diff --git a/0002-If-less-than-16-chars-were-read-allow-shebang-test-c.patch b/0002-If-less-than-16-chars-were-read-allow-shebang-test-c.patch new file mode 100644 index 0000000..13a0512 --- /dev/null +++ b/0002-If-less-than-16-chars-were-read-allow-shebang-test-c.patch @@ -0,0 +1,61 @@ +From a2ea4efcae9ff6c7af47058d8b61aa88f269cf66 Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Mon, 19 Jan 2026 16:27:54 -0500 +Subject: [PATCH] If less than 16 chars were read, allow shebang test (corner + case) +Content-type: text/plain + +--- + src/library/file.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/src/library/file.c b/src/library/file.c +index 30571890071b..6491733c0042 100644 +--- a/src/library/file.c ++++ b/src/library/file.c +@@ -1253,12 +1253,9 @@ int get_ima_hash(int fd, file_hash_alg_t *alg, char *sha) + + + static unsigned char e_ident[EI_NIDENT]; +-static int read_preliminary_header(int fd) ++static inline ssize_t read_preliminary_header(int fd) + { +- ssize_t rc = safe_read(fd, (char *)e_ident, EI_NIDENT); +- if (rc == EI_NIDENT) +- return 0; +- return 1; ++ return safe_read(fd, (char *)e_ident, EI_NIDENT); + } + + +@@ -1356,8 +1353,10 @@ static int looks_like_text_script(int fd) + uint32_t gather_elf(int fd, off_t size) + { + uint32_t info = 0; ++ ssize_t rc; + +- if (read_preliminary_header(fd)) ++ rc = read_preliminary_header(fd); ++ if (rc < 2) + goto rewind_out; + + /* Detect scripts via shebang before ELF check */ +@@ -1366,6 +1365,10 @@ uint32_t gather_elf(int fd, off_t size) + goto rewind_out; + } + ++ /* Make sure we have the full preliminary header */ ++ if (rc < EI_NIDENT) ++ goto rewind_out; ++ + /* Check ELF magic */ + if (strncmp((char *)e_ident, ELFMAG, 4)) { + // Not ELF - see if it might be text script +@@ -1688,4 +1691,3 @@ rewind_out: + rewind_fd(fd); + return info; + } +- +-- +2.52.0 + diff --git a/fapolicyd.spec b/fapolicyd.spec index 977687d..88bd1a6 100644 --- a/fapolicyd.spec +++ b/fapolicyd.spec @@ -21,8 +21,9 @@ Source20: https://github.com/troydhanson/uthash/archive/refs/tags/v2.3.0.tar.gz# # $ git format-patch -N v1.4.3 # https://github.com/linux-application-whitelisting/fapolicyd-selinux # $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-1.1/ --dst-prefix=b/fapolicyd-selinux-1.1/ v1.1 -# $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done +# $ for j in [0-9]*.patch; do printf "Patch: %s\n" $j; done # Patch list start +Patch: 0002-If-less-than-16-chars-were-read-allow-shebang-test-c.patch # Patch list end BuildRequires: gcc