From patchwork Thu Nov 5 07:06:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102985 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29047.1793862380803339449 for ; Wed, 04 Nov 2026 23:06:20 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=cLxmEluU; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2885; q=dns/txt; s=iport01; t=1793862380; x=1795071980; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=L5dIeE2Y5kG4SYT9kxXdIV7+bEOJCCWjfJt40C/VFgw=; b=cLxmEluUNwJq0DUsYvrtOtto/0pCucypbyqqIuyJS4IRXtrDJ0riat5f TSba/UUEuYEHcUqLERTQt1HlSlE8X23OWp9xCwceS8VATgrTymKUBho+G gKUJzIx2K6wZFJ5aexYdzEhmGkpGfM4D0Q4eWfKesDb52JUEw2EClh7b7 iHB4AM3dUOEyZXjO8v1b2yx3Y3ciSlc1IQ9EYtakLYVciaBJdRa2xbqmr hOyIP8cGveiNGi62yNoHhEo70WEWG4AzDyVdUsMAn+lug0iQ1IEpg2DgO nYHh8Ghqh/CwtLk18q99fQ5YE9nW1m97P/tisI4T97FAjB8/EXc/vxaCK w==; X-CSE-ConnectionGUID: PtqUzTuoT3KJy1Kzh8nhNA== X-CSE-MsgGUID: t5fyA2l3SVKVYGk/e8AoGg== X-IPAS-Result: A0BGAgBCKexq/4r/Ja1aglmCV3VgQ0kDlVxsi2iSPIF+DwEBAQ9EDQQBAYQ/Ro4fAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBNQFGLAMBAk8LIyGDAgGCOgM3AxEGvDOCLIEBhH7YTA2CWgELFAGBOIVAgn+FJF0YAYR9JxsbgXKEfoEFgRpCAQEBgSaBBoV5BIIigQyBWh6GIoZYAoFShnFIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPm4Hki+CfxKBDgEHIgKBIF0GKUulK6AgcQoog3iMJI8+hXwaM6pxC5h9jgqECpJHhGmBaDyBWXAVgyIJCUEZD44vCgscg0SFE8lIJjICCQMvAQEHAgcOAwuBaJAAgX4BAQ IronPort-Data: A9a23:ZozteKLJHvIL4VYpFE+RhJQlxSXFcZb7ZxGr2PjKsXjdYENS1jdUm mdLW26DM/zZa2eme9p+YIvioR9T75LQmtBiTVQd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmYoajh8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1WEFgLL7EF/dosIkNfr N8KKGALbjaq0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBVLAtQIvIROPB4towMDUY358VW62BI ZBENHw2N0Sojx5nYj/7DLoyn+qsj3juehVTqUmeouw85G27IAlZjeSxa4KOKoLbLSlTtlrFq HPvpWCiOS85Cu2wyn2IolurqeCayEsXX6pXTtVU7MVCkVqY2mtWEBQKXlu2utG9i1WiQJROL EcI/TI0qqo//1DtScPyNyBUu1aetRIaHt4VGOog5UTVk+zf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ22FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:ntPZbqk+1JcZgH3IknxlG+zl6gnpDfIa3DAbv31ZSRFFG/FwWf rAoB19726QtN9/YhAdcLy7VZVoIkmsl6Kdn7NwAV7KZmCP0wGVxepZg7cKrQeNJ8SHzJ8/6Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHNuQ8bpE0dKz2DrMpbnmBENjo= X-Talos-CUID: 9a23:zbYEgmCtZsbreIf6ExF77XMGJt0iTib+7maJAF24WWBpbpTAHA== X-Talos-MUID: 9a23:MeSFDAb6opDG2+BTq2LilRg4MJxT3YeQOW8O1phWks6rOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544303869" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 07:06:19 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id B8740180001F2; Thu, 5 Nov 2026 07:06:19 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 62360CC1611; Wed, 4 Nov 2026 23:06:19 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: yocto-patches@lists.yoctoproject.org Cc: Darsh Kelaiya Subject: [yocto-patches][meta-selinux][wrynose][PATCH 1/2] selinux-sandbox: fix CVE-2026-59676 Date: Wed, 4 Nov 2026 23:06:16 -0800 Message-Id: <20261105070617.839020-1-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 07:06:28 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto-patches/message/5241 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. The 3.10 rm_rf() implementation follows symlinks after checking directory entries, allowing a setuid seunshare caller to remove root-owned files. Add O_NOFOLLOW to its recursive openat() call. [1] https://github.com/SELinuxProject/selinux/commit/38f0a4d9a683f2cd2472d4502842df5d5b8255a8 [2] https://security.opensuse.org/2026/07/15/selinux-seunshare.html Signed-off-by: Darsh Kelaiya --- .../selinux-sandbox/CVE-2026-59676.patch | 33 +++++++++++++++++++ .../selinux/selinux-sandbox_3.10.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch diff --git a/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch b/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch new file mode 100644 index 0000000..1356381 --- /dev/null +++ b/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch @@ -0,0 +1,33 @@ +From 38f0a4d9a683f2cd2472d4502842df5d5b8255a8 Mon Sep 17 00:00:00 2001 +From: Stephen Smalley +Date: Tue, 12 May 2026 14:34:02 -0400 +Subject: [PATCH] sandbox/seunshare: pass O_NOFOLLOW to openat() + +We do not want to follow symlinks here. + +CVE: CVE-2026-59676 +Upstream-Status: Backport [https://github.com/SELinuxProject/selinux/commit/38f0a4d9a683f2cd2472d4502842df5d5b8255a8] + +Acked-by: James Carter +Signed-off-by: Stephen Smalley +(cherry picked from commit 38f0a4d9a683f2cd2472d4502842df5d5b8255a8) +Signed-off-by: Darsh Kelaiya +--- + sandbox/seunshare.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c +index e89a9fec..a1900eaa 100644 +--- a/sandbox/seunshare.c ++++ b/sandbox/seunshare.c +@@ -428,7 +428,7 @@ static bool rm_rf(int targetfd, const char *path) { + } + + if (S_ISDIR(statbuf.st_mode)) { +- const int newfd = openat(targetfd, path, O_RDONLY | O_DIRECTORY | O_CLOEXEC); ++ const int newfd = openat(targetfd, path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC); + if (newfd < 0) { + perror("openat"); + return false; +-- +2.35.6 diff --git a/recipes-security/selinux/selinux-sandbox_3.10.bb b/recipes-security/selinux/selinux-sandbox_3.10.bb index d29cd88..f8ffd36 100644 --- a/recipes-security/selinux/selinux-sandbox_3.10.bb +++ b/recipes-security/selinux/selinux-sandbox_3.10.bb @@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=393a5ca445f6965873eca0259a17f833" require selinux_common.inc SRC_URI += "file://sandbox-de-bashify.patch;patchdir=.. \ + file://CVE-2026-59676.patch;patchdir=.. \ " S = "${UNPACKDIR}/${BP}/sandbox" From patchwork Thu Nov 5 07:06:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 102984 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29046.1793862380721839371 for ; Wed, 04 Nov 2026 23:06:20 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=jleUO9g2; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4780; q=dns/txt; s=iport01; t=1793862380; x=1795071980; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=mZ0Kj4iLKYWqDyi7d6sM6I5X+7Ag1RMpHUsRqHWeq/Q=; b=jleUO9g2nrr3N74n5nfJ5iiLGo102D+8SveYsvPLqa+ZjRf5N7/Szq2f 6USCkfWujE76iwctnUEFsRmwSJfUcZ06Cm27RHhSRJicRww7L8pdi+j3j khnAD+QuwYjn2bwsXnYR0CY70xDTo8oNPY5gxQq9V+FnvyP0L1gcZPc7l 6blhLM6DBSEp7L2T2c+bwT9U+d2hOvZlB7VXDJ1W47P64/yrZFhXj0kyV zYMeyaitw1byWcoNJI8yNFeQvvT7ZHpn4RGX8DFw5v7fHXDZ/cYKZK+Xj ngBnyGU93eyWkwd4woLUq8iSZvWvv8YXa1MjU8M6MxztOgc5gqMRj/6Wc w==; X-CSE-ConnectionGUID: t4lWYXLCSpSRKcYlYY8ssA== X-CSE-MsgGUID: v948fA7zTcq5hPFL1MLIWA== X-IPAS-Result: A0BJAgC/Kexq/5T/Ja1aglmCV3VgQ0kDlkgDi2WSPIF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwFGEBwDAQIvIAsjCBmDAgGCOgM3AxEGvDiBeTOBAYR+2EwNgloBCxQBgTiFQIJ/hSRdGAGEfScbG4FygRWDaYEFgRpCAQEBiCUEgiKBDIFaHoYihlgCgVKGcUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ+bgeSL4J/Ei03FxMBEwgOAlaBBCMGKQUMCy+SdJI3oCBxCiiDeIwkjz6FfBozqnELmH2OCoQKkXpNhGmBaDyBWXAVgyIJCUEZD44uCwscg0SFE8lIJjICCQMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:vkvZEa8ghwkJ/Mk5y72eDrUD1X+TJUtcMsCJ2f8bNWPcYEJGY0x3z jAfWmCEbKnfYjP9edBzYY+/o0lV65HTy94wQVFqrHhEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpIs/jrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kqYYkny9ZTKlpWz sY7IwEJXyHTnPmflefTpulE3qzPLeHxN48Z/3UlxjbDALN/GNbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP00n1lQ/UPrSmM+khXT7ejxJoXqepLE85C7YywkZPL3FbYaOK4TaHZUJ9qqej nyXozT3K04ICNeGlDq93Fb1o8vuogquDer+E5X9rJaGmma712sYFBpTTVKnqvm0kWa6WslDM AoF/SEyqrAo806mRcW7WAe3yENopTYGUNZWVul/4waXx++NukCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:epfluKBNhnDyT0TlHemO55DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygck79 YCT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a585+oJjsaE52JKGxCe3+mLnE= X-Talos-CUID: 9a23:qeW2mmn6Ryf4GeNiO07XblfUfLPXOWGByEjhE2uTMn5Scp6eeFuhyfN/iOM7zg== X-Talos-MUID: 9a23:t1w6qQRbkhSeqenvRXTy1W0yOu438ZilER0Nqbsi4uygFBNZbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="543908084" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 07:06:19 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id BAA2F18000140; Thu, 5 Nov 2026 07:06:19 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 643A4CBF201; Wed, 4 Nov 2026 23:06:19 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: yocto-patches@lists.yoctoproject.org Cc: Darsh Kelaiya Subject: [yocto-patches][meta-selinux][wrynose][PATCH 2/2] selinux-sandbox: fix CVE-2026-59677 Date: Wed, 4 Nov 2026 23:06:17 -0800 Message-Id: <20261105070617.839020-2-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105070617.839020-1-dkelaiya@cisco.com> References: <20261105070617.839020-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 07:06:28 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto-patches/message/5240 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Remove the 3.10 killall() helper and retain the upstream diagnostic for --kill. seunshare no longer signals processes selected by a caller-provided SELinux context. The embedded patch documents the adaptation to the older helper implementation. [1] https://github.com/SELinuxProject/selinux/commit/572db2fae9157ae620160e0d7b2c3f8b75fe6c1a [2] https://security.opensuse.org/2026/07/15/selinux-seunshare.html Signed-off-by: Darsh Kelaiya --- .../selinux-sandbox/CVE-2026-59677.patch | 114 ++++++++++++++++++ .../selinux/selinux-sandbox_3.10.bb | 1 + 2 files changed, 115 insertions(+) create mode 100644 recipes-security/selinux/selinux-sandbox/CVE-2026-59677.patch diff --git a/recipes-security/selinux/selinux-sandbox/CVE-2026-59677.patch b/recipes-security/selinux/selinux-sandbox/CVE-2026-59677.patch new file mode 100644 index 0000000..b4ab16f --- /dev/null +++ b/recipes-security/selinux/selinux-sandbox/CVE-2026-59677.patch @@ -0,0 +1,114 @@ +From 572db2fae9157ae620160e0d7b2c3f8b75fe6c1a Mon Sep 17 00:00:00 2001 +From: Stephen Smalley +Date: Thu, 21 May 2026 11:54:44 -0400 +Subject: [PATCH] sandbox/seunshare: drop -k/--kill support + +Drop the -k/--kill support; it is fundamentally racy, redundant +with killall -Z, and seemingly unused by sandbox itself. +Provide an error message to the user telling them how to achieve +the same effect via killall. + +CVE: CVE-2026-59677 +Upstream-Status: Backport [https://github.com/SELinuxProject/selinux/commit/572db2fae9157ae620160e0d7b2c3f8b75fe6c1a] + +Backport Changes: +- Remove the older 3.10 killall() body, which predates the upstream + NULL-context checks, PID-table overflow checks, SELinux type + matching and conditional logging. + +Signed-off-by: Stephen Smalley +(cherry picked from commit 572db2fae9157ae620160e0d7b2c3f8b75fe6c1a) +Signed-off-by: Darsh Kelaiya +--- + sandbox/seunshare.c | 69 +---------------------------------------------------- + 1 file changed, 1 insertion(+), 68 deletions(-) + +diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c +index 4e441b3c..02fdd599 100644 +--- a/sandbox/seunshare.c ++++ b/sandbox/seunshare.c +@@ -656,73 +656,6 @@ good: + return tmpdir; + } + +-#define PROC_BASE "/proc" +- +-static int +-killall (const char *execcon) +-{ +- DIR *dir; +- char *scon; +- struct dirent *de; +- pid_t *pid_table, pid, self; +- int i; +- int pids, max_pids; +- int running = 0; +- self = getpid(); +- if (!(dir = opendir(PROC_BASE))) { +- return -1; +- } +- max_pids = 256; +- pid_table = malloc(max_pids * sizeof (pid_t)); +- if (!pid_table) { +- (void)closedir(dir); +- return -1; +- } +- pids = 0; +- context_t con; +- con = context_new(execcon); +- const char *mcs = context_range_get(con); +- printf("mcs=%s\n", mcs); +- while ((de = readdir (dir)) != NULL) { +- if (!(pid = (pid_t)atoi(de->d_name)) || pid == self) +- continue; +- +- if (pids == max_pids) { +- pid_t *new_pid_table = realloc(pid_table, 2*pids*sizeof(pid_t)); +- if (!new_pid_table) { +- free(pid_table); +- (void)closedir(dir); +- return -1; +- } +- pid_table = new_pid_table; +- max_pids *= 2; +- } +- pid_table[pids++] = pid; +- } +- +- (void)closedir(dir); +- +- for (i = 0; i < pids; i++) { +- pid_t id = pid_table[i]; +- +- if (getpidcon(id, &scon) == 0) { +- +- context_t pidcon = context_new(scon); +- /* Attempt to kill remaining processes */ +- if (strcmp(context_range_get(pidcon), mcs) == 0) +- kill(id, SIGKILL); +- +- context_free(pidcon); +- freecon(scon); +- } +- running++; +- } +- +- context_free(con); +- free(pid_table); +- return running; +-} +- + int main(int argc, char **argv) { + int status = -1; + const char *execcon = NULL; +@@ -1076,7 +1009,7 @@ childerr: + kill(-child,SIGTERM); + + if (execcon && kill_all) +- killall(execcon); ++ fprintf(stderr, "-k/--kill no longer supported; run killall -Z %s\n", execcon); + + if (tmpdir_r) cleanup_tmpdir(tmpdir_r, tmpdir_s, pwd, 1); + +-- +2.35.6 diff --git a/recipes-security/selinux/selinux-sandbox_3.10.bb b/recipes-security/selinux/selinux-sandbox_3.10.bb index f8ffd36..6227daf 100644 --- a/recipes-security/selinux/selinux-sandbox_3.10.bb +++ b/recipes-security/selinux/selinux-sandbox_3.10.bb @@ -11,6 +11,7 @@ require selinux_common.inc SRC_URI += "file://sandbox-de-bashify.patch;patchdir=.. \ file://CVE-2026-59676.patch;patchdir=.. \ + file://CVE-2026-59677.patch;patchdir=.. \ " S = "${UNPACKDIR}/${BP}/sandbox"