From patchwork Sat Jul 4 15:38:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10019 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4gsvtC1D2mz3wvc for ; Sat, 04 Jul 2026 15:38:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gsvt96r6dz6q6 for ; Sat, 04 Jul 2026 15:38:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gsvt86Gs2z34Qg for ; Sat, 04 Jul 2026 15:38:56 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gsvt60nXnz30Mt for ; Sat, 04 Jul 2026 15:38:54 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4gsvt5327wzZd; Sat, 04 Jul 2026 15:38:53 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1783179533; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5WIbLV/5EQN7PAqq0rZirptJ2HBYt55kcms56MT8Z+w=; b=tuQ8Qcb3bXGoF+BMUcD95nnjzfDVQ7Hll3rLaCaDpFAlgD3ZwnAuAqRjBqqYLqg+UsatpU jUPaHLPIuZU0EtBg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1783179533; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5WIbLV/5EQN7PAqq0rZirptJ2HBYt55kcms56MT8Z+w=; b=L2o/L3xs+NgcSvaLKHil7Yv1VGxsBbr6qxgU1wLGeaMHrw0owe5rvxoiPPz/6BomeRujK1 /C9ynTHInxufwGUtQlIMkxwS66vDbYyHc3eMYc1LJPwUefZz6/7jufEszRfo+A1nHYFP4W ul+kiu56hAsNmy2wekpVp2etWmVdBB0bxTQ3oBPrspPeM4olzQT8qUxQToH01a+PaPoLjI Y0cMvwEsagMbHiJthqOjl9v5o6RDsGTiNRBMyp4OTsYBAirkoZ/OroTvnlhQ6aZ3t8ihvE /iAq0UQTb9NczLwjrXRJhGlvfSHbgBcskMl0olbCTAGo3g8uHLDgRG6EDJM73Q== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 3/6] attr: Update to version 2.6.0 Date: Sat, 4 Jul 2026 17:38:46 +0200 Message-ID: <20260704153849.3586287-3-adolf.belka@ipfire.org> In-Reply-To: <20260704153849.3586287-1-adolf.belka@ipfire.org> References: <20260704153849.3586287-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.5.2 to 2.6.0 - Update rootfile - 1 CVE fix - Changelog 2.6.0 - Security fixes for CVE-2026-54371: - Fix symlink traversal privilege escalation vulnerability in getfattr and setfattr - Harden getfattr to properly handle symlinks with -h/--no-dereference option - Harden setfattr --restore with new -P/--physical option for safe restoring - Add warnings for potentially unsafe restore operations (can be disabled with the --disable-unsafe-restore-warnings configure option) - New extended attribute system call support: - Add wrappers for new xattrat() system calls (getxattrat, setxattrat, listxattrat, removexattrat) introduced in kernel 6.13 - Add backwards compatibility layer for older systems without xattrat() support - Add openat2() syscall wrapper support for enhanced security (kernel 5.6+) - Code improvements and fixes: - Add new walk_tree helper, remove old implementation - Fix multiple memory management issues in attr_copy_* functions - Fix race conditions in listxattr and lgetxattr operations - Fix buffer overflow and use-after-free bugs in setfattr --restore - Remove dead code and improve compiler warning handling - Add visibility attribute support for better library symbol management - Build system and compatibility: - Improve test suite for SELinux environments - Add License variable to pkg-config file - Fix various compiler warnings with -Wall, -Wextra, -Wmissing-prototypes - Add missing header includes and mark local functions static - Translation updates: - Update the German translation - Configuration updates: - Remove obsolete system.nfs4acl entry from xattr.conf - Add configure option --disable-unsafe-restore-warnings Signed-off-by: Adolf Belka --- config/rootfiles/common/attr | 3 +-- lfs/attr | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/attr b/config/rootfiles/common/attr index 73f8e9500..4307e1dd0 100644 --- a/config/rootfiles/common/attr +++ b/config/rootfiles/common/attr @@ -1,7 +1,6 @@ usr/bin/attr usr/bin/getfattr usr/bin/setfattr -#usr/etc #usr/etc/xattr.conf #usr/include/attr #usr/include/attr/attributes.h @@ -11,7 +10,7 @@ usr/bin/setfattr #usr/lib/libattr.la #usr/lib/libattr.so usr/lib/libattr.so.1 -usr/lib/libattr.so.1.1.2502 +usr/lib/libattr.so.1.1.2600 #usr/lib/pkgconfig/libattr.pc #usr/share/doc/attr #usr/share/doc/attr/CHANGES diff --git a/lfs/attr b/lfs/attr index 8a85b109e..2c005d7b3 100644 --- a/lfs/attr +++ b/lfs/attr @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.5.2 +VER = 2.6.0 THISAPP = attr-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = cf26348c3a96622e4f62493ac7655e14b6580d36a5784ef4c3750178856eceabd33192fd58516be21c8aa1ad41d56c024ad440ef4bc922bed8f7a4984ea16c63 +$(DL_FILE)_BLAKE2 = 10e36188a11344e1cc1dd7d0bcc8724a62bfc945799755cff6a54fff6c6d7e306596628fca4f882e84a156cf2ea790a1a8411599819de4e60b0a21dc3b400d64 install : $(TARGET)