From 83b0e72abdf2ec44c18ec4c2f5736d71bc61998f Mon Sep 17 00:00:00 2001 From: Vojtech Trefny Date: Mon, 23 Jun 2025 10:17:42 +0200 Subject: [PATCH] Don't allow suid and dev set on fs resize Resolves: RHEL-96031 --- ...-allow-suid-and-dev-set-on-fs-resize.patch | 26 +++++++++++++++++++ libblockdev.spec | 7 ++++- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch diff --git a/0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch b/0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch new file mode 100644 index 0000000..d2fd952 --- /dev/null +++ b/0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch @@ -0,0 +1,26 @@ +From 9d1465a9093dd9929ab4c57f6c83df362699820d Mon Sep 17 00:00:00 2001 +From: Thomas Blume +Date: Fri, 16 May 2025 14:27:10 +0200 +Subject: [PATCH] Don't allow suid and dev set on fs resize + +Fixes: CVE-2025-6019 +--- + src/plugins/fs/generic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/plugins/fs/generic.c b/src/plugins/fs/generic.c +index 2b2180aa..60f7d75e 100644 +--- a/src/plugins/fs/generic.c ++++ b/src/plugins/fs/generic.c +@@ -661,7 +661,7 @@ static gchar* fs_mount (const gchar *device, gchar *fstype, gboolean read_only, + "Failed to create temporary directory for mounting '%s'.", device); + return NULL; + } +- ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "ro" : NULL, NULL, &l_error); ++ ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "nosuid,nodev,ro" : "nosuid,nodev", NULL, &l_error); + if (!ret) { + g_propagate_prefixed_error (error, l_error, "Failed to mount '%s': ", device); + g_rmdir (mountpoint); +-- +2.49.0 + diff --git a/libblockdev.spec b/libblockdev.spec index aec4e0f..90da5db 100644 --- a/libblockdev.spec +++ b/libblockdev.spec @@ -86,13 +86,14 @@ Name: libblockdev Version: 3.2.0 -Release: 3%{?dist} +Release: 5%{?dist} Summary: A library for low-level manipulation with block devices License: LGPL-2.1-or-later URL: https://github.com/storaged-project/libblockdev Source0: https://github.com/storaged-project/libblockdev/releases/download/%{version}/%{name}-%{version}.tar.gz Patch0: 0001-nvme_Avoid_element-type_g-i_annotations.patch Patch1: 0002-crypto-Add-a-function-to-set-persistent-flags-for-LU.patch +Patch2: 0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch BuildRequires: make BuildRequires: glib2-devel @@ -948,6 +949,10 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm} %files plugins-all %changelog +* Mon Jun 23 2025 Vojtech Trefny - 3.2.0-5 +- Don't allow suid and dev set on fs resize + Resolves: RHEL-96031 + * Tue Mar 11 2025 Vojtech Trefny - 3.2.0-3 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885