new file mode 100644
@@ -0,0 +1,114 @@
+From 572db2fae9157ae620160e0d7b2c3f8b75fe6c1a Mon Sep 17 00:00:00 2001
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+Date: Thu, 21 May 2026 11:54:44 -0400
+Subject: [PATCH] sandbox/seunshare: drop -k/--kill support
+
+Drop the -k/--kill support; it is fundamentally racy, redundant
+with killall -Z, and seemingly unused by sandbox itself.
+Provide an error message to the user telling them how to achieve
+the same effect via killall.
+
+CVE: CVE-2026-59677
+Upstream-Status: Backport [https://github.com/SELinuxProject/selinux/commit/572db2fae9157ae620160e0d7b2c3f8b75fe6c1a]
+
+Backport Changes:
+- Remove the older 3.10 killall() body, which predates the upstream
+ NULL-context checks, PID-table overflow checks, SELinux type
+ matching and conditional logging.
+
+Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+(cherry picked from commit 572db2fae9157ae620160e0d7b2c3f8b75fe6c1a)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ sandbox/seunshare.c | 69 +----------------------------------------------------
+ 1 file changed, 1 insertion(+), 68 deletions(-)
+
+diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c
+index 4e441b3c..02fdd599 100644
+--- a/sandbox/seunshare.c
++++ b/sandbox/seunshare.c
+@@ -656,73 +656,6 @@ good:
+ return tmpdir;
+ }
+
+-#define PROC_BASE "/proc"
+-
+-static int
+-killall (const char *execcon)
+-{
+- DIR *dir;
+- char *scon;
+- struct dirent *de;
+- pid_t *pid_table, pid, self;
+- int i;
+- int pids, max_pids;
+- int running = 0;
+- self = getpid();
+- if (!(dir = opendir(PROC_BASE))) {
+- return -1;
+- }
+- max_pids = 256;
+- pid_table = malloc(max_pids * sizeof (pid_t));
+- if (!pid_table) {
+- (void)closedir(dir);
+- return -1;
+- }
+- pids = 0;
+- context_t con;
+- con = context_new(execcon);
+- const char *mcs = context_range_get(con);
+- printf("mcs=%s\n", mcs);
+- while ((de = readdir (dir)) != NULL) {
+- if (!(pid = (pid_t)atoi(de->d_name)) || pid == self)
+- continue;
+-
+- if (pids == max_pids) {
+- pid_t *new_pid_table = realloc(pid_table, 2*pids*sizeof(pid_t));
+- if (!new_pid_table) {
+- free(pid_table);
+- (void)closedir(dir);
+- return -1;
+- }
+- pid_table = new_pid_table;
+- max_pids *= 2;
+- }
+- pid_table[pids++] = pid;
+- }
+-
+- (void)closedir(dir);
+-
+- for (i = 0; i < pids; i++) {
+- pid_t id = pid_table[i];
+-
+- if (getpidcon(id, &scon) == 0) {
+-
+- context_t pidcon = context_new(scon);
+- /* Attempt to kill remaining processes */
+- if (strcmp(context_range_get(pidcon), mcs) == 0)
+- kill(id, SIGKILL);
+-
+- context_free(pidcon);
+- freecon(scon);
+- }
+- running++;
+- }
+-
+- context_free(con);
+- free(pid_table);
+- return running;
+-}
+-
+ int main(int argc, char **argv) {
+ int status = -1;
+ const char *execcon = NULL;
+@@ -1076,7 +1009,7 @@ childerr:
+ kill(-child,SIGTERM);
+
+ if (execcon && kill_all)
+- killall(execcon);
++ fprintf(stderr, "-k/--kill no longer supported; run killall -Z %s\n", execcon);
+
+ if (tmpdir_r) cleanup_tmpdir(tmpdir_r, tmpdir_s, pwd, 1);
+
+--
+2.35.6
@@ -11,6 +11,7 @@ require selinux_common.inc
SRC_URI += "file://sandbox-de-bashify.patch;patchdir=.. \
file://CVE-2026-59676.patch;patchdir=.. \
+ file://CVE-2026-59677.patch;patchdir=.. \
"
S = "${UNPACKDIR}/${BP}/sandbox"