From 7bc395d8612b504c9752926f5b1df5e48e2e622c Mon Sep 17 00:00:00 2001 From: Pavel Cahyna Date: Fri, 1 Aug 2025 17:09:07 +0200 Subject: [PATCH] Backport fix of --no-overwrite-dir Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463 Resolves: RHEL-105968 --- tar-1.34-CVE-2025-45582.patch | 182 ++++++++--------- ...te-dir-no-overwrite-even-temporarily.patch | 184 ++++++++++++++++++ tar.spec | 2 + 3 files changed, 277 insertions(+), 91 deletions(-) create mode 100644 tar-1.34-no-overwrite-dir-no-overwrite-even-temporarily.patch diff --git a/tar-1.34-CVE-2025-45582.patch b/tar-1.34-CVE-2025-45582.patch index 8a1db61..b86e0c0 100644 --- a/tar-1.34-CVE-2025-45582.patch +++ b/tar-1.34-CVE-2025-45582.patch @@ -1,6 +1,6 @@ -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/aclocal.m4 tar-1.34-rhel-9.8-clean/aclocal.m4 ---- tar-1.34-rhel-9.7/aclocal.m4 2025-12-12 13:03:34.135100650 +0100 -+++ tar-1.34-rhel-9.8-clean/aclocal.m4 2025-12-19 16:27:11.022371960 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/aclocal.m4 tar-1.34-rhel-9.8-clean/aclocal.m4 +--- a/aclocal.m4 2026-01-12 16:27:23.929483803 +0100 ++++ b/aclocal.m4 2026-01-12 16:33:05.924014963 +0100 @@ -1292,6 +1292,7 @@ m4_include([m4/open-slash.m4]) m4_include([m4/open.m4]) @@ -9,9 +9,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli m4_include([m4/opendir.m4]) m4_include([m4/parse-datetime.m4]) m4_include([m4/pathmax.m4]) -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/doc/tar.texi tar-1.34-rhel-9.8-clean/doc/tar.texi ---- tar-1.34-rhel-9.7/doc/tar.texi 2025-12-11 15:55:21.932996281 +0100 -+++ tar-1.34-rhel-9.8-clean/doc/tar.texi 2025-12-11 15:39:02.395862349 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/doc/tar.texi tar-1.34-rhel-9.8-clean/doc/tar.texi +--- a/doc/tar.texi 2026-01-12 16:26:50.532434565 +0100 ++++ b/doc/tar.texi 2026-01-12 16:32:28.470876836 +0100 @@ -12809,26 +12809,31 @@ When @command{tar} extracts from an archive, by default it writes into files relative to the working directory. If the archive was generated @@ -78,9 +78,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli @item Do not let untrusted users access files extracted from untrusted archives without checking first for problems such as setuid programs. -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/fcntl.in.h tar-1.34-rhel-9.8-clean/gnu/fcntl.in.h ---- tar-1.34-rhel-9.7/gnu/fcntl.in.h 2025-12-12 13:03:03.674252702 +0100 -+++ tar-1.34-rhel-9.8-clean/gnu/fcntl.in.h 2025-12-12 13:03:04.802284103 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/fcntl.in.h tar-1.34-rhel-9.8-clean/gnu/fcntl.in.h +--- a/gnu/fcntl.in.h 2026-01-12 16:27:10.573064736 +0100 ++++ b/gnu/fcntl.in.h 2026-01-12 16:32:51.735584155 +0100 @@ -233,6 +233,46 @@ # endif #endif @@ -144,9 +144,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli #endif /* _@GUARD_PREFIX@_FCNTL_H */ #endif /* _@GUARD_PREFIX@_FCNTL_H */ #endif -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/Makefile.am tar-1.34-rhel-9.8-clean/gnu/Makefile.am ---- tar-1.34-rhel-9.7/gnu/Makefile.am 2025-12-12 13:03:20.614724279 +0100 -+++ tar-1.34-rhel-9.8-clean/gnu/Makefile.am 2025-12-12 13:03:21.738755570 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/Makefile.am tar-1.34-rhel-9.8-clean/gnu/Makefile.am +--- a/gnu/Makefile.am 2026-01-12 16:27:18.417310942 +0100 ++++ b/gnu/Makefile.am 2026-01-12 16:33:00.127839022 +0100 @@ -68,6 +68,7 @@ # gitlog-to-changelog \ # hash \ @@ -192,9 +192,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli ## begin gnulib module opendir -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/openat2.c tar-1.34-rhel-9.8-clean/gnu/openat2.c ---- tar-1.34-rhel-9.7/gnu/openat2.c 1970-01-01 01:00:00.000000000 +0100 -+++ tar-1.34-rhel-9.8-clean/gnu/openat2.c 2025-12-12 13:03:05.526304258 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/openat2.c tar-1.34-rhel-9.8-clean/gnu/openat2.c +--- a/gnu/openat2.c 1970-01-01 01:00:00.000000000 +0100 ++++ b/gnu/openat2.c 2026-01-12 16:32:51.431574919 +0100 @@ -0,0 +1,601 @@ +/* Open a file, with more flags than openat + Copyright 2025 Free Software Foundation, Inc. @@ -797,9 +797,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli + } + return r; +} -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/xalloc.h tar-1.34-rhel-9.8-clean/gnu/xalloc.h ---- tar-1.34-rhel-9.7/gnu/xalloc.h 2025-12-12 13:03:05.130293235 +0100 -+++ tar-1.34-rhel-9.8-clean/gnu/xalloc.h 2025-12-12 13:03:06.318326306 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/xalloc.h tar-1.34-rhel-9.8-clean/gnu/xalloc.h +--- a/gnu/xalloc.h 2026-01-12 16:27:11.349089104 +0100 ++++ b/gnu/xalloc.h 2026-01-12 16:32:52.487607000 +0100 @@ -21,6 +21,7 @@ #include #include @@ -817,9 +817,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli void *xmemdup (void const *p, size_t s) _GL_ATTRIBUTE_ALLOC_SIZE ((2)); char *xstrdup (char const *str) -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/xmalloc.c tar-1.34-rhel-9.8-clean/gnu/xmalloc.c ---- tar-1.34-rhel-9.7/gnu/xmalloc.c 2025-12-12 13:03:05.146293680 +0100 -+++ tar-1.34-rhel-9.8-clean/gnu/xmalloc.c 2025-12-12 13:03:06.338326863 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/xmalloc.c tar-1.34-rhel-9.8-clean/gnu/xmalloc.c +--- a/gnu/xmalloc.c 2026-01-12 16:27:11.361089481 +0100 ++++ b/gnu/xmalloc.c 2026-01-12 16:32:52.495607243 +0100 @@ -21,6 +21,9 @@ #include "xalloc.h" @@ -897,9 +897,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli /* Allocate N bytes of zeroed memory dynamically, with error checking. There's no need for xnzalloc (N, S), since it would be equivalent to xcalloc (N, S). */ -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/m4/fcntl_h.m4 tar-1.34-rhel-9.8-clean/m4/fcntl_h.m4 ---- tar-1.34-rhel-9.7/m4/fcntl_h.m4 2025-12-12 13:03:05.322298579 +0100 -+++ tar-1.34-rhel-9.8-clean/m4/fcntl_h.m4 2025-12-12 13:03:06.518331873 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/m4/fcntl_h.m4 tar-1.34-rhel-9.8-clean/m4/fcntl_h.m4 +--- a/m4/fcntl_h.m4 2026-01-12 16:27:11.465092747 +0100 ++++ b/m4/fcntl_h.m4 2026-01-12 16:32:52.575609673 +0100 @@ -1,6 +1,6 @@ # serial 17 # Configure fcntl.h. @@ -932,9 +932,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli REPLACE_CREAT=0; AC_SUBST([REPLACE_CREAT]) REPLACE_FCNTL=0; AC_SUBST([REPLACE_FCNTL]) REPLACE_OPEN=0; AC_SUBST([REPLACE_OPEN]) -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/m4/gnulib-comp.m4 tar-1.34-rhel-9.8-clean/m4/gnulib-comp.m4 ---- tar-1.34-rhel-9.7/m4/gnulib-comp.m4 2025-12-12 13:03:23.538805677 +0100 -+++ tar-1.34-rhel-9.8-clean/m4/gnulib-comp.m4 2025-12-12 13:03:24.906843760 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/m4/gnulib-comp.m4 tar-1.34-rhel-9.8-clean/m4/gnulib-comp.m4 +--- a/m4/gnulib-comp.m4 2026-01-12 16:27:20.125364520 +0100 ++++ b/m4/gnulib-comp.m4 2026-01-12 16:33:01.955894520 +0100 @@ -214,6 +214,7 @@ # Code from module openat-die: # Code from module openat-h: @@ -972,9 +972,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli m4/opendir.m4 m4/parse-datetime.m4 m4/pathmax.m4 -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/m4/openat2.m4 tar-1.34-rhel-9.8-clean/m4/openat2.m4 ---- tar-1.34-rhel-9.7/m4/openat2.m4 1970-01-01 01:00:00.000000000 +0100 -+++ tar-1.34-rhel-9.8-clean/m4/openat2.m4 2025-12-12 13:03:06.890342230 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/m4/openat2.m4 tar-1.34-rhel-9.8-clean/m4/openat2.m4 +--- a/m4/openat2.m4 1970-01-01 01:00:00.000000000 +0100 ++++ b/m4/openat2.m4 2026-01-12 16:32:51.439575162 +0100 @@ -0,0 +1,33 @@ +# openat2.m4 +# serial 1 @@ -1009,9 +1009,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli + #include + ]])]) +]) -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/NEWS tar-1.34-rhel-9.8-clean/NEWS ---- tar-1.34-rhel-9.7/NEWS 2025-12-11 15:55:21.924996045 +0100 -+++ tar-1.34-rhel-9.8-clean/NEWS 2025-12-11 15:39:02.391862228 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/NEWS tar-1.34-rhel-9.8-clean/NEWS +--- a/NEWS 2026-01-12 16:26:50.528434439 +0100 ++++ b/NEWS 2026-01-12 16:32:28.466876714 +0100 @@ -1,6 +1,17 @@ -GNU tar NEWS - User visible changes. 2021-02-13 +GNU tar NEWS - User visible changes. 2025-12-05 @@ -1031,9 +1031,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli version 1.34 - Sergey Poznyakoff, 2021-02-13 * Fix extraction over pipe (savannah bug #60002) -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/common.h tar-1.34-rhel-9.8-clean/src/common.h ---- tar-1.34-rhel-9.7/src/common.h 2025-12-11 15:55:21.936996399 +0100 -+++ tar-1.34-rhel-9.8-clean/src/common.h 2025-12-11 15:39:02.399862469 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/common.h tar-1.34-rhel-9.8-clean/src/common.h +--- a/src/common.h 2026-01-12 16:26:50.612437084 +0100 ++++ b/src/common.h 2026-01-12 16:32:28.674883043 +0100 @@ -58,6 +58,7 @@ #include #include @@ -1078,9 +1078,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli int chdir_count (void); void close_diag (char const *name); -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/compare.c tar-1.34-rhel-9.8-clean/src/compare.c ---- tar-1.34-rhel-9.7/src/compare.c 2025-12-11 15:55:21.936996399 +0100 -+++ tar-1.34-rhel-9.8-clean/src/compare.c 2025-12-11 15:39:02.399862469 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/compare.c tar-1.34-rhel-9.8-clean/src/compare.c +--- a/src/compare.c 2026-01-12 16:26:50.616437210 +0100 ++++ b/src/compare.c 2026-01-12 16:32:28.674883043 +0100 @@ -219,7 +219,9 @@ } else @@ -1133,9 +1133,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli if (fd < 0) { -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/create.c tar-1.34-rhel-9.8-clean/src/create.c ---- tar-1.34-rhel-9.7/src/create.c 2025-12-11 15:55:21.936996399 +0100 -+++ tar-1.34-rhel-9.8-clean/src/create.c 2025-12-11 15:39:02.399862469 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/create.c tar-1.34-rhel-9.8-clean/src/create.c +--- a/src/create.c 2026-01-12 16:26:50.616437210 +0100 ++++ b/src/create.c 2026-01-12 16:32:28.674883043 +0100 @@ -1386,8 +1386,10 @@ { if (! st.orig_file_name) @@ -1332,9 +1332,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli } else if (S_ISSOCK (st->stat.st_mode)) { -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/exclist.c tar-1.34-rhel-9.8-clean/src/exclist.c ---- tar-1.34-rhel-9.7/src/exclist.c 2025-12-11 15:55:21.936996399 +0100 -+++ tar-1.34-rhel-9.8-clean/src/exclist.c 2025-12-11 15:39:02.399862469 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/exclist.c tar-1.34-rhel-9.8-clean/src/exclist.c +--- a/src/exclist.c 2026-01-12 16:26:50.616437210 +0100 ++++ b/src/exclist.c 2026-01-12 16:32:28.674883043 +0100 @@ -77,7 +77,7 @@ return; for (file = excfile_head; file; file = file->next) @@ -1358,9 +1358,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli if ((result = excluded_file_name (ep->excluded, rname))) break; -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/extract.c tar-1.34-rhel-9.8-clean/src/extract.c ---- tar-1.34-rhel-9.7/src/extract.c 2025-12-11 15:55:21.936996399 +0100 -+++ tar-1.34-rhel-9.8-clean/src/extract.c 2025-12-19 16:24:30.833719042 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/extract.c tar-1.34-rhel-9.8-clean/src/extract.c +--- a/src/extract.c 2026-01-12 16:26:50.616437210 +0100 ++++ b/src/extract.c 2026-01-12 16:32:28.678883165 +0100 @@ -202,7 +202,8 @@ if (result == 0 || implemented (errno)) return result; @@ -1517,7 +1517,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli if (status == 0) { current_mode = mode & ~ current_umask; -@@ -1160,14 +1181,17 @@ +@@ -1135,14 +1156,17 @@ } } @@ -1537,7 +1537,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli && S_ISLNK (st.st_mode)) { errno = ELOOP; -@@ -1175,7 +1199,7 @@ +@@ -1150,7 +1174,7 @@ } } @@ -1546,7 +1546,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli if (0 <= fd) { if (overwriting_old_files) -@@ -1342,8 +1366,9 @@ +@@ -1317,8 +1341,9 @@ if (!delayed_link_head) return NULL; @@ -1558,7 +1558,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli { if (errno != ENOENT) stat_error (name); -@@ -1375,8 +1400,16 @@ +@@ -1350,8 +1375,16 @@ int fd; struct stat st; @@ -1576,7 +1576,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli if (errno == EEXIST && find_delayed_link_source (file_name)) { /* The placeholder file has already been created. This means -@@ -1478,16 +1511,24 @@ +@@ -1453,16 +1486,24 @@ do { @@ -1606,7 +1606,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli for (; ds; ds = ds->next) if (ds->change_dir == chdir_current && ds->dev == st1.st_dev -@@ -1504,15 +1545,15 @@ +@@ -1479,15 +1520,15 @@ } return 0; } @@ -1630,7 +1630,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli errno = e; } while ((rc = maybe_recoverable (file_name, false, &interdir_made)) -@@ -1539,7 +1580,10 @@ +@@ -1514,7 +1555,10 @@ || contains_dot_dot (current_stat_info.link_name))) return create_placeholder_file (file_name, true, &interdir_made, NULL); @@ -1642,7 +1642,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli switch (maybe_recoverable (file_name, false, &interdir_made)) { case RECOVER_OK: -@@ -1579,8 +1623,10 @@ +@@ -1554,8 +1598,10 @@ mode_t mode = (current_stat_info.stat.st_mode & (MODE_RWX | S_IFBLK | S_IFCHR) & ~ (0 < same_owner_option ? S_IRWXG | S_IRWXO : 0)); @@ -1655,7 +1655,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli switch (maybe_recoverable (file_name, false, &interdir_made)) { case RECOVER_OK: -@@ -1609,7 +1655,10 @@ +@@ -1584,7 +1630,10 @@ mode_t mode = (current_stat_info.stat.st_mode & MODE_RWX & ~ (0 < same_owner_option ? S_IRWXG | S_IRWXO : 0)); @@ -1667,7 +1667,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli switch (maybe_recoverable (file_name, false, &interdir_made)) { case RECOVER_OK: -@@ -1848,25 +1897,30 @@ +@@ -1823,25 +1872,30 @@ /* Make sure the placeholder file is still there. If not, don't create a link, as the placeholder was probably removed by a later extraction. */ @@ -1704,7 +1704,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli symlink_error (ds->target, source); else { -@@ -1929,9 +1983,14 @@ +@@ -1904,9 +1958,14 @@ bool rename_directory (char *src, char *dst) { @@ -1722,7 +1722,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli { int e = errno; bool interdir_made; -@@ -1941,8 +2000,13 @@ +@@ -1916,8 +1975,13 @@ case ENOENT: if (make_directories (dst, &interdir_made) == 0) { @@ -1738,9 +1738,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli e = errno; } break; -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/misc.c tar-1.34-rhel-9.8-clean/src/misc.c ---- tar-1.34-rhel-9.7/src/misc.c 2025-12-11 15:55:21.940996517 +0100 -+++ tar-1.34-rhel-9.8-clean/src/misc.c 2025-12-11 15:39:02.403862591 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/misc.c tar-1.34-rhel-9.8-clean/src/misc.c +--- a/src/misc.c 2026-01-12 16:26:50.616437210 +0100 ++++ b/src/misc.c 2026-01-12 16:32:28.678883165 +0100 @@ -250,6 +250,30 @@ return name; } @@ -2264,9 +2264,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli if (fd < 0) { if (!must_exist && errno == ENOENT) -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/names.c tar-1.34-rhel-9.8-clean/src/names.c ---- tar-1.34-rhel-9.7/src/names.c 2025-12-11 15:55:21.940996517 +0100 -+++ tar-1.34-rhel-9.8-clean/src/names.c 2025-12-11 15:39:02.403862591 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/names.c tar-1.34-rhel-9.8-clean/src/names.c +--- a/src/names.c 2026-01-12 16:26:50.616437210 +0100 ++++ b/src/names.c 2026-01-12 16:32:28.678883165 +0100 @@ -1786,8 +1786,9 @@ } if (S_ISDIR (st.stat.st_mode)) @@ -2279,9 +2279,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli if (dir_fd < 0) open_diag (name->name); else -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/tar.c tar-1.34-rhel-9.8-clean/src/tar.c ---- tar-1.34-rhel-9.7/src/tar.c 2025-12-11 15:55:21.940996517 +0100 -+++ tar-1.34-rhel-9.8-clean/src/tar.c 2025-12-11 15:39:02.403862591 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/tar.c tar-1.34-rhel-9.8-clean/src/tar.c +--- a/src/tar.c 2026-01-12 16:26:50.620437336 +0100 ++++ b/src/tar.c 2026-01-12 16:32:28.678883165 +0100 @@ -2597,16 +2597,29 @@ if (recursive_unlink_option) old_files_option = UNLINK_FIRST_OLD_FILES; @@ -2321,9 +2321,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli } fstatat_flags = dereference_option ? 0 : AT_SYMLINK_NOFOLLOW; -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/unlink.c tar-1.34-rhel-9.8-clean/src/unlink.c ---- tar-1.34-rhel-9.7/src/unlink.c 2025-12-11 15:55:21.940996517 +0100 -+++ tar-1.34-rhel-9.8-clean/src/unlink.c 2025-12-11 15:39:02.403862591 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/unlink.c tar-1.34-rhel-9.8-clean/src/unlink.c +--- a/src/unlink.c 2026-01-12 16:26:50.620437336 +0100 ++++ b/src/unlink.c 2026-01-12 16:32:28.678883165 +0100 @@ -117,7 +117,10 @@ else fname = p->file_name; @@ -2366,9 +2366,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli dunlink_reclaim (p); dunlink_count--; p = next; -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/update.c tar-1.34-rhel-9.8-clean/src/update.c ---- tar-1.34-rhel-9.7/src/update.c 2025-12-11 15:55:21.940996517 +0100 -+++ tar-1.34-rhel-9.8-clean/src/update.c 2025-12-11 15:39:02.403862591 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/update.c tar-1.34-rhel-9.8-clean/src/update.c +--- a/src/update.c 2026-01-12 16:26:50.620437336 +0100 ++++ b/src/update.c 2026-01-12 16:32:28.678883165 +0100 @@ -47,8 +47,9 @@ static void append_file (char *file_name) @@ -2380,9 +2380,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli if (handle < 0) { -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/xattrs.c tar-1.34-rhel-9.8-clean/src/xattrs.c ---- tar-1.34-rhel-9.7/src/xattrs.c 2025-12-11 15:55:21.944996635 +0100 -+++ tar-1.34-rhel-9.8-clean/src/xattrs.c 2025-12-11 15:39:02.403862591 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/xattrs.c tar-1.34-rhel-9.8-clean/src/xattrs.c +--- a/src/xattrs.c 2026-01-12 16:26:50.620437336 +0100 ++++ b/src/xattrs.c 2026-01-12 16:32:28.682883287 +0100 @@ -219,7 +219,8 @@ /* No "default" IEEE 1003.1e ACL set for directory. At this moment, FILE_NAME may already have inherited default acls from parent @@ -2444,9 +2444,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli sysname = "lsetfileconat"; } -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/tests/extrac31.at tar-1.34-rhel-9.8-clean/tests/extrac31.at ---- tar-1.34-rhel-9.7/tests/extrac31.at 1970-01-01 01:00:00.000000000 +0100 -+++ tar-1.34-rhel-9.8-clean/tests/extrac31.at 2025-12-11 15:39:02.407862711 +0100 +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/tests/extrac31.at tar-1.34-rhel-9.8-clean/tests/extrac31.at +--- a/tests/extrac31.at 1970-01-01 01:00:00.000000000 +0100 ++++ b/tests/extrac31.at 2026-01-12 16:32:28.682883287 +0100 @@ -0,0 +1,55 @@ +# Test suite for GNU tar. -*- Autotest -*- +# Copyright 2025 Free Software Foundation, Inc. @@ -2503,24 +2503,24 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli +tar: Exiting with failure status due to previous errors +]) +AT_CLEANUP -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/tests/Makefile.am tar-1.34-rhel-9.8-clean/tests/Makefile.am ---- tar-1.34-rhel-9.7/tests/Makefile.am 2025-12-11 15:55:21.944996635 +0100 -+++ tar-1.34-rhel-9.8-clean/tests/Makefile.am 2025-12-11 15:39:02.403862591 +0100 -@@ -123,6 +123,7 @@ - extrac22.at\ +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/tests/Makefile.am tar-1.34-rhel-9.8-clean/tests/Makefile.am +--- a/tests/Makefile.am 2026-01-12 16:26:50.620437336 +0100 ++++ b/tests/Makefile.am 2026-01-12 16:32:28.682883287 +0100 +@@ -124,6 +124,7 @@ extrac23.at\ extrac24.at\ + extrac30.at\ + extrac31.at\ filerem01.at\ filerem02.at\ dirrem01.at\ -diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/tests/testsuite.at tar-1.34-rhel-9.8-clean/tests/testsuite.at ---- tar-1.34-rhel-9.7/tests/testsuite.at 2025-12-11 15:55:21.952996871 +0100 -+++ tar-1.34-rhel-9.8-clean/tests/testsuite.at 2025-12-11 15:39:02.411862832 +0100 -@@ -345,6 +345,7 @@ - m4_include([extrac22.at]) +diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/tests/testsuite.at tar-1.34-rhel-9.8-clean/tests/testsuite.at +--- a/tests/testsuite.at 2026-01-12 16:26:50.620437336 +0100 ++++ b/tests/testsuite.at 2026-01-12 16:32:28.682883287 +0100 +@@ -346,6 +346,7 @@ m4_include([extrac23.at]) m4_include([extrac24.at]) + m4_include([extrac30.at]) +m4_include([extrac31.at]) m4_include([backup01.at]) diff --git a/tar-1.34-no-overwrite-dir-no-overwrite-even-temporarily.patch b/tar-1.34-no-overwrite-dir-no-overwrite-even-temporarily.patch new file mode 100644 index 0000000..32021a7 --- /dev/null +++ b/tar-1.34-no-overwrite-dir-no-overwrite-even-temporarily.patch @@ -0,0 +1,184 @@ +From 5c151e963652f695557766c8123755a95ad8ab12 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Sat, 26 Jul 2025 21:41:23 -0700 +Subject: [PATCH] --no-overwrite-dir no overwrite even temporarily + +Problem and fix reported by Pavel Cahyna in +https://lists.gnu.org/r/bug-tar/2025-01/msg00000.html +* src/extract.c (extract_dir): With --no-overwrite-dir, +skip the chmod if the directory already exists. +* tests/extrac23.at (--no-overwrite-dir on empty directory): +Move the part of the test that looks at a nonempty directory ... +* tests/extrac30.at: ... to this new file, because the test now +must be run as non-root. Adjust the test to match the new behavior. +* tests/Makefile.am (TESTSUITE_AT), tests/testsuite.at: Add it. + +(cherry picked from commit b5ecab839bdbce1757f466895f3eca956b931e23) +--- + src/extract.c | 25 ------------------------ + tests/Makefile.am | 1 + + tests/extrac23.at | 16 +--------------- + tests/extrac30.at | 47 ++++++++++++++++++++++++++++++++++++++++++++++ + tests/testsuite.at | 1 + + 5 files changed, 50 insertions(+), 40 deletions(-) + create mode 100644 tests/extrac30.at + +diff --git a/src/extract.c b/src/extract.c +index 80009a54..8bab30a2 100644 +--- a/src/extract.c ++++ b/src/extract.c +@@ -1070,31 +1070,6 @@ extract_dir (char *file_name, int typeflag) + repair_delayed_set_stat (file_name, &st); + return 0; + } +- else if (old_files_option == NO_OVERWRITE_DIR_OLD_FILES) +- { +- /* Temporarily change the directory mode to a safe +- value, to be able to create files in it, should +- the need be. +- */ +- mode = safe_dir_mode (&st); +- status = fd_chmod(-1, file_name, mode, +- AT_SYMLINK_NOFOLLOW, DIRTYPE); +- if (status == 0) +- { +- /* Store the actual directory mode, to be restored +- later. +- */ +- current_stat_info.stat = st; +- current_mode = mode & ~ current_umask; +- current_mode_mask = MODE_RWX; +- atflag = AT_SYMLINK_NOFOLLOW; +- break; +- } +- else +- { +- chmod_error_details (file_name, mode); +- } +- } + break; + } + } +diff --git a/tests/Makefile.am b/tests/Makefile.am +index f01ca270..b3c503dc 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -123,6 +123,7 @@ TESTSUITE_AT = \ + extrac22.at\ + extrac23.at\ + extrac24.at\ ++ extrac30.at\ + filerem01.at\ + filerem02.at\ + dirrem01.at\ +diff --git a/tests/extrac23.at b/tests/extrac23.at +index 84f97446..2adc2276 100644 +--- a/tests/extrac23.at ++++ b/tests/extrac23.at +@@ -15,15 +15,12 @@ + # + # You should have received a copy of the GNU General Public License + # along with this program. If not, see . +-AT_SETUP([--no-overwrite-dir]) ++AT_SETUP([--no-overwrite-dir on empty directory]) + AT_KEYWORDS([extract extrac23 no-overwrite-dir]) + + # Description: Implementation of the --no-overwrite-dir option was flawed in + # tar versions up to 1.32.90. This option is intended to preserve metadata + # of existing directories. In fact it worked only for non-empty directories. +-# Moreover, if the actual directory was owned by the user tar runs as and the +-# S_IWUSR bit was not set in its actual permissions, tar failed to create files +-# in it. + # + # Reported by: Michael Kaufmann + # References: <20200207112934.Horde.anXzYhAj2CHiwUrw5CuT0G-@webmail.michael-kaufmann.ch>, +@@ -38,21 +35,10 @@ chmod 777 dir + tar -xf a.tar --no-overwrite-dir + genfile --stat=mode.777 dir + +-# Test if temprorary permissions are set correctly to allow the owner +-# to write to the directory. +-genfile --file dir/file +-tar cf a.tar dir +-rm dir/file +-chmod 400 dir +-tar -xf a.tar --no-overwrite-dir +-genfile --stat=mode.777 dir +-chmod 700 dir + find dir + ], + [0], + [777 +-400 + dir +-dir/file + ]) + AT_CLEANUP +diff --git a/tests/extrac30.at b/tests/extrac30.at +new file mode 100644 +index 00000000..8c879c95 +--- /dev/null ++++ b/tests/extrac30.at +@@ -0,0 +1,47 @@ ++# Test suite for GNU tar. -*- Autotest -*- ++# Copyright 2020-2025 Free Software Foundation, Inc. ++# ++# This file is part of GNU tar. ++# ++# GNU tar is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# GNU tar is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++AT_SETUP([--no-overwrite-dir on unwritable directory]) ++AT_KEYWORDS([extract extrac30 no-overwrite-dir]) ++ ++# Make sure that tar does not change permissions on directories if ++# --no-overwrite-dir tells it not to, not even temporarily. ++ ++AT_TAR_CHECK([ ++AT_UNPRIVILEGED_PREREQ ++ ++# Test that the user cannot write to a unwritable directory ++# if --no-overwrite-dir is used. ++mkdir dir ++chmod 755 dir ++genfile --file dir/file ++tar cf a.tar dir ++rm dir/file ++chmod 555 dir ++tar -xf a.tar --no-overwrite-dir ++genfile --stat=mode.777 dir ++chmod 755 dir ++find dir ++], ++[0], ++[555 ++dir ++], ++[tar: dir/file: Cannot open: Permission denied ++tar: Exiting with failure status due to previous errors ++]) ++AT_CLEANUP +diff --git a/tests/testsuite.at b/tests/testsuite.at +index 775e765a..b11ee50e 100644 +--- a/tests/testsuite.at ++++ b/tests/testsuite.at +@@ -345,6 +345,7 @@ m4_include([extrac21.at]) + m4_include([extrac22.at]) + m4_include([extrac23.at]) + m4_include([extrac24.at]) ++m4_include([extrac30.at]) + + m4_include([backup01.at]) + +-- +2.39.5 + diff --git a/tar.spec b/tar.spec index ec76aad..a11b0db 100644 --- a/tar.spec +++ b/tar.spec @@ -23,6 +23,8 @@ Patch11: tar-1.30-padding-zeros.patch Patch12: tar-1.30-disk-read-error.patch Patch13: tar-1.34-CVE-2022-48303.patch Patch14: tar-1.34-Warn-file-changed-as-we-read-it-less-often.patch +# Source: https://cgit.git.savannah.gnu.org/cgit/tar.git/diff/?id=4e742fc8674064a9fa00d4483d06aca48d5b0463 +Patch22: tar-1.34-no-overwrite-dir-no-overwrite-even-temporarily.patch #tar commits from upstream # 56fb4a96ca43c247261b8c04dd65592f990f98ac # 7c241126f14975c7f5df4268b434f276fc7f8842