Don't allow suid and dev set on fs resize

Resolves: RHEL-96031

0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch

@@ -0,0 +1,26 @@
+From 9d1465a9093dd9929ab4c57f6c83df362699820d Mon Sep 17 00:00:00 2001
+From: Thomas Blume <Thomas.Blume@suse.com>
+Date: Fri, 16 May 2025 14:27:10 +0200
+Subject: [PATCH] Don't allow suid and dev set on fs resize
+
+Fixes: CVE-2025-6019
+---
+ src/plugins/fs/generic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/plugins/fs/generic.c b/src/plugins/fs/generic.c
+index 2b2180aa..60f7d75e 100644
+--- a/src/plugins/fs/generic.c
++++ b/src/plugins/fs/generic.c
+@@ -661,7 +661,7 @@ static gchar* fs_mount (const gchar *device, gchar *fstype, gboolean read_only,
+                              "Failed to create temporary directory for mounting '%s'.", device);
+                 return NULL;
+             }
+-            ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "ro" : NULL, NULL, &l_error);
++            ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "nosuid,nodev,ro" : "nosuid,nodev", NULL, &l_error);
+             if (!ret) {
+                 g_propagate_prefixed_error (error, l_error, "Failed to mount '%s': ", device);
+                 g_rmdir (mountpoint);
+-- 
+2.49.0
+

libblockdev.spec

@@ -86,13 +86,14 @@
 
 Name:        libblockdev
 Version:     3.2.0
-Release:     3%{?dist}
+Release:     5%{?dist}
 Summary:     A library for low-level manipulation with block devices
 License:     LGPL-2.1-or-later
 URL:         https://github.com/storaged-project/libblockdev
 Source0:     https://github.com/storaged-project/libblockdev/releases/download/%{version}/%{name}-%{version}.tar.gz
 Patch0:      0001-nvme_Avoid_element-type_g-i_annotations.patch
 Patch1:      0002-crypto-Add-a-function-to-set-persistent-flags-for-LU.patch
+Patch2:      0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch
 
 BuildRequires: make
 BuildRequires: glib2-devel
@@ -948,6 +949,10 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 %files plugins-all
 
 %changelog
+* Mon Jun 23 2025 Vojtech Trefny <vtrefny@redhat.com> - 3.2.0-5
+- Don't allow suid and dev set on fs resize
+  Resolves: RHEL-96031
+
 * Tue Mar 11 2025 Vojtech Trefny <vtrefny@redhat.com> - 3.2.0-3
 - crypto: Add a function to set persistent flags for LUKS
   Resolves: RHEL-82885