permissions-debuginfo-20200127-lp153.24.9.1 4>$  ApbJ>/=„Rp7lJeXtJv>a*4_1sz%V 8vxZ}Xk vܺB;-,zj2Sjs9ӶIK9)Wpz0flSHh*\K F"ǬH[ߘ^j&˹ވ,X=rsc )j9\J:ps`bPtW^spyO4؂:CD/Y\m$ER3ae5b0ebd6f27d93918d00221d7bc1923aab765e6953f920b845e4cc2758d6716a6147e6f51c46fa05ff62ab136c0bbe3d86bd8aڼbJ>/=„!a257"0[u{e٢~J$U,ȷ6M@+T}JԤ+;~fԤ,L[BRZ< H2-%df~N<#ԅKoG+Ql$ F\KN6w+wCmRDcAXa W&  W]d| ܭ}{/hqj#.O^\bYMkgzruszNQ;(jQ#?wgܧk#}'>pAt?td! . X +4= Vh    D ,Xx3(O8X8988: 8FoGoHoIoXoYo\pT]pt^qbqcr4drerfrlrurvswsxtyt zt$t4t8tXtptttztCpermissions-debuginfo20200127lp153.24.9.1Debug information for package permissionsThis package provides debug information for package permissions. Debug information is useful when developing applications that use this package or when debugging this package.bJ;sheep888openSUSE Leap 15.3openSUSEGPL-2.0+http://bugs.opensuse.orgDevelopment/Debughttp://github.com/openSUSE/permissionslinuxx86_64O8AAAAA큤bJ:bJ;bJ;bJ;bJ;bJ:bJ:bJ:ead8ef777e5cfcdbbcf1d36d7e7ea357391b0d19fa672a0eaa648bef7df84fa8../../../../../usr/bin/chkstat../../../../../usr/lib/debug/usr/bin/chkstat-20200127-lp153.24.9.1.x86_64.debugrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpermissions-20200127-lp153.24.9.1.src.rpmdebuginfo(build-id)permissions-debuginfopermissions-debuginfo(x86-64)    rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.14.3bVaaa@`@` l^?@^ϧ^>@^^y@^\@^Y^;^:@^4]@]@]@]@]:\8\b@[@[z@ZiZ\Z%8ZZ@Z@Z@ZNY|Y@Y˒Y@YY@Y7Y2Y1S@W"W@W@WBWBVV@VV2 @V +V +UuT~@TZ@matthias.gerstner@suse.commatthias.gerstner@suse.commatthias.gerstner@suse.commatthias.gerstner@suse.commatthias.gerstner@suse.commatthias.gerstner@suse.commatthias.gerstner@suse.commalte.kraus@suse.comjsegitz@suse.comjsegitz@suse.comjsegitz@suse.commalte.kraus@suse.commalte.kraus@suse.commatthias.gerstner@suse.commatthias.gerstner@suse.comMalte Kraus Malte Kraus Malte Kraus Malte Kraus Johannes Segitz Malte Kraus jsegitz@suse.comjsegitz@suse.comopensuse-packaging@opensuse.orgmatthias.gerstner@suse.commeissner@suse.comkrahmer@suse.comkukuk@suse.commpluskal@suse.comastieger@suse.comrbrown@suse.comkrahmer@suse.comeeich@suse.comjsegitz@suse.comastieger@suse.compgajdos@suse.comastieger@suse.comastieger@suse.comopensuse-packaging@opensuse.orgdimstar@opensuse.orgmeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comkrahmer@suse.comdimstar@opensuse.orgmeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comkrahmer@suse.commeissner@suse.com- Update to version 20200127: * postfix: add postlog setgid for maildrop binary (bsc#1201385)- Update to version 20200127: * base this fork on a SLE-15-SP3 branch instead of on the Factory branch. The Factory branch contains too many unknowns for the far-off Leap 15.3 codebase. * add a couple of cleanup changes that we can on Leap 15.3: - etc/permissions: remove unnecessary static dirs and devices - etc/permissions: remove legacy RPM directory entries - etc/permissions: remove outdated sudo directories- Update to version 20200127: * Makefile: Leap 15.3 still uses /etc, so adjust the installation setup- Update to version 20181225: * mgetty: faxq-helper now finally reside in /usr/libexec * libksysguard5: Updated path for ksgrd_network_helper * kdesu: Updated path for kdesud * sbin_dirs cleanup: these binaries have already been moved to /usr/sbin * mariadb: revert auth_pam_tool to /usr/lib{,64} again * cleanup: revert virtualbox back to plain /usr/lib * cleanup: remove deprecated /etc/ssh/sshd_config * hawk_invoke is not part of newer hawk2 packages anymore * cleanup: texlive-filesystem: public now resides in libexec * cleanup: authbind: helper now resides in libexec * cleanup: polkit: the agent now also resides in libexec * libexec cleanup: 'inn' news binaries now reside in libexec * whitelist please (bsc#1183669) * Fix enlightenment paths * usbauth: drop compatibility variable for libexec * usbauth: Updated path for usbauth-npriv * profiles: finish usage of variable for polkit-agent-helper-1 * Makefile: fix custom flags support when using make command line variables * added information about know limitations of this approach * Makefile: compile with LFO support to fix 32-bit emulation on 64-bit hosts (bsc#1178476) * Makefile: support CXXFLAGS and LDFLAGS override / extension via make/env variables (bsc#1178475) * profiles: prepare /usr/sbin versions of profile entries (bsc#1029961) * profiles: use new variables feature to remove redundant entries * profiles: remove now superfluous squid pinger paths (bsc#1171569) * tests: implement basic tests for new the new variable feature * tests: avoid redundant specification of test names by using class names * regtests: split up base types and actual test implementation * man pages: add documentation about variables, update copyrights * chkstat: implement support for variables in profile paths * chkstat: prepare reuse of config file locations * chkstat: fix some typos and whitespace * etc/permissions: remove unnecessary, duplicate, outdated entries * etc/permissions: remove trailing whitespace * ksgrd_network_helper: remove obviously wrong path * adjust squid pinger path (bsc#1171569) * mgetty: remove long dead (or never existing) locks directory (bsc#1171882) * squid: remove basic_pam_auth which doesn't need special perms (bsc#1171569) * cleanup now useless /usr/lib entries after move to /usr/libexec (bsc#1171164) * drop (f)ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504) * whitelist Xorg setuid-root wrapper (bsc#1175867) * screen: remove /run/uscreens covered by systemd-tmpfiles (bsc#1171879) * Add /usr/libexec for cockpit-session as new path * physlock: whitelist with tight restrictions (bsc#1175720) * mtr-packet: stop requiring dialout group * etc/permissions: fix mtr permission * list_permissions: improve output format * list_permissions: support globbing in --path argument * list_permissions: implement simplifications suggested in PR#92 * list_permissions: new tool for better path configuration overview * regtest: support new getcap output format in libcap-2.42 * regtest: print individual test case errors to stderr * etc/permissions: remove static /var/spool/* dirs * etc/permissions: remove outdated entries * etc/permissions: remove unnecessary static dirs and devices * screen: remove now unused /var/run/uscreens * Revert "etc/permissions: remove entries for bind-chrootenv" * rework permissions.local text (boo#1173221) * dbus-1: adjust to new libexec dir location (bsc#1171164) * permission profiles: reinstate kdesud for kde5 * etc/permissions: remove entries for bind-chrootenv * etc/permissions: remove traceroute entry * VirtualBox: remove outdated entry which is only a symlink any more * /bin/su: remove path refering to symlink * etc/permissions: remove legacy RPM directory entries * /etc/permissions: remove outdated sudo directories * singularity: remove outdated setuid-binary entries * chromium: remove now unneeded chrome_sandbox entry (bsc#1163588) * dbus-1: remove deprecated alternative paths * PolicyKit: remove outdated entries last used in SLE-11 * pcp: remove no longer needed / conflicting entries * gnats: remove entries for package removed from Factory * kdelibs4: remove entries for package removed from Factory * v4l-base: remove entries for package removed from Factory * mailman: remove entries for package deleted from Factory * gnome-pty-helper: remove dead entry no longer part of the vte package * gnokii: remove entries for package no longer in Factory * xawtv (v4l-conf): correct group ownership in easy profile * systemd-journal: remove unnecessary profile entries * thttp: make makeweb entry usable in the secure profile (bsc#1171580) * profiles: add entries for enlightenment (bsc#1171686) * permissions fixed profile: utempter: reinstate libexec compatibility entry * chkstat: fix sign conversion warnings on non 32-bit architectures * chkstat: allow simultaneous use of `--set` and `--system` * regtest: adjust TestUnkownOwnership test to new warning output behaviour * whitelist texlive public binary (bsc#1171686) * fixed permissions: adjust to new libexec dir location (bsc#1171164) * chkstat: don't print warning about unknown user/group by default * Makefile: link with --as-needed, move libs to the end of the command line * setuid bit for cockpit (bsc#1169614) * Fix paranoid mode for newgidmap and newuidmap (boo#1171173) * chkstat: collectProfilePaths(): use directory_iterator to simplify code * chkstat: collectProfilePaths(): prefer /usr over /etc * regtest: add relative symlink corner case to TestSymlinkBehaviour * Chkstat::parseProfile(): avoid use of raw pointer * parseSysconfig(): only emmit warning if value is non-empty * incorporate a bunch of PR #56 review comments * regtest: add test for correct ownership change * chkstat: final pass over refactored code * chkstat: finish refactoring of safeOpen() * chkstat: improve/fix output of mismatches * chkstat: support numerical owner/group specification in profiles * chkstat: safeOpen: simplify path handling by using a std::string * chkstat regtest: support debug build * chkstat: start refactoring of safe_open() -> safeOpen() * chkstat: processEntries: pull out change logic into applyChanges() * chkstat: processEntries: pull out safety check logic * chkstat: processEntries: separate printing code and simplify ownership flags * chkstat: processEntries: also add file_status and *_ok flags to EntryContext * chkstat: processEntries: also add caps to EntryContext * chkstat: also move fd_path into EntryContext * chkstat: processEntries(): introduce EntryContext data structure * chkstat: introduce class type to deal with capabilities * chkstat: overhaul of the main entry processing loop * chkstat: smaller cleanup of Chkstat::run() * chkstat: remove last global variables `root` and `rootl` * chkstat: refactor parsing of permission profiles * chkstat: replace global `permlist` by STL map * chkstat: remove now obsolete usage() function * chkstat: refactor collection of permission files * regtest: support --after-test-enter-shell * chkstat: change global euid variable into const class member * chkstat: replace global level, nlevel by a vector data structure * chkstat: refactor check_fscaps_enabled() * chkstat: refactor parse_sysconfig as a member function Chkstat::parseSysconfig * chkstat: introduce separate processArguments() and refactor --files logic * chkstat: replace C style chkecklist by std::set * chkstat: refactor command line parsing * allow /usr/libexec in addition to /usr/lib (bsc#1171164) * whitelist s390-tools setgid bit on log directory (bsc#1167163) * whitelist WMP (bsc#1161335) * regtest: improve readability of path variables by using literals * regtest: adjust test suite to new path locations in /usr/share/permissions * regtest: only catch explicit FileNotFoundError * regtest: provide valid home directory in /root * regtest: mount permissions src repository in /usr/src/permissions * regtest: move initialialization of TestBase paths into the prepare() function * chkstat: suppport new --config-root command line option * fix spelling of icingacmd group * chkstat: fix readline() on platforms with unsigned char * remove capability whitelisting for radosgw * whitelist ceph log directory (bsc#1150366) * adjust testsuite to post CVE-2020-8013 link handling * testsuite: add option to not mount /proc * do not follow symlinks that are the final path element: CVE-2020-8013 * add a test for symlinked directories * fix relative symlink handling * include cpp compat headers, not C headers * Move permissions and permissions.* except .local to /usr/share/permissions * regtest: fix the static PATH list which was missing /usr/bin * regtest: also unshare the PID namespace to support /proc mounting * regtest: bindMount(): explicitly reject read-only recursive mounts * Makefile: force remove upon clean target to prevent bogus errors * regtest: by default automatically (re)build chkstat before testing * regtest: add test for symlink targets * regtest: make capability setting tests optional * regtest: fix capability assertion helper logic * regtests: add another test case that catches set*id or caps in world-writable sub-trees * regtest: add another test that catches when privilege bits are set for special files * regtest: add test case for user owned symlinks * regtest: employ subuid and subgid feature in user namespace * regtest: add another test case that covers unknown user/group config * regtest: add another test that checks rejection of insecure mixed-owner paths * regtest: add test that checks for rejection of world-writable paths * regtest: add test for detection of unexpected parent directory ownership * regtest: add further helper functions, allow access to main instance * regtest: introduce some basic coloring support to improve readability * regtest: sort imports, another piece of rationale * regtest: add capability test case * regtest: improve error flagging of test cases and introduce warnings * regtest: support caps * regtest: add a couple of command line parameter test cases * regtest: add another test that checks whether the default profile works * regtests: add tests for correct application of local profiles * regtest: add further test cases that test correct profile application * regtest: simplify test implementation and readability * regtest: add helpers for permissions.d per package profiles * regtest: support read-only bind mounts, also bind-mount permissions repo * tests: introduce a regression test suite for chkstat * Makefile: allow to build test version programmatically * README.md: add basic readme file that explains the repository's purpose * chkstat: change and harmonize coding style * chkstat: switch to C++ compilation unit * remove obsolete/broken entries for rcp/rsh/rlogin * chkstat: handle symlinks in final path elements correctly * Revert "Revert "mariadb: settings for new auth_pam_tool (bsc#1160285)"" * Revert "mariadb: settings for new auth_pam_tool (bsc#1160285)" * mariadb: settings for new auth_pam_tool (bsc#1160285) * add read-only fallback when /proc is not mounted (bsc#1160764) * capability handling fixes (bsc#1161779) * better error message when refusing to fix dir perms (#32) * fix paths of ksysguard whitelisting * fix zero-termination of error message for overly long paths * fix misleading indendation * fix changing of capabilities * fix warning text for unlisted files * fix error message with insecure sym links * remove useless if around realloc() * fix invalid free() when permfiles points to argv * use path-based operations with /proc/self/fd/X to avoid errors due to O_PATH * add .gitignore for chkstat binary * add/fix compiler warnings, free memory at exit * only open regular files/directories without O_PATH, fix stat buffer initialization * update * rewrite while protecting against symlinks and races * fix whitespace * faxq-helper: correct "secure" permission for trusted group (bsc#1157498) * whitelist ksysguard network helper (bsc#1151190) * fix syntax of paranoid profile * fix squid permissions (bsc#1093414, CVE-2019-3688) * setgid bit for nagios directory (bsc#1028975, bsc#1150345) * global: removal of unneeded SuSEconfig file and directory * global: restructure repository layout * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687) * add one more missing slash for icinga2 * fix more missing slashes for directories * cron directory permissions: add slashes * iputils: Add capability permissions for clockdiff * iputils/ping: Drop effective capability * iputils/ping6: Remove definitions * singluarity: Add starter-suid for version 3.2.0 * removed entry for /var/cache/man. Conflicts with packaging and man:man is the better setting anyway (bsc#1133678) * fixed error in description of permissions.paranoid. Make it clear that this is not a usable profile, but intended as a base for own developments * Misleading comment fix * removed old entry for wodim * removed old entry for netatalk * removed old entry for suidperl * removed old entriy for utempter * removed old entriy for hostname * removed old directory entries * removed old entry for qemu-bridge-helper * removed old entries for pccardctl * removed old entries for isdnctrl * removed old entries for unix(2)_chkpwd * removed old entries for mount.nfs * removed old entries for (u)mount * removed old entry for fileshareset * removed old entries for KDE * removed old entry for heartbeat * removed old entry for gnome-control-center * removed old entry for pcp * removed old entry for lpdfilter * removed old entry for scotty * removed old entry for ia32el * removed old entry for squid * removed old qpopper whitelist * removed pt_chown entries. Not needed anymore and a bad idea anyway * removed old majordomo entry * removed stale entries for old ncpfs tools * removed old entry for rmtab * Fixed type in icinga2 whitelist entry * New whitelisting for /usr/lib/virtualbox/VirtualBoxVM and removed stale entries for VirtualBox * Removed whitelist for /usr/bin/su.core. According to comment a temporary hack introduced 2012 to help moving su from coretuils to util-linux. I couldn't find it anywhere, so we don't need it anymore * Remove entry for /usr/bin/yaps. We don't ship it anymore and the group that is used doesn't exists anymore starting with Leap 15, so it will not work there anyway. Users using this (old) package can do this individually * removed entry for /etc/ftpaccess. We currently don't have it anywhere (and judging from my search this has been the case for quite a while) * Ensure consistency of entries, otherwise switching between settings becomes problematic * Fix spelling of SUSE * adjust settings for amanda to current binary layout- Update to version 20181225: * etc/permissions: remove unnecessary entries (bsc#1182899)- Update to version 20181224: * pcp: remove no longer needed / conflicting entries (bsc#1171883, CVE-2020-8025)- Update to version 20181224: * profiles: add entries for enlightenment (bsc#1171686)- whitelist texlive public binary (bsc#1171686)- Remove setuid bit for newgidmap and newuidmap in paranoid profile (bsc#1171173)- correct spelling of icinga group (icingagmd -> icingacmd, bsc#1168364)- whitelist s390-tools setgid bit on log directory (bsc#1167163)- run testsuite during package build - Update to version 20181224: * testsuite: adapt expected behavior to legacy branches * adjust testsuite to post CVE-2020-8013 link handling * testsuite: add option to not mount /proc * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922 * add a test for symlinked directories * fix relative symlink handling * regtest: fix the static PATH list which was missing /usr/bin * regtest: also unshare the PID namespace to support /proc mounting * Makefile: force remove upon clean target to prevent bogus errors * regtest: by default automatically (re)build chkstat before testing * regtest: add test for symlink targets * regtest: make capability setting tests optional * regtest: fix capability assertion helper logic * regtests: add another test case that catches set*id or caps in world-writable sub-trees * regtest: add another test that catches when privilege bits are set for special files * regtest: add test case for user owned symlinks * regtest: employ subuid and subgid feature in user namespace * regtest: add another test case that covers unknown user/group config * regtest: add another test that checks rejection of insecure mixed-owner paths * regtest: add test that checks for rejection of world-writable paths * regtest: add test for detection of unexpected parent directory ownership * regtest: add further helper functions, allow access to main instance * regtest: introduce some basic coloring support to improve readability * regtest: sort imports, another piece of rationale * regtest: add capability test case * regtest: improve error flagging of test cases and introduce warnings * regtest: support caps * regtest: add a couple of command line parameter test cases * regtest: add another test that checks whether the default profile works * regtests: add tests for correct application of local profiles * regtest: add further test cases that test correct profile application * regtest: simplify test implementation and readability * regtest: add helpers for permissions.d per package profiles * regtest: support read-only bind mounts, also bind-mount permissions repo * tests: introduce a regression test suite for chkstat- Update to version 20181224: * whitelist WMP (bsc#1161335) * Makefile: allow to build test version programmatically * chkstat: handle symlinks in final path elements correctly * add .gitignore for chkstat binary * faxq-helper: correct "secure" permission for trusted group (bsc#1157498) * fix syntax of paranoid profile- Update to version 20181224: * mariadb: settings for new auth_pam_tool (bsc#1160285) * chkstat: capability handling fixes (bsc#1161779) * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594) * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore remove all of the following patches which are now included in the tarball: - 0001-whitelisting-update-virtualbox.patch - 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch - 0004-var-cache-man.patch - 0005-singularity-starter-suid.patch - 0006-bsc1110797_amanda.patch - 0007-chkstat-fix-privesc-CVE-2019-3690.patch - 0008-squid-pinger-owner-fix-CVE-2019-3688.patch - 0009-chkstat-handle-missing-proc.patch - 0010-chkstat-capabilities-implicit-changes.patch Because of inconsistencies between the upstream branch and the package state the following previously missing changes are introduced by this update: - Update to version 20181117: * removed old entry for rmtab * Fixed typo in icinga2 whitelist entry- fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch) - fix capability handling when doing multiple permission changes at once (bsc#1161779, 0010-chkstat-capabilities-implicit-changes.patch)- fix invalid free() when permfiles points to argv (bsc#1157198, changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414, CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)- fix privilege escalation through untrusted symlinks (bsc#1150734, CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch (bsc#1110797)- Added ./0005-singularity-starter-suid.patch (bsc#1128598) New whitelisting for /usr/lib/singularity/bin/starter-suid- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man. Conflicts with packaging and man:man is the better setting anyway (bsc#1133678)- Added 0001-whitelisting-update-virtualbox.patch (bsc#1120650) New whitelisting for /usr/lib/virtualbox/VirtualBoxVM and removed stale entries for VirtualBox - Added 0002-consistency-between-profiles.patch Ensure consistency of entries, otherwise switching between settings becomes problematic - Added 0003-var-run-postgresql.patch (bsc#1123886) Whitelist for postgresql. Currently the checker doesn't complain because the directories aren't packaged, but that might change and/or our checkers might improve- Update to version 20181116: * zypper-plugin: new plugin to fix bsc#1114383 * singularity: remove dropped -suid binaries (bsc#1028304) * capability whitelisting: allow cap_net_bind_service for ns-slapd from 389-ds * setuid whitelisting: add fusermount3 (bsc#1111230) * setuid whitelisting: add authbind binary (bsc#1111251) * setuid whitelisting: add firejail binary (bsc#1059013) * setuid whitelisting: add lxc-user-nic (bsc#988348) * whitelisting: add smc-tools LD_PRELOAD library (bsc#1102956) * whitelisting: add spice-gtk usb helper setuid binary (bnc#1101420) * Fix wrong file path in help string * Capabilities for usage of Wireshark for non-root - remove 0001-whitelisting-add-spice-gtk-usb-helper-setuid-binary-.patch: is now contained in tarball.- 0001-whitelisting-add-spice-gtk-usb-helper-setuid-binary-.patch: add whitelisting for the spice-gtk setuid binary (bsc#1101420) for improved usability.- Update to version 20180125: * the eror should be reported for permfiles[i], not argv[i], as these are not the same files. (bsc#1047247) * make btmp root:utmp (bsc#1050467)- Update to version 20180115: * - polkit-default-privs: usbauth (bsc#1066877)- fillup is required for post, not pre installation- Cleanup spec file with spec-cleaner - Drop conditions/definitions related to old distros- Update to version 20171129: * permissions: adding gvfs (bsc#1065864) * Allow setgid incingacmd on directory /run/icinga2/cmd bsc#1069410 * Allow fping cap_net_raw (bsc#1047921)- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- Update to version 20171121: * - permissions: adding kwayland (bsc#1062182)- Update to version 20171106: * Allow setuid root for singularity (group only) bsc#1028304- Update to version 20171025: * Stricter permissions on cron directories (paranoid) and stricter permissions on sshd_config (secure/paranoid)- Update to version 20170928: * Fix invalid syntax bsc#1048645 bsc#1060738- Update to version 20170927: * fix typos in manpages- Update to version 20170922: * Allow setuid root for singularity (group only) bsc#1028304- Update to version 20170913: * Allow setuid for shadow newuidmap, newgidmap bsc#979282, bsc#1048645)- Update to version 20170906: * permissions - copy dbus-daemon-launch-helper from / to /usr - bsc#1056764 * permissions: Adding suid bit for VBoxNetNAT (bsc#1033425)- BuildIgnore group(trusted): we don't really care for this group in the buildroot and do not want to get system-users into the bootstrap cycle as we can avoid it.- Require: group(trusted), as we are handing it out to some unsuspecting binaries and it is no longer default. (bsc#1041159 for fuse, also cronie, etc)- Update to version 20170602: * make /etc/ppp owned by root:root. The group dialout usage is no longer used- Update to version 20160807: * suexec2 is a symlink, no need for permissions handling- Update to version 20160802: * list the newuidmap and newgidmap, currently 0755 until review is done (bsc#979282) * root:shadow 0755 for newuidmap/newgidmap- adding qemu-bridge-helper mode 04750 (bsc#988279)- Introduce _service to easier update the package. For simplicity, change the version from yyyy.mm.dd to yyyymmdd (which is eactly %cd in the _service defintion). Upgrading is no problem.- chage only needs read rights to /etc/shadow, so setgid shadow is sufficient (bsc#975352)- permissions: adding gstreamer ptp file caps (bsc#960173)- the apache folks renamed suexec2 to suexec with symlink. adjust both (bsc#962060)- pinger needs to be squid:root, not root:squid (there is no squid group) bsc#961363- add suexec with 0755 to all standard profiles. this can and should be overridden in permissions.local if you need it setuid root. bsc#951765 bsc#263789 - added missing / to the squid specific directories (bsc#950557)- adjusted radosgw to root:www mode 0750 (bsc#943471)- radosgw can get capability cap_bind_net_service (bsc#943471)- remove /usr/bin/get_printing_ticket; (bnc#906336)- Added iouyap capabilities (bnc#904060)- %{_bindir}/get_printing_ticket turned to mode 700, setuid root no longer needed (bnc#685093) - permissions: incorporating squid changes from bnc#891268 - hint that chkstat --system --set needs to be run after editing bnc#895647sheep88 16578831952ebff9cf4c4b97fb3f664ff262a1ef390943fc7d20200127-lp153.24.9.120200127-lp153.24.9.1debug.build-id2ebff9cf4c4b97fb3f664ff262a1ef390943fc7dbff9cf4c4b97fb3f664ff262a1ef390943fc7d.debugusrbinchkstat-20200127-lp153.24.9.1.x86_64.debug/usr/lib//usr/lib/debug//usr/lib/debug/.build-id//usr/lib/debug/.build-id/2e//usr/lib/debug/usr//usr/lib/debug/usr/bin/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:17576/openSUSE_Leap_15.3_Update/3cb3850389ffe36adc470a8b150bd088-permissions.openSUSE_Leap_15.3_Updatecpioxz5x86_64-suse-linuxdirectoryELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=2ebff9cf4c4b97fb3f664ff262a1ef390943fc7d, for GNU/Linux 3.2.0, with debug_info, not strippedPaxdWPu/permissions-debugsource(x86-64)20200127-lp153.24.9.1utf-88cd94cc6a795e094699a1d892f158d641b3f411cdb3d2a735db4980247c60162?7zXZ !t/at] crt:bLL Dg`&4">܎y_W/njF&jw FoQ,ܲ MI዆Xrgn4Хj7c}[ ܣ/NNöurxtңEsìTl7w<{~YxzԦ =;+x7- Lhݔr f-oAоlo&My߬?QY8Kim!̂WtJFz}MwZ*f(wT 9tX?V%-j7?z|@i4NFVs5FD kXk􈾟y3٫B~4mEnШ%uN>1Fs悮ir-!J9?}QZQ$^F|]?>,dO,qĤ7l/WYdyn%=Zsʱvq&{*󤃮 (cPlS6䉍teuU$ZQ;M-cՉ{atycɅf`WVᙿ&RI%%|+^6dv|u]G rN!O41e˂J,~z$՟ ƭ0)6ʻ8ڷ|w(-bO3'+p>[6HEѨl^,O]`t8&_-ᅹ}NA]S1Tj@C.0izs<u{0O)Cm f7zg ~ W|8EM&C xAHF".PP:%y\@๬Dx3!|I,u*ׂy,ЕF=VJX]Kh) *V$Ғ@DᄃLQZ,"Hڛk.Z: Mg ,apŇ7{oH29afF? j.(x LtL8LPLXdߨreNt|?k@n ꈱ!xÕ۫Tl;]L=FwzK' P6S!#io+P[T}Q/0YZBypxHt9}dmJ=}dkL>Fu? AB;\s7,q6l>(D.I psY'v '1b> }dzs9[Rw lӸN=&368`+riSkn/Aɍ$Gǫ{c^ئuH$4%* qPG#Z v$%5O=#3F./ @Kk E),HO*Cǩ |Ǧm~bIRE{ymn4g)֠@2z̚]47%a"<+"dS`=gt䮌 ͆6=@y 8LZa3b2V1nu{yкQu@:q4rzD kme;:O%Y{1>79H~S>}Κ33!2?~p+3[d[\%?1<[ ׻t1-#J܃ g9rлt:O8vc~(Bh8AAg l-LCtL0.eK/3pp+P@m܉/u|g`ZV^EMMl.m:k8E f"i2q`ֲ#@Xd_Y3Ȕ{rꦴ_`/E*0^C #s.ӤL?7l=$qiIR0qO|#dCvn n%I37ߊ` h7Ҷ؊'X T(j > /.gzDfOaULϺsV%uqUsI1%wdW7u6*)*$W|lF%p RjVB e ~ T&"(^*uJAP 4dXPތri}epc UsX\Modv[9/K?`R`ɢ|޹o2])==7W_%U-]K0<>7%T(|E#DytrnqƉxtb,# 0eG~SZn*A bEn 7!bά X/d}CO:^E]~QyR. R4to qF.ηHTMYUi5m0"98ݐXItZvȼ~[tRe+Ms(Tbx\D' e.(<@t%{ { }C(7K:G? ԕ(|jdQy2]S2Yc{P)d /'JRqu D]pvkczg1E'%Zю&0g 'sѹ6,N db}r_Ӧ`aV OtTdW;1Bң%xKYWN/A3 x:ɯ,D m`@hY>μhw۩Q)#N( 'jOoۆm9ԎheHy`O!gK+QF_Eĭbш(,U5ɛ@hfAG3:pkan\SR;7:k-=uϗ*p%B=P異EIѴ,]otY-nwy&-J,?!\ A"kQ?><˭cmG]m>9?  S(">K`WE>`Di; j6B"I|i2h4MkF,{&UhۺDHrevs˳{wk8~}-qz3Վ4JD5mьW(ԋݢr,dG9S+-|v!.dic[ zb6;r՗ň+mwTNB'R3SN8Bi{Sk~)Ñ []J_&C<G̋3gG9qc [|>^V9lvෂ0npGd&qđL}n(MzghѸ)i].DxdXY.i'#EvɜCիG[Zbo\Ϭd&⎐'+37К{IєƊjE捺8o*˹a>)L|8!/.Ŋ$k*wUc:r`ȴ ғDYb0'4= ri av:j&,M)JWI;NXrȝk@EmKA]~էkm!wSAAUɫ0YMHsgih}YS5H. gm#2Y,sl%쳑A*_* }.Z4Hg@]uOA6r5"\a4!]z7>梌Άx_v|ɬ?2XT$VxNO{fn` 9@UvRh "j-N%V#,'ov҈q'ts?4`Dؠ2'{NBZ=o#y^^ V+cwkkI<{{UQb">!H.dϰ!~@fu_;=*sGcӜ 52r)bIX>tpt-\^d"2-`G|U5$X0KL.txZ# Zˍ_SETa!lu93EE%Ӕm 9*oq)x3/E^ᗭdmYFRtB?T}bdt9f?'[-5ۙr$",9|qv2Kps j0dECQkL#ϝbt! k4^lA#󯹌Ѱ *rfZ%s؃W;mOeJu3ܘGϠ?\~1&7o>"qqqx,:/R~RH޼)y_ 9¨`~by &Z-͙h(bm;G}r?`Sq&fDej@2Ć걾D>ONɎH0s{Np { ka;V*F-^ &t(4ueTeRﴻp3NUKCݗ oGvvĜ.<@gG6淰]WGk {vVɾHgEZhm2Ԥ'_T@S\J4|*3}wʖOՖe&moƅ e {qSnR&SQ,iE WƿW%e"f$\叫(E/PM7EbJV6@ y{_OH*J1~7m_K10s#??(FPXqn[*ǻPQ1x!׃)+aaoEILJ̊sP7A9蝼(5nB*5*Â^5FZYH-@-H]抳}Mr9JͥHC?AdQyժ/,:%{0|mH7S ^8O cq UEKl?pЎ ؈,>?R]J}VCBxl`ĸ]?#ZYHe/3GDSË8?ٰX'Ea *.;Hn>˝!‘ ve;܁ȡi+Dž6 RXʩn>1? R!} MDЗ C)C4lv­R>xU8"G$wR T*#}iە7kyI ֕5^<"/4e`GuEݴ3ruʄ#dG'Ҳhj ؈(4?=0 Ϫӆ.۝yϜѰY! }씢lp} fGIC!Bċ8Q=j1 0l&8[$֖6$-eZA@|OWs=ZadWY7X>a]m;DR7;<20f[b-^F]r(QVqgT*8A͗-1JN:Z~*vLNmZ`&/i8!ˌ* A@ߦFȿa[ܝ)95l ZĮ0gF}~Q-<u5>ZتXkaY5ulrLÈ}MpR}q`v/7ǠQ\t<;Xǀ2a~0 \x[TGmgjsT()<۝usmdLfK׊e!V-BWe 'Å )d+wa^+3$0SM chfW dZf<úB M #%~r-V1&ڲGKމq mK\h<^E "z|3Zk Se#L1(-M<=F,G1C$&9ZWIIL5J'w|#|bMbxi=w sC3]q3NǞuҮQ1ז9}`)u9\Y(y\?lY¼K}ID6k:[ ֢Lq )dı|rUo0!_b 'LVH4|ꋨAᕅuL tr7}W0=]u`[TW{ZkALF2}mOo!.sjH 1Ҧc34|xDP0 &HOs8I(a Yp/ +l@48-'8E@߂:2ԢWjDDa7 4}i;]b2tKMXՕןDPl$)H]Iiica q3МVϑ [m 9&s6fV9:Uc9ڙ0'_ii,9]nmh%4PҾ ;11'ϤDk?&|1DHXB|,&枮@İ"ۣm%J } +e (k{R+Nɗ/>Ȓ"͇Ǥ-(\NqR=S/, K&6١w ~^8c0gwoLzlj^C_ eGٕY+dCSe Pr%qᰮnmdjjy&ï=`fQ,ѶW5?* bc.~q,F[ʭV_:~^; niҬDԐCd /avl'@ 2,PS)GO ^i-q93/oɟ鲠% MsˈVy\**@h ^BH:wʬ&u8`}bhh?nȽ_|S{-T {n|֣7#̩}r#_ ?%jk~}(.~dUb$Yc\Ф[:V`8S-4]Bm̆}eO6{-$0ۅVE߳75D:R }1/_y|w5MT刡㱦i/8e;Yo%W[^5pJHhx!澠 zq!=dfq(4w?B\# 3T3ҥor/tm5)1};FJ8Ngx+*^ AϹK2˩FHO ,nO)`֠f4'QyI.Q?v|ZjL')L]9'A$b5"!mUZU!S3_,a+< .ڕb>rB# G+["'_n]H Bx75dFlOb9d5K9T Eæm0Xܾ&D~fe F-q͸0tGyE:_D!4}و'7N]<ܽAKCaA]x]OGgS0 CA~Q$In$?.D5-_' g#}d{VW7ɏp4T u^k=5gK8$qVᵘ L]m(tIg(M W#6xD,Teg}hMMڜI~dCG=*;l~PudepLgAzyx/1**td>FCưo``;MaIo>bTa\% AǯI٬A.jQ}} ($dDxMǸj+_+Nx.KɨJ97udW|(ՐhAWbs5kJ? ds4- ǰO& 8^|{/kZ5xX[2]x+ x6JxOǼ P 9P?Ai}@_.N\r x%-ʽ8J_ؤv|ߵا!ED'g׮jli\S=@a-cO $"ccjsV̶!A\2V0?^)O%4 *<7b:fʫb (t) RӬ+cnAC> sIpJ.xsdiCø&Lxʄsz4/*'™[6bRE5)`e<;(Jn u-˶|9Kpt_`SNY>kuøsWr;65lKݎTeqka u61yLV;Ez Ed7S[kt=Y"sS.g$Q\m}yl"e2>br+ |Uyf|/|Ke&=][sb˪ln0_y|g<SAvNQ?]kY$iˑS?Tzu_a0"/r8//pR7AO+c)S-ؑ@ň'АoKDd XWhUCկF˼lAKLʄ(8 rWr|-CL_93'tlH{Ɗr%8*{8 QPAzLz!c6 ;9B=9sz p睧krY+.gs~3m| M;x.ŨKN4{9+4 wћaEdEl8Lp)N~jzv$yL9LYh;AߣL4bZ’=X~!B2+Vϫ- J]mCCo=+(̱@yMc'6QjD\LY&llYed~w.m#}z\+bO_veǂA s e-\l ub_fiO쑲ISj{ |ٜ%șQ(u$mړ˅$$)jf µx]Y)Tx М?'[Jbͷv4bQ0JshUXK` b%e¬bђ{pCJ^LHX'>lٶԊ'֓[*kI-jگ>TA4o$ om,[JI,( ݗiq?z X0e:r ܺ/t` 6D-$5{ERH6-^Dg%S<֡ḱk֟LB =cx!S0%jrRPQS(5@]̭Rޫ/D;VdFONax]7JNyOVɶ~?8ay ]6К5LEmhlg8Y092zPebP3u0_BoOԄ ?ОƜfv"B" mI!ܼۆڊN8nۇ+X(߂&|7NOT+E 3,2*0#2{w3g7=4Ac &MI1Y wqM¶BDf{./\P6y=Y'kǵi/jx1멯9&@0ͽ E}Տg٨GM3qx= Ƚ_L,0ivAk;ێ20 SćG.9p;.y`ĩ]3SdP" z7 \T"K[jӽ- hɬ}NbJqؠ_n;WזP~~UfTYCR o,F&Մ~ |9}}]GT4" ܯ+K=Ł_nǕRu Fz 4 ݶg^{t|;ę.RLAif R[0JxTjc^-i<[C(kl(v`%*>^/(CGLskTte XQ1xt8^y åx$ zpOSj/ڡӄz}> BgI;JCs\.>ORt& zJHƜTN^o02vWnCc(md6t0 6"j+ FhNM<<7:]rE!}+g1ט$+-+Er!w؀.QN]޺Tw.OvEvvq^N_ Y7Ib04F(4 u&6[ʝ].TeVbD^Yt0 Gcb Fk0ŀl;0<2)B%<{)fbBٝ SfcAhȉd*?uzt4z4;!@,ZmԮe7C|&Y?=֠HMGiRnVVsv$2e8o)ߎJxhX$wev#uPͲa8( ;P&PJEoЄwNBtek~*R<;cPs[ ,Xi̢ `w3lOOr@1О]x+Dnf|.,ǧ+>ަƗ &p#0zmrN%H 4Km_Cu'n@'Bnm6zr_h:ۛ VΟ1†$]Dmɳ;jjPUO^/s}AZyӋ |cɱpFtIxC-?j,M$V%M"zAHP7"4m[khY'B:3%HC&F;xy{q<Ùi0GuFⰸ&qcK<'߹f+04f/"2fnZj:w7PkKPMUe*BQ72o!OUz4מZ—9_ B/HnDOh## <}&x 9>&,,&,"z[ʶ+{Sar3Z~hw#[ ĩz.wBr 6CE:AkUF> [1{Qb9Nl=kjq"t#?a" #BZ| ɗuMwLWc[f>"O:q^)Ԣ*ͶgMV# 7nZ g,(c7?u//?"XpUP|Vg 3i$کR0tDKXкE{37FKrпu{e-z9 Ų,IF2].^}_i|.VБjjxs]en KL^΄c@Id*)GĴ2VClϔgID?|8d "TAD+̗xuz#%MGIkeK+.qXcY]FDVa5KUH9 cW1Gvnv^zNq' J .2bJ]iRMNo_%=M;n悓 H?+VYJXl_"@zE25X2#3Ƃ ? @97,ed M1CCDz7eJ=2?$|m=XZv N?i_M$ ~nt1|lxV4,c>Lf7DI*.%W d"˩"<|KtEnBjNx%=ibtƺSO7"`*|J[V~0ʢ"?t}$P[l8 L-򽓪iV[2 APW 9.2N8d.-fz=,3{dևwxXjP:m~ȠE}[@@^#q8q$G3V_Gm:bHt9vShإXyI罬9whFWY]0:dIj|Lm^zX)ju؋R܈ eoujd$<rdJA;*qOn",F}晵Pn+Ϥ JIQcjLv[P56n8[gÈ9'4Ԥm؏Nw|z\'kOloʀS-'XNd-,7y(8t}7J˚lѺ$ ηDEY՜CY24 e(g,$+AQj'J/t͞Ġt0&&.E4lS9 X]j=8t.>vv/aǞ .WqSB.x?1W>?/X&UaJ',Pbd.=y ΂^ 5^TV\J!ۊ Dzȱ'',jc2 T/dpEx$<ݪyXQ $B+2@Z =}Xzuh%'("a>QRSd"-9%R/$E f/ UHWz}]p~)i~VXGuN:=~doEE8Jp ʹ*n_p`sZ|+'ez[S2}؊wb hXhkgt̕'%-n5]I݅G16v a&tFBlu*=[H .B~ʦ:2ѳjDg7S 0Vd4+^(VL/ tF|4Of@.څ 7*ؿe|d]#zMbIU'Pfml!7$~+=BO()=:%f_Bz=ǜ{&dlQy<u>1DO_b"F_k " >|l9?z_c jjC`f K?WӗtyYh< U{lT{W,N'RR_$978mVXq4Y#!9-H쫢 2WJAdfuɛRj1Wũo/z~EEa֫URd6rkJpÌ?n0:B!p} sf7F8Ygi sEd'16J*`RߣgԕD>9P)qnӹ͏j\ ܑj =BN_ |K,r 'm8.Dp & .z0)C˅>HNڣ#y%ИKɖkka30:>[R77NvY#N~v"J}7YX} =I%=c$9 7{)v V;-e5UaJ Lhր|t]R% =8f=v3/5(] 7M_. ʯƑ>8q^9̜pTE`SQ  F}\gZ5Or`QU:L~]670Hd )|<`S20X?< o7}rlsMNEOZ]BY) bV 2G-VI ӅϴJ.}N2A 3=^"btIOp̠&"݅n2E,Ʃx7d;R,"ӪS2d_~ē*T%K'10"_.7sS'2ǷTHXN&*dP?~r)2Y o')RHՀwZȅ\;2!K١ *Gv.[@3#Dk ȓ!owtCKl.t;p<e/Q**[  i!ɩ<[Xa#D_.R_'7sS.:kfE17I(j#.Py-]KzM~9t ,"NJ 3*0J:{/x&mݹ0Jh/-9f\w&b~Wz3shˆT5[7Q_C"5>fygMɢhB=*q1%l|}P%J^3n[{ސRu9耶Lq+=yjCrz5iy⋛=<mRQvZk[?u"%ͽ < ['ʯUc4UJ\\K$:wUg:k3FKu; YY@~E縓(j7_HU!c|QC,ꭄ{# NMt=_!ȧ,'Krw0KeoSIVPܹm#qcp$HJk%}|mDHbG2{+{O7ҘбL6*מgkٓs&h(|X+az .muk)[u*J"HvT2,s  YZ