diff mbox series

[yocto-patches,meta-selinux,wrynose,2/2] selinux: ignore CVE-2026-59677 in components excluding seunshare

Message ID 20261105070309.834959-2-dkelaiya@cisco.com
State New
Headers show
Series [yocto-patches,meta-selinux,wrynose,1/2] selinux: ignore CVE-2026-59676 in components excluding seunshare | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 7:03 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Analysis:
- CVE-2026-59677 affects the privileged --kill path in seunshare;
  upstream removes its killall() helper to fix the issue [1, 2].
- SELinux components share a broad CVE product mapping through
  selinux_common.inc [3]. Only selinux-sandbox builds seunshare.
- Set not-applicable-config once in the shared include for the
  components that exclude seunshare, including native variants.
- For BPN selinux-sandbox, remove this status flag after parsing
  so CVE reporting detects the source patch carried by its recipe.

Reference:
[1] https://security.opensuse.org/2026/07/15/selinux-seunshare.html
[2] https://github.com/SELinuxProject/selinux/commit/572db2fae9157ae620160e0d7b2c3f8b75fe6c1a
[3] https://git.yoctoproject.org/meta-selinux/tree/recipes-security/selinux/selinux_common.inc?id=1c3a699f363167571ab39fecb0fe6f56691a4e20

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 recipes-security/selinux/selinux_common.inc | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/recipes-security/selinux/selinux_common.inc b/recipes-security/selinux/selinux_common.inc
index bf7aa78..e434853 100644
--- a/recipes-security/selinux/selinux_common.inc
+++ b/recipes-security/selinux/selinux_common.inc
@@ -23,8 +23,10 @@  do_install() {
 CVE_PRODUCT ?= "selinux_project:selinux"
 
 CVE_STATUS[CVE-2026-59676] = "not-applicable-config: The vulnerable seunshare utility is built by selinux-sandbox."
+CVE_STATUS[CVE-2026-59677] = "not-applicable-config: The vulnerable seunshare utility is built by selinux-sandbox."
 
 python __anonymous() {
     if d.getVar("BPN") == "selinux-sandbox":
         d.delVarFlag("CVE_STATUS", "CVE-2026-59676")
+        d.delVarFlag("CVE_STATUS", "CVE-2026-59677")
 }