Table of Contents

• 1) Introduction
• 2) Symlink Attack in /var/log/below/error_root.log
• 3) Further Issues
• 4) Bugfix
• 5) CVE Assignment
• 6) Hardening Suggestions
• 7) Timeline
• 8) References

1) Introduction

Below is a tool for recording and displaying system data like hardware utilization and cgroup information on Linux. In January 2025, Below was packaged and submitted to openSUSE Tumbleweed. Below runs as a systemd service with root privileges. The SUSE security team monitors additions and changes to systemd service unit files in openSUSE Tumbleweed, and through this we noticed problematic log directory permissions applied in Below’s code.

The version we reviewed in this context was v0.8.1 and this report is based on that version.

Upstream released a bugfix in version v0.9.0 and a security advisory on GitHub.

2) Symlink Attack in /var/log/below/error_root.log

Below’s systemd service runs with full root privileges. It attempts to create a world-writable directory in /var/log/below. Even if the directory already exists, the Rust code ensures that it receives mode 0777 permissions:

    if perm.mode() & 0o777 != 0o777 {
        perm.set_mode(0o777);
        match dir.set_permissions(perm) {
            Ok(()) => {}
            Err(e) => {
                bail!(
                    "Failed to set permissions on {}: {}",
                    path.to_string_lossy(),
                    e
                );
            }
        }
    }

This logic leads to different outcomes depending on the packaging on Linux distributions:

• in openSUSE Tumbleweed the directory was packaged with 01755 permissions (below.spec line 73), thus causing the set_permissions() call to run, resulting in a directory with mode 0777 during runtime.
• in Gentoo Linux the directory is created with mode 01755 resulting in the same outcome as on openSUSE Tumbleweed (below.ebuild). Where the 01755 mode is exactly coming from is not fully clear, maybe the cargo build process assigns these permissions during installation.
• in Fedora Linux the directory is packaged with 01777 permissions, thus the set_permissions() code will not run, because the if condition masks out the sticky bit. The directory stays at mode 01777 (rust-below.spec).
• the Arch Linux AUR package (maybe wrongly) does not pre-create the log directory. Thus the set_permissions() code will run and create the directory with mode 0777.

Below creates a log file in /var/log/below/error_root.log and assigns mode 0666 to it. This (somewhat confusingly) happens via a log_dir variable, which has been changed to point to the error_root.log file. The 0666 permission assignment to the logfile happens in logging::setup(), also accompanied by a somewhat strange comment in the code.

A local unprivileged attacker can stage a symlink attack in this location and cause an arbitrary file in the system to obtain 0666 permissions, likely leading to a full local root exploit, if done right, e.g. by pointing the symlink to /etc/shadow. Even if the file already exists it can be removed and replaced by a symlink, because of the world-writable directory permissions. The attack is thus not limited to scenarios in which the file has not yet been created by Below.

We believe the actual intention of this code might have been to assign mode 01777 (i.e. carrying a sticky bit). The sticky bit is neither contained in the if condition nor in the set_permissions() call, though. With the sticky bit set the Linux kernel’s protected_symlinks logic, which is enabled on most Linux distributions, would protect from symlink attacks.

3) Further Issues

Even on Fedora Linux, where /var/log/below has “safe” 01777 permissions, there is a time window during which problems can arise. As long as below.service has not been started, another local user can pre-create /var/log/below/error_root.log and e.g. place a FIFO special file there. This will pose a local DoS against the below service, since it will fail to open the path and thus fail to start.

If /var/log/below were to be deleted for any reason, then Below would still recreate it using the bad 0777 mode permissions, which can also happen on distributions that initially package /var/log/below using permissions that do not trigger the set_permissions() call in Below’s code.

Below applies many world-writable and world-readable permissions under /var/log/below. This seems a strange choice. For some reason the internal state data of Below is also stored within the log directory in /var/log/below/store. The data is fully world-readable, which could result in information leaks, if Below stores system information there that would not otherwise be accessible to unprivileged local users. We did not check if this applies, though. By pre-creating this directory before below.service runs for the first time, an unprivileged user can control all of its contents, possibly violating the integrity of Below in various ways.

The world-writable logfile error_root.log makes no sense to us as well. Why should arbitrary users in the system be able to modify the log data of Below? This allows log spoofing by local users. Even making the logfile world-readable is considered bad style by some people these days. Why /var/log/below should be world-writable in the first place is also unclear to us. Ideally only root or a dedicated below service user should be allowed to write there.

4) Bugfix

Upstream published a bugfix in commit 10e73a21d67 which is part of Below v0.9.0. The commit basically removes all problematic permission assignments from the code, stating that these directories are better setup by systemd. This seems to refer to an added systemd directive LogsDirectory=below in the below.service file.

With this change no world-writable directories or files should turn up in /var/log/below anymore, and the most severe issues from this report are addressed. The possible matter of world-readable log and store files remains, though.

We did not get any details from upstream about the design decisions in Below that led to this issue or about any further changes that upstream intends to perform to improve security in this area.

5) CVE Assignment

Upstream assigned CVE-2025-27591 for this issue.

6) Hardening Suggestions

It could be considered to apply hardening directives in Below’s systemd service unit that prevent some attack types. Most prominently, restricting write access for the daemon to a range of well known locations comes to mind.

7) Timeline

8) References

• Below GitHub repository
• Below v0.9.0 bugfix release
• Bugfix commit 10e73a21d67
• Below GitHub Security Advisory

Last weekend, I was welcomed to a special event in an industrial area of Budapest. Zsolt Audio – one of the best known high-end audio manufacturers in Hungary – turns 40 this year, and Zsolt Huszti, the founder, started a series of events celebrating this in the showroom next to his “factory”. We listened to some fun stories from the past 40 years, and also to music on some of his latest devices.

The first time I heard about Heed Audio was in 2011, when one of my friends brought me along to an open house event. Sadly, that was the last time I met that friend before his passing, but that’s a different story. I’m happy that he introduced me to Heed Audio right before leaving us…

At that time, we listened to the Enigma 5 speakers, and to me, it was love at first sight. I mean, first listening… :-) I decided that these are the speakers I want to listen to. And almost a decade later, this dream finally became true. And while the Enigma 5 is no longer produced, you can still find some info about it at the bottom of this page: https://heedaudio.com/loudspeakers/

At the event last Saturday, we learned a lot about the company’s future plans, some of which is quite interesting. Zsolt had some ground-breaking ideas, but I’m not in the position to share those publicly. However, we also listened to a few devices that are already available or will be available soon.

The Heed Audio Asterisk is a really simple stereo amplifier. Nothing fancy, just three line inputs, and it can drive a pair of speakers. However, it can do its job really well. Connected to the amplifier, we could listen to a pair of bookshelf speakers. They are tiny and still under development, but could already fill the show room with a loud and clear voice. The amplifier is already available: https://www.bartimexaudio.hu/Heed-Audio-Asterisk

I love the sound of the Enigma 5 speakers. They do a fantastic job with most of the music I listen to. You can easily draw a map of instruments you are listening to in 3D. I did it a couple of times, and they turned out to be pretty accurate when compared to photos taken during recordings. Unlike the Enigma 5, the reincarnation of the StandArt speakers we listened to are not omnidirectional. You cannot expect the same level of spatial sound. However, speakers directed at you reproduce the atmosphere of a (prog)rock concert much better. At the event, we also listened to some Rammstein, which was pure joy on these speakers. They were driven by a Heed Obelisk integrated amplifier, a slightly more modern version of what I use at home. As you could guess from this description, these speakers are not meant to replace the Enigmas, but rather complement them.

This was just the first event of a promising series. I’m looking forward to listening to even more stories and music!

Dear Tumbleweed users and hackers,

This week felt quite busy; lots of things going through staging, but luckily, most things passed rather easy from what I’ve seen. At this point, a big “thank you” to the package maintainers taking care of such a smooth process. Tumbleweed could not be rolling at its speed without your help.

Seven snapshots were published (0227…0305) during this week. The most relevant changes included are:

• KDE Plasma 6.3.2
• Postfix 3.10.1
• libzypp/zypper updates with experimental ‘parallel download’ capabilities.
• Linux kernel 6.13.5
• glibc 2.41
• QEmu 9.2.2
• GNOME Shell 47.5

The next snapshots to come will bring even larger changes, namely:

• Python 3.13 as primary python interpreter. /usr/bin/python3 will be switched to version 3.13. This will require a rather large Tumbleweed rebuild to ensure the python3-* symbols move to the correct packages.
• GCC 15: We will run the well-tested 2-phase approach from previous years: first, switch the used libraries to the ones generated by gcc15 (the phase we are currently working on), then later switch to GCC 15 being the compiler.
• Mozilla Firefox 136.0
• KDE Gear 24.12.3
• Mesa 25.0.1
• RPM 4.20.1
• Perl 5.40.1

If you read only one long article this month, it should be The Anti-Social Century by the The Atlantic.

I planned to write about tribalism for a long time, as it bothers me a lot and often puts me in trouble. Unfortunately, most people think in tribes, such as “I’m a Democrat”, “I’m a Republican”, or “You’re either with us, or against us”. Something similar also exists here in Hungary. When I agree with something that others also support, those people think that I belong to their tribe. However, as soon as I disagree with them about something, those same people immediately think that I belong to another tribe. But nothing could be further from the truth–I do not belong to any tribe. If I agree on something with the Democrats, it does not mean that I reject everything what the Republicans say. And the same is true the other way round.

And this applies not just to politics, but to all aspects of life, including IT. Just think about my operating system affiliations. I consider myself a FreeBSD guy at heart. Still, I use openSUSE as my main OS on my laptop, as it provides the best installation and hardware support (often better than Windows) and has most of the software I need. My colleagues have a lot more trouble using the same company laptop with other operating systems. That said, I also use Windows, even if my title is “open-source evangelist”: Teams and PowerPoint for work, while Capture One and Ableton for my hobbies. And even if I use FreeBSD, openSUSE and Windows as my daily drivers, most of my friends are from the Fedora / RHEL (& compatibles) community, as most syslog-ng users use CentOS and friends, which means that I spend most of my time with those people. Would it help in any way if I embraced a tribal mindset for the various Linux distros or operating systems? Certainly not.

Long story short: Forget tribalism and be social! The article in The Atlantic describes many changes that led to this situation. If we are aware of these, we can hopefully reverse the trends.

In my previous OneIdentity Active Roles blog, you learned how to forward Active Roles logs to a central syslog-ng server to parse and store the logs. In this blog, I’ll show you how to:

• Work with parsed Active Roles logs.
• Store logs to various document stores.
• Prepare long-term storage.
• Send alerts for some critical events.

Even if this blog about commercial software, the name-value pairs concept I describe in this blog in depth is the same in the open source syslog-ng.

https://www.syslog-ng.com/community/b/blog/posts/working-with-parsed-active-roles-logs-in-syslog-ng

This week, I reorganized the speakers in my room and wanted to test the change by listening to a wide variety of music. The first piece that came to my mind was “Rhapsody in Blue” by Gershwin https://en.wikipedia.org/wiki/Rhapsody_in_Blue, as I have a fantastic recording of it made by the Pittsburgh Symphony Orchestra. That said, I know that I’m not a music maniac enough, as I do not have it on vinyl, but rather as a digital download from HDTracks: https://www.hdtracks.com/#/album/5de7b4c75935a842dd765e23. Rhapsody in Blue already sounded great with the original setup, but placing the speakers farther away from each other and turning up the volume made wonders. Even in a middle-sized room, it suddenly sounded as if I was in a huge concert hall.

TIDAL: https://listen.tidal.com/album/79240363

Once the album was over, I wanted to experiment further. That’s when I realized that I have a few more recordings of Rhapsody in Blue. Well, not the original, but various adaptations. The next one I listened to had a completely different style: progressive metal. It is on the third album of Liquid Tension Experiment. This was the only time when the new setup did not improve the sound. I mean, it wasn’t bad at all, but a bit more bass would have helped :-) I listened to this music from a Blu-ray disk.

TIDAL: https://listen.tidal.com/album/168567035

The third song featuring the melodies of Rhapsody in Blue was recorded by Hiromi, a jazz pianist from Japan. I have this album as a CD from Japan, but I also have it in high resolution FLAC files from HDTracks: https://www.hdtracks.com/#/album/5dfb7dc30a58de3182f046f0. I know the sound of the piano pretty well, as there was at least one piano in my home most of my life. Turning up the volume a bit and listening to a good recording made wonders: it was a lot more lifelike than usual.

TIDAL: https://listen.tidal.com/album/119047940/

The new speaker arrangement gives a nicer, more realistic sound. However, it also needs to be louder, as I’m farther away from the speakers. So, for now, I just note the position of the speakers and move back everything as it was previously…

I am looking for even more Rhapsody in Blue recordings. Do you have any recommendations, either for the original or for other arrangements?

Dear Tumbleweed users and hackers,

This has been a very productive week with 7 published snapshots (0220…0226). Naturally, some snapshots were a bit smaller than others.. It does not matter if you update to all intermediate snapshots or skip a few. Tumbleweed is built to be resilient against this and should not care much. We frequently hear that people fire up a VM that was last used one year ago, running zypper dup, and being positively surprised that this all works. But you should be allowed to expect that.

The 7 snapshots from this week brought you these changes:

• KDE Plasma 6.3.1
• GPG 2.5.4
• MariaDB 11.7.2
• Poppler 25.02.0
• LibXML 2.13.6
• PostgreSQL 17.4
• Mesa 25.0.0
• Linux kernel 6.13.4
• Boost 1.87.0
• ZStd 1.5.7
• move to openmpi5

Staging projects are well occupied – testing these changes/updates:

• KDE Plasma 6.3.2
• Linux kernel 6.13.5
• GCC 15: We will run the well-tested 2-phase approach from previous years: first, switch the used libraries to the ones generated by gcc15 (the phase we are currently working on), then later switch to GCC 15 being the compiler.
• glibc 2.41: please help work out the errors in https://build.opensuse.org/project/show/openSUSE:Factory:Staging:O
• Python 3.13 as the default Python interpreter: Pending issues can be seen at https://build.opensuse.org/project/show/openSUSE:Factory:Staging:A. Just 1 more package to go: CEPH!

AI’s latest escapade into software piracy has left Microsoft scrambling, but let’s be honest; why even go through the hassle? If people are looking at not paying for an operating system, they don’t need to look far when alternatives like openSUSE exist?

With Linux distributions like openSUSE, there are no activation codes, no shady workarounds, no costs; just a fully functional, open and freely available operating system so users don’t have to break the law to break free from Windows’ licensing fees.

The Financial Benefits of Moving to Linux

Millions of computer users face a financial decision as they prepare for the end support for Windows 10 in October 2025; upgrade their operating systems at a cost depending on the users location, purchase new hardware with an OS installed or explore alternatives. Or, as Copilot seems to suggest, they could just ask an AI how to pirate Windows; because nothing says “secure computing” like taking legal advice from a chatbot.

For those feeling the pinch of rising costs due to stagflation, Linux distributions, particularly openSUSE’s Leap and Tumbleweed, offer a compelling, cost-effective alternative.

With no licensing fees, extended hardware compatibility and an abundance of software applications, Linux operating systems provide a compelling solution to reduce expenses while maintaining productivity, security and extending hardware lifespans to reduce electronic waste.

As part of our Upgrade to Freedom! campaign, this write-up focuses on the financial benefits of switching to openSUSE or another Linux operating system.

No Licensing Fees

One of the most immediate savings people notice when switching to Linux is the elimination of licensing fees. Licensing fees for some commercial operating systems can cost more than $100 USD per device. Enterprise solutions often incur additional costs for maintenance and upgrades.

Instead, people can save that money by going to get.opensuse.org and downloading an operating system without needing any codes or paying any money.

This zero-cost licensing model translates to significant savings to individual users, small businesses and large enterprises.

Investing in Linux is investing in one’s knowledge; it’s an investment into freedom. People get a professional-grade operating system without recurring costs using openSUSE.

Extend the Life of Your Hardware

Newer versions of Windows may require specific hardware features like TPM 2.0 and Secure Boot. For many older devices, this could render these devices incompatible and force users to purchase new machines.

The cost of a new laptop can run $350 USD or more, which is a substantial expense in a struggling economy. For a business, multiple devices could come at a hefty cost.

By contrast, openSUSE is optimized to run efficiently on a wide range of hardware, which includes older machines. Leap provides long-term stability, while Tumbleweed offers the news software updates to ensure devices remain relevant and functional for years to come. Members of the openSUSE community can also recommend using distributions like Slowroll, Aeon and Kalpa.

By switching to Linux, users may extend the life of their existing hardware and avoid contributing to any unnecessary e-waste; a cost that is much more precious than financial savings.

Apps and Open-Source Software

The financial benefits of Linux extends well beyond the operating system itself. The distributions provide access to a vast library of free, open-source applications that can replace costly proprietary software.

• Office Suites: LibreOffice is a powerful alternative to office suites that charge a premium.
• Creative Tools: GIMP and Inkscape provide robust alternatives to graphic design and image editing software, which can cost upwards of $600 per year for subscriptions.
• Development Tools: Developers can access free Integrated Development Environments like Visual Studio Code, JetBrains’ IntelliJ IDEA Community Edition and Eclipse.

For users who require specific Windows applications, tools like Wine, Bottles and Proton can help run those programs on Linux, which eliminates the need for additional software purchases. Linux systems are renowned for stability and security along with the reduction of time and money spent on IT support and maintenance.

Set up tools like YaST and advances with Agama provide intuitive ways to manage systems, updates, configurations and software installations, which can make it easy for non-technical users.

For businesses, the cost savings of switching to Linux can be immense. Companies running Windows often incur costs for server licenses and client access licenses (CALs). By moving to open-source solutions like openSUSE and its enterprise-focused sibling, SUSE Linux Enterprise, businesses can significantly reduce their IT expenses.

Small and medium-sized businesses can save thousands of dollars annually by adopting Linux. It’s not just about the initial savings but an ongoing reduction to operational costs.

As Windows 10 nears its expiration date, users and businesses have a choice: switch to openSUSE for a free, reliable solution; or start asking AI for sketchy workarounds and hope for the best.

Here is a step-by-step guide to start installing openSUSE.

This is part of a series on Upgrade to Freedom where we offer reasons to transition from Windows to Linux.

Agama development goes on at good pace and, approximately one month after our latest blog post, we have more news for you. Not only a new version of Agama with a completely refreshed user interface and other significant changes, but also some information about the future.

New visual appearance​

Let's start with the most obvious change introduced at Agama 12. You may know that the Agama web interface relies on the Patternfly framework, the same design system used by Cockpit. In this version of Agama, we migrated to the latest major version of Patternfly (v6), which brings several improvements and quite noticeable visual changes. Moreover, we took the opportunity to align with the SUSE branding guidelines regarding aspects like typography, colors, etc.

More than ever, in this case a picture is worth a thousand words.

But the changes on the user interface go far beyond cosmetic aspects and general usability improvements. On top of that, some sections went through an overhaul.

Revamped Storage section​

In previous Agama releases, the section of the user interface used to configure the storage devices (partitions, LVM, etc.) was very powerful. It allowed to create complex setups over single or multiple disks based on partitions and/or LVM volume groups, to use hard disks directly formatted (without partitions), to reuse existing partitions or volume groups (optionally re-formatting them) and much more. But it had some problems.

On the one hand, most users failed to discover how to access to all those features. The interface was not self-explanatory enough. On the other hand, we were struggling to find a way to add more functionality (especially software RAIDs) in a consistent way. To make things a bit more problematic, the configuration generated by that user interface was not fully aligned with the usual mindset of our users currently relying on profile-based configuration (ie. unattended installation).

Thus, a couple of months ago, we decided to change the approach of that user interface. But it took us some time to reach a point in which the new interface is functional enough for basic configurations.

The new section is still far from its final form and also from providing all the possibilities of the previous interface. So expect significant updates on future releases, like bringing back the support to define LVM volume groups. Meanwhile, you can read about its existing and future capabilities at the corresponding section of the Agama user documentation.

Changes in authentication management​

Security is a topic that demands constant re-evaluation. When it comes to a Linux system, one of the first aspects of security is the way to organize users, privileges and authentication. SUSE and openSUSE have been reconsidering lately how to approach that and it seems clear that the traditional role of the root user and the default configuration of sudo are going to change in future releases of SLE and openSUSE Leap.

Agama 12 already takes the first steps to adapt to the new situation, removing the mandatory step to set a password for the root user and introducing a new Authentication section instead of the former Users one.

This is just the first iteration for a part of Agama that will receive several improvements regarding usability and wording in upcoming releases.

Post-partitioning script​

Not all changes at Agama 12 affect the user interface. Unattended installation also received a bunch of improvements, including the ability to execute scripts right after setting up the storage layout.

As you may know, both AutoYaST and Agama offer the possibility to specify custom scripts that can be executed at several points of the installation workflow. In previous versions Agama already offered the so-called pre-installation scripts, post-installation scripts and init scripts. But now Agama 12 offers also post-partitioning scripts that can be used, among many other things, to deploy configuration files before the packages are installed, modifying with that the behavior of the scripts included at RPM packages.

Information about AutoYaST compatibility​

And talking about unattended installation, we cannot forget one of the main features of Agama - its backwards compatibility with AutoYaST. Such a compatibility is not perfect and never will be, due to the difference in scope between both Agama (focused on installation) and AutoYaST (a more general configuration tool).

Now when Agama reads an AutoYaST profile it informs the user about the sections that will be ignored, making a difference between those sections that will be supported soon by Agama and those that are considered to be out of its scope even for the future.

The report can be disabled by specifying agama.ay_check=0 as a boot parameter.

We also took the opportunity to update the corresponding information at the AutoYaST compatibility reference document. What is even better, we introduced some mechanisms to generate such a document based on the same information used by Agama to generate the compatibility report during execution, so we can make sure the documentation is in sync with the actual implementation.

Improvements at the Live ISO​

Most users will execute Agama using the default installation media for SUSE or openSUSE distributions, which we unsurprisingly call Agama-live (since it is just a live Linux system running Agama).

Although the installation media is relatively independent from Agama itself, we take every Agama release as an opportunity to announce some of the latest improvements. In this occasion that includes some tweaks to the underlying window manager (IceWM), less aggressive settings for both power saving and the screensaver and the ability to open a terminal emulator by pressing ctrl+alt+t.

Find the latest version of the openSUSE Agama Live ISO image, including Agama 12, at its usual location.

A glance into the future​

This time we will use the release of Agama 12 as an opportunity to announce something else. We decided to add a Roadmap section to the Agama home page.

They say "plans are useless, but planning is indispensable". That may be the case of the Agama roadmap. We have a clear goal in the mid term, but we are constantly re-evaluating our priorities and the next steps to be taken. As such, you can expect that document to be updated often. Do not carve it into stone!

See you soon!​

As you can see in the mentioned roadmap, we plan to release Agama 13 by the end of March. And of course that will mean another blog post for you to enjoy the YaST Team adventures.

Meanwhile, you can also find us at SUSECON 2025, which will take place at Orlando (USA). Part of the team will be there to meet our beloved users and conduct a couple of sessions about Agama.

If you cannot be there in person, you can of course meet us at our usual online channels, like the Agama project at GitHub and the #yast channel at Libera.chat.

Have a lot of fun!