This update for watchman fixes the following issues:
- ship README.suse that explains how to use the template systemd units
- add user writable bit for systemd service and socket files
- properly handle state directory creation in /run/watchman/$USER-state.
The former approach was susceptible to a local privilege escalation
using symlinks (CVE-2022-21944, boo#1194470).
- Added hardening to systemd service(s) (boo#1181400). Modified:
* watchman@.service
- removed python2 bindings
- enabled python3 bindings as python3-watchman
- Changes in 4.8.0:
* New command `flush-subscriptions` to synchronize subscriptions
associated with the current session.
* Enforce socket Unix groups more strongly ??? Watchman will now
refuse to start if it couldn't gain the right group memberships, as
can happen for sites that are experiencing intermittent LDAP
connectivity problems.
* pywatchman now officially...
Read the Full AdvisoryPatch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP3:
zypper in -t patch openSUSE-2022-16=1
- openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64):
python3-watchman-1.4.0-bp153.2.3.1
watchman-4.9.0-bp153.2.3.1
https://www.suse.com/security/cve/CVE-2022-21944.html
https://bugzilla.suse.com/1181400
https://bugzilla.suse.com/1194470
Get the latest Linux and open source security news straight to your inbox.