Fix CVE-2025-6019

SOURCES/0013-dont-allow-suid-and-dev-set-on-fs-resize.patch

@@ -0,0 +1,24 @@
+From 8e072f794744bd17c57cceabb3884d3f0f6a1602 Mon Sep 17 00:00:00 2001
+From: Thomas Blume <Thomas.Blume@suse.com>
+Date: Fri, 16 May 2025 14:27:10 +0200
+Subject: [PATCH] dont allow suid and dev set on fs resize
+
+[Salvatore Bonaccorso: Backport to 2.28, which does not contain 2b55f566d422
+("fs: Add support for NILFS2 filesystem") from 3.0 which generalized the
+bd_fs_mount() call in preparation for other filesystems.]
+---
+ src/plugins/fs/generic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/src/plugins/fs/generic.c
++++ b/src/plugins/fs/generic.c
+@@ -409,7 +409,7 @@ static gboolean xfs_resize_device (const
+                              "before resizing it.", device);
+                 return FALSE;
+             }
+-            ret = bd_fs_mount (device, mountpoint, "xfs", NULL, NULL, error);
++            ret = bd_fs_mount (device, mountpoint, "xfs", "nosuid,nodev", NULL, error);
+             if (!ret) {
+                 g_prefix_error (error, "Failed to mount '%s' before resizing it: ", device);
+                 return FALSE;
+

SPECS/libblockdev.spec

@@ -129,7 +129,7 @@
 
 Name:        libblockdev
 Version:     2.28
-Release:     10%{?dist}
+Release:     10%{?dist}.alma.1
 Summary:     A library for low-level manipulation with block devices
 License:     LGPLv2+
 URL:         https://github.com/storaged-project/libblockdev
@@ -147,6 +147,7 @@ Patch9:      0009-Fix-issues-in-tests-when-running-in-FIPS-mode.patch
 Patch10:     0010-lvm-Add-a-function-to-activate-LVs-in-shared-mode.patch
 Patch11:     0011-nvme_libblockdev-3.0.4_backport.patch
 Patch12:     0012-lvm-Add-support-for-starting-and-stopping-VG-locking.patch
+Patch13:     0013-dont-allow-suid-and-dev-set-on-fs-resize.patch
 
 BuildRequires: make
 BuildRequires: glib2-devel
@@ -1045,6 +1046,9 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 %files plugins-all
 
 %changelog
+* Wed Jun 18 2025 Jonathan Wright <jonathan@almalinux.org> - 2.28-10.alma.1
+- Fix CVE-2025-6019 don't allow suid and dev set on fs resize
+
 * Wed Nov 08 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-10
 - lvm: Add support for starting and stopping VG locking
   Resolves: RHEL-15921