From 893965270573e3e7a0b634602009fdb0692f5a8b Mon Sep 17 00:00:00 2001
From: Jonathan Wright <jonathan@almalinux.org>
Date: Wed, 18 Jun 2025 08:54:15 -0500
Subject: [PATCH] Fix CVE-2025-6019

---
 ...-allow-suid-and-dev-set-on-fs-resize.patch | 28 +++++++++++++++++++
 libblockdev.spec                              |  6 +++-
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 0003-dont-allow-suid-and-dev-set-on-fs-resize.patch

diff --git a/0003-dont-allow-suid-and-dev-set-on-fs-resize.patch b/0003-dont-allow-suid-and-dev-set-on-fs-resize.patch
new file mode 100644
index 0000000..a0c5532
--- /dev/null
+++ b/0003-dont-allow-suid-and-dev-set-on-fs-resize.patch
@@ -0,0 +1,28 @@
+From 8e072f794744bd17c57cceabb3884d3f0f6a1602 Mon Sep 17 00:00:00 2001
+From: Thomas Blume <Thomas.Blume@suse.com>
+Date: Fri, 16 May 2025 14:27:10 +0200
+Subject: [PATCH] dont allow suid and dev set on fs resize
+
+---
+ src/plugins/fs/generic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/plugins/fs/generic.c b/src/plugins/fs/generic.c
+index 69333944..1a6dd960 100644
+--- a/src/plugins/fs/generic.c
++++ b/src/plugins/fs/generic.c
+@@ -683,7 +683,9 @@ static gchar* fs_mount (const gchar *device, gchar *fstype, gboolean read_only,
+                              "Failed to create temporary directory for mounting '%s'.", device);
+                 return NULL;
+             }
+-            ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "ro" : NULL, NULL, &l_error);
++
++            ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "nosuid,nodev,ro" : "nosuid,nodev", NULL, &l_error);
++
+             if (!ret) {
+                 g_propagate_prefixed_error (error, l_error, "Failed to mount '%s': ", device);
+                 g_rmdir (mountpoint);
+-- 
+2.48.1
+
+
diff --git a/libblockdev.spec b/libblockdev.spec
index aec4e0f..4de4b9d 100644
--- a/libblockdev.spec
+++ b/libblockdev.spec
@@ -86,13 +86,14 @@
 
 Name:        libblockdev
 Version:     3.2.0
-Release:     3%{?dist}
+Release:     3%{?dist}.alma.1
 Summary:     A library for low-level manipulation with block devices
 License:     LGPL-2.1-or-later
 URL:         https://github.com/storaged-project/libblockdev
 Source0:     https://github.com/storaged-project/libblockdev/releases/download/%{version}/%{name}-%{version}.tar.gz
 Patch0:      0001-nvme_Avoid_element-type_g-i_annotations.patch
 Patch1:      0002-crypto-Add-a-function-to-set-persistent-flags-for-LU.patch
+Patch2:      0003-dont-allow-suid-and-dev-set-on-fs-resize.patch
 
 BuildRequires: make
 BuildRequires: glib2-devel
@@ -948,6 +949,9 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 %files plugins-all
 
 %changelog
+* Wed Jun 18 2025 Jonathan Wright <jonathan@almalinux.org> - 3.2.0-3.alma.1
+- Fix CVE-2025-6019 don't allow suid and dev set on fs resize
+
 * Tue Mar 11 2025 Vojtech Trefny <vtrefny@redhat.com> - 3.2.0-3
 - crypto: Add a function to set persistent flags for LUKS
   Resolves: RHEL-82885