Johannes Segitz

**Describe the bug** A comeback of #579. The base problem is that if a user (or a script) ever runs the command iptables the iptables modules are loaded. Then the...

tests_filesystems: check for blacklisted modules also under /usr/lib/modules.d

2

On newer (open)SUSE systems and probably also other systems that move distribution config files to /usr the files live there

and something goes wrong. This is not something that should just be logged. Fail to make sure that the user notices that and can act on it

It's not installed everywhere, causing this error message: /usr/share/lynis/include/tests_mac_frameworks: line 161: permissive: command not found /usr/share/lynis/include/tests_mac_frameworks: line 162: permissive: command not found

Predictable filename in /tmp

1

In /usr/bin/powerline-daemon on non-linux systems: 33 USE_FILESYSTEM = not sys.platform.lower().startswith('linux') a predictable filename is used in /tmp 438 if USE_FILESYSTEM: 439 address = '/tmp/powerline-ipc-%d' that allows local attackers to take...

### Missing feature We (SUSE security team) had a look at this software (https://bugzilla.suse.com/show_bug.cgi?id=1202928). We noticed that the assumption seems to be that this is running on a uncompromised, single...

allows for systemd hardenings to be applied to the daemon

Using GPUs to accelerate workloads requires the permissions guarded by container_use_xserver_devices. By default it's disabled

Harden XML parsing

3

Orignal report: https://bugzilla.suse.com/show_bug.cgi?id=1143658 This module parse potentially untrusted XML. Without precautions this can result in DoS, network connections to machines in the internal network etc. For details please see the...