diff mbox series

[yocto-patches,meta-selinux,wrynose,1/2] selinux: ignore CVE-2026-59676 in components excluding seunshare

Message ID 20261105070309.834959-1-dkelaiya@cisco.com
State New
Headers show
Series [yocto-patches,meta-selinux,wrynose,1/2] selinux: ignore CVE-2026-59676 in components excluding seunshare | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 7:03 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Analysis:
- CVE-2026-59676 affects recursive deletion in sandbox/seunshare.c
  and is fixed by adding O_NOFOLLOW to openat() [1, 2].
- SELinux components share a broad CVE product mapping through
  selinux_common.inc [3]. Only selinux-sandbox builds seunshare.
- Set not-applicable-config once in the shared include for the
  components that exclude seunshare, including native variants.
- For BPN selinux-sandbox, remove this status flag after parsing
  so CVE reporting detects the source patch carried by its recipe.

Reference:
[1] https://security.opensuse.org/2026/07/15/selinux-seunshare.html
[2] https://github.com/SELinuxProject/selinux/commit/38f0a4d9a683f2cd2472d4502842df5d5b8255a8
[3] https://git.yoctoproject.org/meta-selinux/tree/recipes-security/selinux/selinux_common.inc?id=1c3a699f363167571ab39fecb0fe6f56691a4e20

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 recipes-security/selinux/selinux_common.inc | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series

Patch

diff --git a/recipes-security/selinux/selinux_common.inc b/recipes-security/selinux/selinux_common.inc
index aaf0b90..bf7aa78 100644
--- a/recipes-security/selinux/selinux_common.inc
+++ b/recipes-security/selinux/selinux_common.inc
@@ -21,3 +21,10 @@  do_install() {
 }
 
 CVE_PRODUCT ?= "selinux_project:selinux"
+
+CVE_STATUS[CVE-2026-59676] = "not-applicable-config: The vulnerable seunshare utility is built by selinux-sandbox."
+
+python __anonymous() {
+    if d.getVar("BPN") == "selinux-sandbox":
+        d.delVarFlag("CVE_STATUS", "CVE-2026-59676")
+}