Revisit of Deepin Desktop D-Bus Services after Removal from openSUSE (April 2026)

openSUSE 再次评估 Deepin 桌面组件，结果依然令人失望。虽然官方声称已修复，但审计发现 Backlight Helper 缺少 Polkit 认证，Accounts Service 更是漏洞百出：CreateGuestUser 存在竞态条件，SetHomeDir 可将家目录移至 /root，SetPassword 甚至泄露明文密码并存在 root 提权风险。openSUSE 表示 Deepin 安全文化堪忧，修复效率极低，建议用户谨慎使用，并已降低其审核优先级。

https://security.opensuse.org/2026/04/20/winter-spotlight.html#section-deepin

#aigc

SUSE Security Team Blog

SUSE Security Team Spotlight Winter 2025/2026

This is the winter 2025/2026 edition of our spotlight series. This time we will discuss, among others, a review of the libpgpr signature parsing library, the rtkit realtime scheduling service and an attempt at bringing Deepin desktop components back to openSUSE.