From patchwork Sat Jul 4 15:38:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10015 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4gsvtB4Nlvz3wmP for ; Sat, 04 Jul 2026 15:38:58 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gsvt90XTSz6sQ for ; Sat, 04 Jul 2026 15:38:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gsvt80wRlz33td for ; Sat, 04 Jul 2026 15:38:56 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gsvt53Dscz2xHd for ; Sat, 04 Jul 2026 15:38:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4gsvt431c1zMj; Sat, 04 Jul 2026 15:38:52 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1783179532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=OYz8RSl0dYGZCd+o+vKSl/PNQlGt9DvXNhQYz1LKK/U=; b=GDF/u9emo1pypQSi247fGoQH75nGZkVNk+St/a5D+PITFIgE+Fu2JaVdxWVXn6Pr9UyfnN QjPsBxAWPk0Ww2Cg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1783179532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=OYz8RSl0dYGZCd+o+vKSl/PNQlGt9DvXNhQYz1LKK/U=; b=frnDy/blptCYtSdHfVHV/0RC3F2WZmsPA08b7a/4mcJarl/lWuiEb8wAZcmvEqsjjE3lTK 8TUGmoJI1RiQCGSeSsI0ya+H5GvcI7vjXpILtqkQHdr1S4mx6/nNE2FFFBbOLXa20K+1e1 CpMWHFZFzgJU541i0V4ODSdqTc004XiXxkHwBEs21V14bUnZW7+3/f9mw+zk/kLvtSATYp IkwlUow1+p7sYi2YLbJpeeGX0N06lHdhWSaI7XLqM+tekillSlesZKJIjYNRk1aCUHizpN o+jI8jUaFQTsp/tgmn2w4Gj5rIXKzZnzao0+2/8ovkzqikEJmlMiUSBjrRID/Q== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 1/6] acl: Update to version 2.4.0 Date: Sat, 4 Jul 2026 17:38:44 +0200 Message-ID: <20260704153849.3586287-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.3.2 to 2.4.0 - Update of rootfile - 2 CVE fixes - Changelog 2.4.0 * Major security and robustness improvements: - Fix multiple security vulnerabilities: CVE-2026-54369 and CVE-2026-54370 - Harden setfacl, getfacl, and chacl against malicious input - Prevent NULL pointer dereferences and memory corruption - Fix setfacl --restore for pathnames beginning with whitespace - Prevent setfacl --restore --test from changing file permissions * New library functions: - Add acl_get_file_at(), acl_set_file_at(), acl_delete_def_file_at() for safer file operations using file descriptors and to control symlink following - acl_delete_def_file_at() allows removing default ACLs via file descriptor * API improvements and bug fixes: - Remove libacl dependency on libattr - Reject invalid numeric UIDs and GIDs in libacl - Fix memory wasting loop when user does not exist - Retry harder in acl_get_file/acl_get_fd operations - Improve errno handling in acl permission functions - Fix compiler warnings and sequence point issues * Build system and code organization: - Rename internal symbols with __acl_ prefix to avoid conflicts - Internalize walk_tree API and replace with hardened version - Mark local variables and functions static where appropriate - Remove unnecessary dependencies and dead code * Test suite improvements: - Fix test compatibility issues with getpwnam/getgrnam functions - Add comprehensive restore.run test for --restore functionality - Fix shell quoting errors in test scripts - Improve test lookup library accessibility * Documentation updates: - Clarify symlink following behavior in manual pages - Document new _at function variants - Clarify that on Linux, acl_perm_t is a bitset * Translation updates: - German translation update Signed-off-by: Adolf Belka --- config/rootfiles/common/acl | 6 +++++- lfs/acl | 6 +++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/acl b/config/rootfiles/common/acl index 505fd563c..9d449a60a 100644 --- a/config/rootfiles/common/acl +++ b/config/rootfiles/common/acl @@ -7,7 +7,7 @@ usr/bin/setfacl #usr/lib/libacl.la usr/lib/libacl.so usr/lib/libacl.so.1 -usr/lib/libacl.so.1.1.2302 +usr/lib/libacl.so.1.2.2400 #usr/lib/pkgconfig/libacl.pc #usr/share/doc/acl #usr/share/doc/acl/CHANGES @@ -37,6 +37,7 @@ usr/lib/libacl.so.1.1.2302 #usr/share/man/man3/acl_copy_int.3 #usr/share/man/man3/acl_create_entry.3 #usr/share/man/man3/acl_delete_def_file.3 +#usr/share/man/man3/acl_delete_def_file_at.3 #usr/share/man/man3/acl_delete_entry.3 #usr/share/man/man3/acl_delete_perm.3 #usr/share/man/man3/acl_dup.3 @@ -45,6 +46,7 @@ usr/lib/libacl.so.1.1.2302 #usr/share/man/man3/acl_error.3 #usr/share/man/man3/acl_extended_fd.3 #usr/share/man/man3/acl_extended_file.3 +#usr/share/man/man3/acl_extended_file_at.3 #usr/share/man/man3/acl_extended_file_nofollow.3 #usr/share/man/man3/acl_free.3 #usr/share/man/man3/acl_from_mode.3 @@ -52,6 +54,7 @@ usr/lib/libacl.so.1.1.2302 #usr/share/man/man3/acl_get_entry.3 #usr/share/man/man3/acl_get_fd.3 #usr/share/man/man3/acl_get_file.3 +#usr/share/man/man3/acl_get_file_at.3 #usr/share/man/man3/acl_get_perm.3 #usr/share/man/man3/acl_get_permset.3 #usr/share/man/man3/acl_get_qualifier.3 @@ -59,6 +62,7 @@ usr/lib/libacl.so.1.1.2302 #usr/share/man/man3/acl_init.3 #usr/share/man/man3/acl_set_fd.3 #usr/share/man/man3/acl_set_file.3 +#usr/share/man/man3/acl_set_file_at.3 #usr/share/man/man3/acl_set_permset.3 #usr/share/man/man3/acl_set_qualifier.3 #usr/share/man/man3/acl_set_tag_type.3 diff --git a/lfs/acl b/lfs/acl index b0008d4db..9b6f90b96 100644 --- a/lfs/acl +++ b/lfs/acl @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.3.2 +VER = 2.4.0 THISAPP = acl-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 9f2abfddcd403df2c716c05f02a1b52453613d10948dc58a65b9ef41b44e37db6de99fb22dcfc4f6f0fb5d0319c939da61bd4e0fba2cdb5643e8087ecd34eeac +$(DL_FILE)_BLAKE2 = c7e4cd5dc482b1e9e283ca0ec6740cd1051d23e9cb533917e3d58e8d2381af516bb74d340f195a5e38f9f76466406a7b2e8f31dff5362ae2cc09e9d1f47eeec7 install : $(TARGET)