diff --git a/.gitignore b/.gitignore index 08b9615..7f66b7e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/acl-2.[23].*.tar.gz -/acl-2.[23].*.tar.gz.sig +/acl-2.*.*.tar.gz +/acl-2.*.*.tar.gz.sig diff --git a/0001-acl-2.2.53-test-runwrapper.patch b/0001-acl-2.2.53-test-runwrapper.patch deleted file mode 100644 index 7c27c6c..0000000 --- a/0001-acl-2.2.53-test-runwrapper.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 085cc4ff56857d234e80f37d0316c13eb5718696 Mon Sep 17 00:00:00 2001 -From: Kamil Dudka -Date: Tue, 3 Jul 2018 10:46:58 +0200 -Subject: [PATCH] test/runwrapper: copy the preloaded library - -... to a temporary directory because the original location might -not be accessible by other users. ---- - test/runwrapper | 20 ++++++++++++++++++-- - 1 file changed, 18 insertions(+), 2 deletions(-) - -diff --git a/test/runwrapper b/test/runwrapper -index 6e0e899..de4555a 100755 ---- a/test/runwrapper -+++ b/test/runwrapper -@@ -1,7 +1,23 @@ - #!/bin/bash - --if [ -e "$PWD/.libs/libtestlookup.so" ]; then -- export LD_PRELOAD="$PWD/.libs/libtestlookup.so" -+src="$PWD/.libs/libtestlookup.so" -+dst= -+if [ -e "$src" ]; then -+ # copy the preloaded library to a temporary directory because -+ # the original location might not be accessible by other users -+ tmp="$(mktemp -d)" -+ chmod 0755 "$tmp" -+ dst="${tmp}/libtestlookup.so" -+ cp -L "$src" "$dst" -+ export LD_PRELOAD="$dst" - fi - - "${srcdir:-${PWD}}"/test/run "$@" -+ec="$?" -+ -+if [ -n "$dst" ]; then -+ # remove the temporary location -+ rm -rf "$dst" -+fi -+ -+exit "$ec" --- -2.14.4 - diff --git a/0001-acl-2.3.2-__acl_get_uid-fix-memory-wasting-loop.patch b/0001-acl-2.3.2-__acl_get_uid-fix-memory-wasting-loop.patch deleted file mode 100644 index a7267b7..0000000 --- a/0001-acl-2.3.2-__acl_get_uid-fix-memory-wasting-loop.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 56abe432b65801f31277fb9a3bca0f9e31502315 Mon Sep 17 00:00:00 2001 -From: Matthias Gerstner -Date: Thu, 25 Apr 2024 12:43:49 +0200 -Subject: [PATCH] libmisc: __acl_get_uid(): fix memory wasting loop if user - does not exist - -I noticed that `acl_from_text()` unexpectedly returns ENOMEM for invalid -user names. The reason for this is a missing break statement in the for -loop in `__acl_get_uid()`, which causes the loop to act as if ERANGE was -returned from `getpwnam_r()`, thereby exponentially increasing the -buffer size to (in my case) multiple gigabytes, until `grow_buffer()` -reports ENOMEM, which terminates the `__acl_get_uid()` function. - -This is a pretty costly "no such user" lookup that can disturb a -process's heap memory management, but can also cause a process to fail -e.g. if it is multithreaded and other threads encounter an ENOMEM, -before `__acl_get_uid()` frees the gigantic heap buffer and returns. -The allocated memory isn't actually used. Therefore on Linux it should -not affect other processes by default, due to its overcommit memory -and lazy memory allocation strategy. - -Fix this by properly terminating the for loop on any conditions except -an ERANGE error being reported. The same break statement correctly -exists in `__acl_get_gid()` already. - -Fixes: 3737f00 ("use thread-safe getpwnam_r and getgrnam_r") -Signed-off-by: Andreas Gruenbacher ---- - libmisc/uid_gid_lookup.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/libmisc/uid_gid_lookup.c b/libmisc/uid_gid_lookup.c -index a4f21f6..74baab4 100644 ---- a/libmisc/uid_gid_lookup.c -+++ b/libmisc/uid_gid_lookup.c -@@ -91,6 +91,7 @@ __acl_get_uid(const char *token, uid_t *uid_p) - if (err == ERANGE) - continue; - errno = err ? err : EINVAL; -+ break; - } - free(buffer); - return result ? 0 : -1; --- -2.45.2 - diff --git a/0001-acl-2.3.2-tests-fix-getpwnam-and-getgrnam.patch b/0001-acl-2.3.2-tests-fix-getpwnam-and-getgrnam.patch deleted file mode 100644 index 8073b7c..0000000 --- a/0001-acl-2.3.2-tests-fix-getpwnam-and-getgrnam.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 99ed23222f315d1a6efbc240db3ff4ed04db99c6 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= -Date: Mon, 10 Jun 2024 16:28:22 +0200 -Subject: [PATCH] tests: fix getpwnam and getgrnam -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The calls to these functions would always fail because the size of the buffer -was smaller than the minimum (170000) specified in the test implementations -of getgrnam_r and getpwnam_r. Use test_get*_match directly because getpwnam -and getgrnam should never fail on ERANGE. - -This commit fixes the following failure in the test/root/restore.test test: - -[21] $ chown bin passwd -- failed -chown: invalid user: ‘bin’ != ~ - -Fixes: 3737f000d3f17cd283f51eeacac21a71a3472053 ("use thread-safe getpwnam_r and getgrnam_r") ---- - test/test_group.c | 2 +- - test/test_passwd.c | 4 ++-- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/test/test_group.c b/test/test_group.c -index 96dd612..42d6b07 100644 ---- a/test/test_group.c -+++ b/test/test_group.c -@@ -136,7 +136,7 @@ struct group *getgrnam(const char *name) - static struct group grp; - struct group *result; - -- (void) getgrnam_r(name, &grp, buf, sizeof(buf), &result); -+ (void) test_getgr_match(&grp, buf, sizeof buf, &result, match_name, name); - return result; - } - -diff --git a/test/test_passwd.c b/test/test_passwd.c -index b88ea45..ebe9dce 100644 ---- a/test/test_passwd.c -+++ b/test/test_passwd.c -@@ -117,7 +117,7 @@ int getpwnam_r(const char *name, struct passwd *pwd, char *buf, size_t buflen, - *result = NULL; - return ERANGE; - } -- last_buflen =- 1; -+ last_buflen = -1; - - return test_getpw_match(pwd, buf, buflen, result, match_name, name); - } -@@ -129,7 +129,7 @@ struct passwd *getpwnam(const char *name) - static struct passwd pwd; - struct passwd *result; - -- (void) getpwnam_r(name, &pwd, buf, sizeof(buf), &result); -+ (void) test_getpw_match(&pwd, buf, sizeof(buf), &result, match_name, name); - return result; - } - --- -2.45.2 - diff --git a/acl.spec b/acl.spec index 02b2e83..ee476ff 100644 --- a/acl.spec +++ b/acl.spec @@ -1,7 +1,7 @@ Summary: Access control list utilities Name: acl -Version: 2.3.2 -Release: 4%{?dist} +Version: 2.4.0 +Release: 2%{?dist} BuildRequires: gawk BuildRequires: gcc BuildRequires: gettext @@ -14,18 +14,9 @@ Requires: libacl%{?_isa} = %{version}-%{release} Source0: https://download-mirror.savannah.gnu.org/releases/acl/acl-%{version}.tar.gz Source1: https://download-mirror.savannah.gnu.org/releases/acl/acl-%{version}.tar.gz.sig # Retreived from https://savannah.nongnu.org/people/viewgpg.php?user_id=15000 -# Source2: agruen-key.gpg +Source2: agruen-key.gpg # Retrieved from https://savannah.nongnu.org/people/viewgpg.php?user_id=42032 -Source2: vapier-key.gpg - -# avoid permission denied problem with LD_PRELOAD in the test-suite -Patch1: 0001-acl-2.2.53-test-runwrapper.patch - -# fix regressions introduced by the `libacl: use getpwnam_r and getgrnam_r in acl_from_text.c` patch -# https://git.savannah.nongnu.org/cgit/acl.git/commit/?id=56abe432b65801f31277fb9a3bca0f9e31502315 -Patch2: 0001-acl-2.3.2-__acl_get_uid-fix-memory-wasting-loop.patch -# https://lists.nongnu.org/archive/html/acl-devel/2024-06/msg00000.html -Patch3: 0001-acl-2.3.2-tests-fix-getpwnam-and-getgrnam.patch +# Source2: vapier-key.gpg License: GPL-2.0-or-later AND LGPL-2.1-or-later URL: https://savannah.nongnu.org/projects/acl @@ -132,6 +123,11 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %{_libdir}/libacl.so.* %changelog +* Wed Jul 22 2026 Lukáš Zaoral - 2.4.0-2 +- rebase to 2.4.0 to fix the following CVEs: + - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions + - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl + * Tue Oct 29 2024 Troy Dawson - 2.3.2-4 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 diff --git a/sources b/sources index f92416f..2a7a3dd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (acl-2.3.2.tar.gz) = 31aeb39958d8af5d08933dd3a89333a41025c3eb49fc461fa3c291caca51dad575ec13faeb7deba9b3c2ebf7615be7d45e2b78e50d4f83d8ec933c95931a7682 -SHA512 (acl-2.3.2.tar.gz.sig) = fcd05951bba9d99bceb6dee409ae9e186808c7106f68f7d8e31959f75e0f5b01e18b87c4c7340cb4c168734b596468c710342a7d8c5e27c9fc55f1fcb57f9625 +SHA512 (acl-2.4.0.tar.gz) = 91f82d5620ca35977e917b7f678c86136a48c2500829b31a19aee7f5be8137a7a48a049dc4d51e5f8dc3328be248756bbfee77565eff6c8a4c8fc79cb850ee0c +SHA512 (acl-2.4.0.tar.gz.sig) = 978f71040dff604daa0d8b052b74ba44e9c9b4dcd2f8c18a798b68348acf5ee9819ec9989b69822164fc816f07cbfb982eae1502f6ba115729bb19e2dabc6a6a