From 15208c42a11f1bcdfbd2baba1c91876bdfa14c49 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Thu, 24 Jul 2025 17:12:40 +0200 Subject: [PATCH] RHEL 9.7.0 ERRATUM - "fapolicyd-cli --file add" crashes when processing sockets Resolves: RHEL-69136 Signed-off-by: Radovan Sroka --- fapolicyd-skip-nonregular.patch | 39 ++++++++++++++ fapolicyd-socket-segfault.patch | 48 ++++++++++++++++++ fapolicyd-sync-update-thread.patch | 81 ------------------------------ fapolicyd.spec | 10 +++- 4 files changed, 95 insertions(+), 83 deletions(-) create mode 100644 fapolicyd-skip-nonregular.patch create mode 100644 fapolicyd-socket-segfault.patch delete mode 100644 fapolicyd-sync-update-thread.patch diff --git a/fapolicyd-skip-nonregular.patch b/fapolicyd-skip-nonregular.patch new file mode 100644 index 0000000..9d25230 --- /dev/null +++ b/fapolicyd-skip-nonregular.patch @@ -0,0 +1,39 @@ +From 508805c9f47ca22695fd7a265668f99e9258ea27 Mon Sep 17 00:00:00 2001 +From: Radovan Sroka +Date: Thu, 24 Jul 2025 15:30:06 +0200 +Subject: [PATCH] Skip to add non regular files to trustdb + +- it does not make any sense to have them in the trustdb +- the patch should be fix potential error when reading nonregular files + +Signed-off-by: Radovan Sroka +--- + src/cli/file-cli.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/src/cli/file-cli.c b/src/cli/file-cli.c +index 7deec39c..ae326c14 100644 +--- a/src/cli/file-cli.c ++++ b/src/cli/file-cli.c +@@ -67,7 +67,7 @@ static int ftw_add_list_append(const char *fpath, + */ + static int add_list_load_path(const char *path) + { +- int fd = open(path, O_RDONLY); ++ int fd = open(path, O_RDONLY|O_NONBLOCK); + if (fd < 0) { + msg(LOG_ERR, "Cannot open %s", path); + return 1; +@@ -83,8 +83,11 @@ static int add_list_load_path(const char *path) + + if (S_ISDIR(sb.st_mode)) + nftw(path, &ftw_add_list_append, FTW_NOPENFD, FTW_FLAGS); +- else ++ else if (S_ISREG(sb.st_mode)) { + list_append(&add_list, strdup(path), NULL); ++ } else { ++ msg(LOG_INFO, "Skipping non regular file: %s", path); ++ } + + return 0; + } diff --git a/fapolicyd-socket-segfault.patch b/fapolicyd-socket-segfault.patch new file mode 100644 index 0000000..33c2c65 --- /dev/null +++ b/fapolicyd-socket-segfault.patch @@ -0,0 +1,48 @@ +From 73770c9111800cb5a1e62203e460ae9149307d49 Mon Sep 17 00:00:00 2001 +From: Radovan Sroka +Date: Mon, 28 Jul 2025 18:44:08 +0200 +Subject: [PATCH] Fix segfault when socket is inside of the directory + +$ socat UNIX-LISTEN:"/home/rsroka/dir/socket" /dev/null & + +[ ERROR ]: Cannot open /home/rsroka/dir/socket +Program received signal SIGSEGV, Segmentation fault. + +Signed-off-by: Radovan Sroka +--- + src/cli/file-cli.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/src/cli/file-cli.c b/src/cli/file-cli.c +index ae326c14..655e8f15 100644 +--- a/src/cli/file-cli.c ++++ b/src/cli/file-cli.c +@@ -53,8 +53,13 @@ static int ftw_add_list_append(const char *fpath, + int typeflag, + struct FTW *ftwbuf __attribute__ ((unused))) + { +- if (typeflag == FTW_F) +- list_append(&add_list, strdup(fpath), NULL); ++ if (typeflag == FTW_F) { ++ if (S_ISREG(sb->st_mode)) { ++ list_append(&add_list, strdup(fpath), NULL); ++ } else { ++ msg(LOG_INFO, "Skipping non regular file: %s", fpath); ++ } ++ } + return FTW_CONTINUE; + } + +@@ -83,11 +88,8 @@ static int add_list_load_path(const char *path) + + if (S_ISDIR(sb.st_mode)) + nftw(path, &ftw_add_list_append, FTW_NOPENFD, FTW_FLAGS); +- else if (S_ISREG(sb.st_mode)) { ++ else + list_append(&add_list, strdup(path), NULL); +- } else { +- msg(LOG_INFO, "Skipping non regular file: %s", path); +- } + + return 0; + } diff --git a/fapolicyd-sync-update-thread.patch b/fapolicyd-sync-update-thread.patch deleted file mode 100644 index 47b9b72..0000000 --- a/fapolicyd-sync-update-thread.patch +++ /dev/null @@ -1,81 +0,0 @@ -diff -up ./src/daemon/fapolicyd.c.sync-update ./src/daemon/fapolicyd.c ---- ./src/daemon/fapolicyd.c.sync-update 2024-04-29 17:27:41.000000000 +0200 -+++ ./src/daemon/fapolicyd.c 2025-04-21 13:35:21.751343832 +0200 -@@ -66,7 +66,11 @@ - unsigned int debug_mode = 0, permissive = 0; - - // Signal handler notifications --volatile atomic_bool stop = false, hup = false, run_stats = false; -+volatile atomic_bool try_to_stop = false, stop = false; -+volatile atomic_bool hup = false, run_stats = false; -+ -+extern volatile atomic_bool update_thread_loop; -+extern volatile atomic_bool update_thread_stop; - - // Local variables - static conf_t config; -@@ -214,7 +218,7 @@ static void init_fs_list(const char *wat - - static void term_handler(int sig __attribute__((unused))) - { -- stop = true; -+ try_to_stop = true; - } - - -@@ -667,7 +672,7 @@ int main(int argc, const char *argv[]) - msg(LOG_DEBUG, "Got SIGHUP"); - reconfigure(); - } -- rc = poll(pfd, 2, -1); -+ rc = poll(pfd, 2, 1000); - - #ifdef DEBUG - msg(LOG_DEBUG, "Main poll interrupted"); -@@ -699,7 +704,15 @@ int main(int argc, const char *argv[]) - sigaction(SIGINT, &sa, NULL); - #endif - } -+ -+ if (try_to_stop) -+ update_thread_stop = true; -+ -+ if (try_to_stop && !update_thread_loop) -+ stop = true; -+ - } -+ - msg(LOG_INFO, "shutting down..."); - shutdown_fanotify(m); - close(pfd[0].fd); -diff -up ./src/library/database.c.sync-update ./src/library/database.c ---- ./src/library/database.c.sync-update 2025-04-21 13:34:57.479790359 +0200 -+++ ./src/library/database.c 2025-04-21 13:34:57.480928947 +0200 -@@ -70,6 +70,9 @@ static struct pollfd ffd[1] = { {0, 0, - static integrity_t integrity; - static atomic_int reload_db = 0; - -+volatile atomic_bool update_thread_loop = false; -+volatile atomic_bool update_thread_stop = false; -+ - static pthread_t update_thread; - static pthread_mutex_t update_lock; - static pthread_mutex_t rule_lock; -@@ -1283,7 +1286,8 @@ static void *update_thread_main(void *ar - fcntl(ffd[0].fd, F_SETFL, O_NONBLOCK); - ffd[0].events = POLLIN; - -- while (!stop) { -+ update_thread_loop = true; -+ while (!update_thread_stop) { - - rc = poll(ffd, 1, 1000); - -@@ -1407,6 +1411,7 @@ static void *update_thread_main(void *ar - } - - finalize: -+ update_thread_loop = false; - close(ffd[0].fd); - unlink_fifo(); - diff --git a/fapolicyd.spec b/fapolicyd.spec index d795fab..96bac01 100644 --- a/fapolicyd.spec +++ b/fapolicyd.spec @@ -5,7 +5,7 @@ Summary: Application Whitelisting Daemon Name: fapolicyd Version: 1.3.3 -Release: 103%{?dist} +Release: 105%{?dist} License: GPLv3+ URL: http://people.redhat.com/sgrubb/fapolicyd Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz @@ -40,6 +40,8 @@ Patch7: fapolicyd-rpm-loader.patch Patch8: fapolicyd-infinite-loop.patch Patch9: fapolicyd-data-format.patch Patch10: var-run-t-dir-selinux.patch +Patch11: fapolicyd-skip-nonregular.patch +Patch12: fapolicyd-socket-segfault.patch %description Fapolicyd (File Access Policy Daemon) implements application whitelisting @@ -81,6 +83,8 @@ The %{name}-selinux package contains selinux policy for the %{name} daemon. %patch -P 8 -p1 -b .infinite-loop %patch -P 9 -p1 -b .data-format %patch -P 10 -p1 -b .var-run-dir +%patch -P 11 -p1 -b .skip-nonregular +%patch -P 12 -p1 -b .socket-segfault # generate rules for python sed -i "s|%python2_path%|`readlink -f %{__python2}`|g" rules.d/*.rules @@ -268,7 +272,7 @@ fi %selinux_relabel_post -s %{selinuxtype} %changelog -* Wed May 28 2025 Radovan Sroka - 1.3.3-103 +* Wed May 28 2025 Radovan Sroka - 1.3.3-105 RHEL 9.7.0 ERRATUM - RPMDB crashes with SIGBUS when updating the RPMDB repeatedly Resolves: RHEL-63090 @@ -278,6 +282,8 @@ Resolves: RHEL-59626 Resolves: RHEL-21871 - fapolicy rule containing 'pattern=normal' produces error Resolves: RHEL-30020 +- "fapolicyd-cli --file add" crashes when processing sockets +Resolves: RHEL-69136 * Wed Jul 19 2023 Radovan Sroka - 1.3.3-100 RHEL 9.5.0 ERRATUM