diff mbox series

[yocto-patches,meta-selinux,wrynose,1/2] selinux-sandbox: fix CVE-2026-59676

Message ID 20261105070617.839020-1-dkelaiya@cisco.com
State New
Headers show
Series [yocto-patches,meta-selinux,wrynose,1/2] selinux-sandbox: fix CVE-2026-59676 | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 7:06 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

The 3.10 rm_rf() implementation follows symlinks after checking
directory entries, allowing a setuid seunshare caller to remove
root-owned files. Add O_NOFOLLOW to its recursive openat() call.

[1] https://github.com/SELinuxProject/selinux/commit/38f0a4d9a683f2cd2472d4502842df5d5b8255a8
[2] https://security.opensuse.org/2026/07/15/selinux-seunshare.html

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../selinux-sandbox/CVE-2026-59676.patch      | 33 +++++++++++++++++++
 .../selinux/selinux-sandbox_3.10.bb           |  1 +
 2 files changed, 34 insertions(+)
 create mode 100644 recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch
diff mbox series

Patch

diff --git a/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch b/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch
new file mode 100644
index 0000000..1356381
--- /dev/null
+++ b/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch
@@ -0,0 +1,33 @@ 
+From 38f0a4d9a683f2cd2472d4502842df5d5b8255a8 Mon Sep 17 00:00:00 2001
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+Date: Tue, 12 May 2026 14:34:02 -0400
+Subject: [PATCH] sandbox/seunshare: pass O_NOFOLLOW to openat()
+
+We do not want to follow symlinks here.
+
+CVE: CVE-2026-59676
+Upstream-Status: Backport [https://github.com/SELinuxProject/selinux/commit/38f0a4d9a683f2cd2472d4502842df5d5b8255a8]
+
+Acked-by: James Carter <jwcart2@gmail.com>
+Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+(cherry picked from commit 38f0a4d9a683f2cd2472d4502842df5d5b8255a8)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ sandbox/seunshare.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c
+index e89a9fec..a1900eaa 100644
+--- a/sandbox/seunshare.c
++++ b/sandbox/seunshare.c
+@@ -428,7 +428,7 @@ static bool rm_rf(int targetfd, const char *path) {
+ 	}
+ 
+ 	if (S_ISDIR(statbuf.st_mode)) {
+-		const int newfd = openat(targetfd, path, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
++		const int newfd = openat(targetfd, path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+ 		if (newfd < 0) {
+ 			perror("openat");
+ 			return false;
+-- 
+2.35.6
diff --git a/recipes-security/selinux/selinux-sandbox_3.10.bb b/recipes-security/selinux/selinux-sandbox_3.10.bb
index d29cd88..f8ffd36 100644
--- a/recipes-security/selinux/selinux-sandbox_3.10.bb
+++ b/recipes-security/selinux/selinux-sandbox_3.10.bb
@@ -10,6 +10,7 @@  LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=393a5ca445f6965873eca0259a17f833"
 require selinux_common.inc
 
 SRC_URI += "file://sandbox-de-bashify.patch;patchdir=.. \
+            file://CVE-2026-59676.patch;patchdir=.. \
            "
 
 S = "${UNPACKDIR}/${BP}/sandbox"