mbox series

[wrynose,0/3] acl: Security fixes

Message ID 20261104055335.2080900-1-dkelaiya@cisco.com
Headers show
Series acl: Security fixes | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 4, 2026, 5:53 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport the upstream fixes for CVE-2026-54369 and CVE-2026-54370 to
ACL 2.3.2.

CVE-2026-54369 adds descriptor-relative ACL APIs so callers can control
symlink traversal. CVE-2026-54370 uses those APIs to harden getfacl,
setfacl, setfacl --restore and chacl against path replacement races and
unsafe symlink traversal.

Retain ACL 2.3.2 on the stable Wrynose branch and backport the security
fixes with the required _at APIs and helper dependencies. This follows
OE-Core's focus on security and bug fixes for stable branches [1],
avoiding a general recipe upgrade to ACL 2.4.0. Existing pathname API
behavior is preserved.

The new public acl_*_at declarations conflict with private helpers
using the same names in GNU tar 1.35. Patch 1 backports the upstream
tar rename before patches 2 and 3 introduce and consume
the new ACL APIs.

[1] https://docs.yoctoproject.org/6.0/ref-manual/release-process.html#stable-release-process

Darsh Kelaiya (3):
  tar: avoid name conflicts with new libacl APIs
  acl: fix CVE-2026-54369
  acl: fix CVE-2026-54370

 .../tar/tar/Avoid-acl_-prefix-for-functions.patch     | 103 ++
 meta/recipes-extended/tar/tar_1.35.bb                 |   1 +
 .../attr/acl/CVE-2026-54369-dependent_p1.patch        |  69 ++
 .../attr/acl/CVE-2026-54369-dependent_p2.patch        | 200 ++++
 .../attr/acl/CVE-2026-54369-dependent_p3.patch        | 712 +++++++++++++
 meta/recipes-support/attr/acl/CVE-2026-54369_p1.patch | 719 +++++++++++++
 meta/recipes-support/attr/acl/CVE-2026-54369_p2.patch | 957 ++++++++++++++++++
 meta/recipes-support/attr/acl/CVE-2026-54369_p3.patch | 109 ++
 .../attr/acl/CVE-2026-54370-dependent_p1.patch        | 168 +++
 .../attr/acl/CVE-2026-54370-dependent_p2.patch        | 761 ++++++++++++++
 .../attr/acl/CVE-2026-54370-dependent_p3.patch        | 439 ++++++++
 .../attr/acl/CVE-2026-54370-dependent_p4.patch        | 140 +++
 meta/recipes-support/attr/acl/CVE-2026-54370_p1.patch | 299 ++++++
 meta/recipes-support/attr/acl/CVE-2026-54370_p2.patch | 403 ++++++++
 meta/recipes-support/attr/acl/CVE-2026-54370_p3.patch | 603 +++++++++++
 meta/recipes-support/attr/acl/CVE-2026-54370_p4.patch | 213 ++++
 meta/recipes-support/attr/acl_2.3.2.bb                |  14 +
 17 files changed, 5910 insertions(+)
 create mode 100644 meta/recipes-extended/tar/tar/Avoid-acl_-prefix-for-functions.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369-dependent_p1.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369-dependent_p2.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369-dependent_p3.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369_p1.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369_p2.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369_p3.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370-dependent_p1.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370-dependent_p2.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370-dependent_p3.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370-dependent_p4.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370_p1.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370_p2.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370_p3.patch
 create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370_p4.patch