Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package util-linux for openSUSE:Factory checked in at 2026-07-29 18:58:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/util-linux (Old) and /work/SRC/openSUSE:Factory/.util-linux.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "util-linux" Wed Jul 29 18:58:16 2026 rev:311 rq:1367885 version:2.42.2 Changes: -------- --- /work/SRC/openSUSE:Factory/util-linux/util-linux.changes 2026-05-31 18:28:22.508319056 +0200 +++ /work/SRC/openSUSE:Factory/.util-linux.new.2004/util-linux.changes 2026-07-29 18:58:26.503974217 +0200 @@ -1,0 +2,79 @@ +Mon Jul 13 11:51:37 UTC 2026 - Stanislav Brabec <[email protected]> + +- BREAKING CHANGE: + Paths must always be canonicalized for unprivileged users to + ensure safe target resolution. X-mount.nocanonicalize is ignored + for them. +- INCOMAPTIBLE CHANGE (for linux < 6.15): + X-mount.subdir: The safe detached subdirectory is no more + supported for unprivileged users for safety reasons. +- INCOMAPTIBLE CHANGE: + LIBMOUNT_FORCE_MOUNT2 is ignored for unprivileged users for safety + reasons. +- Update to version 2.42.2: + * Security fixes: + * CVE-2026-53613 - mount(8) TOCTOU race on target path. The + SUID mount does not pin the mount target directory, allowing + a race between path resolution and the actual mount syscall. + A local attacker can swap an ancestor directory component + between these steps to redirect a mount to an arbitrary + location. (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g) + * CVE-2026-53612 - mount(8) TOCTOU race on post-mount + owner/mode change. The X-mount.owner, X-mount.group, and + X-mount.mode options use path-based lchown()/chmod() after + mounting. An attacker can swap the target between mount and + the ownership/mode change to gain control of arbitrary + files. (bsc#1268886, CVE-2026-53612, GHSA-g8wm-75wr-g2vh) + * CVE-2026-53614 - mount(8) SUID bypass via + LIBMOUNT_FORCE_MOUNT2. The environment variable + LIBMOUNT_FORCE_MOUNT2 is not filtered via safe_getenv() in + SUID context. A local attacker can force the legacy + mount(2) code path, which uses a two-step bind+remount or + propagation sequence with a window where security flags + (nosuid, noexec,...) are not yet applied. (bsc#1268886, + CVE-2026-53614, GHSA-67r7-8m5w-22wx) + * CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop + device (follow-up). The v2.42.1 fix used O_NOFOLLOW which + only rejects symlinks at the last path component. This + update uses openat2(RESOLVE_NO_SYMLINKS) to reject symlinks + at any component of the backing file path. (bsc#1268886#c2, + bsc#1261606) + * libblkid: use-after-free in nested partition probing. The + partitions list stores partitions in a contiguous array + grown by reallocarray(). When the array is reallocated, all + existing blkid_partition pointers become dangling. + (bsc#1269583, bsc#1268886#c2, CVE-2026-13595) + * fdisk-list: + * fix memory leak when partition returns empty string + * fix memory leak in partition listing + * fsck.minix: bound namelen guessed in get_dirsize + * hexdump: fix buffer overflow in color_cond() + * libblkid: fix use-after-free in nested partition probing + * libfdisk: fix use of on-disk sizeof_partition_entry in GPT + * libmount: + * add mount ID verification and man page TOCTOU note + * use fd_target in hook_idmap for move_mount() + * restrict X-mount.subdir for non-root to Linux >= 6.15 + * use fd-based fchownat/chmod in hook_owner + * ignore X-mount.nocanonicalize for restricted users + * add fd_target to context for TOCTOU prevention + * fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy mount + path + * detect fanotify queue overflow in monitor + * fix subvolid buffer overflow in get_btrfs_fs_root + * loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file + * lscpu: free cputype ISA string + * lslogins: bound lastlog2 tty/host copy to destination size + * nsenter: Fix invalid fd check in enter_namespaces + * readprofile: replace popen() with fork/exec for .gz map files +- Refreshed + Add-documentation-on-blacklisted-modules-to-mount-8-.patch. +- If needed, display post installation message. + +------------------------------------------------------------------- +Mon Jul 13 11:21:30 UTC 2026 - Stanislav Brabec <[email protected]> + +- Ignore pam-config error that prevents update failure if common* + pam configuration is not symlink to common-*-pc (bsc#1270219). + +------------------------------------------------------------------- Old: ---- util-linux-2.42.1.tar.sign util-linux-2.42.1.tar.xz New: ---- util-linux-2.42.2.tar.sign util-linux-2.42.2.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ util-linux.spec ++++++ --- /var/tmp/diff_new_pack.CaUa3A/_old 2026-07-29 18:58:27.540009951 +0200 +++ /var/tmp/diff_new_pack.CaUa3A/_new 2026-07-29 18:58:27.544010089 +0200 @@ -85,7 +85,7 @@ %endif # ulbuild == python -Version: 2.42.1 +Version: 2.42.2 Release: 0 License: GPL-2.0-or-later #Git-Clone: https://github.com/util-linux/util-linux @@ -777,6 +777,8 @@ export TS_OPT_lslocks_lslocks_known_fail=yes # FIXME: script/options sometimes fails on aarch64, arm7l and s390x export TS_OPT_script_options_known_fail=yes +# New failure in 2.42.2. +export TS_OPT_lsfd_column_mntid_nonroot_known_fail="yes" %ifarch ppc64le # util-linux-2.42.1 fails (small swap) export TS_OPT_mkswap_mkswap_known_fail=yes @@ -861,6 +863,45 @@ %endif %dnl # defined no_config +DISPLAY_MESSAGE=false +if grep -q -e '\([[:space:]]\|,\)user.*X-mount.nocanonicalize' /etc/fstab ; then + DISPLAY_MESSAGE=true +fi +if grep -q -e '\([[:space:]]\|,\)X-mount.nocanonicalize.*user' /etc/fstab ; then + DISPLAY_MESSAGE=true +fi +RAW_KERNEL_VERSION=$(uname -r) +KERNEL_VERSION=${RAW_KERNEL_VERSION%%-*} +OLD_IFS=$IFS +IFS=. +set -- $KERNEL_VERSION +IFS=$OLD_IFS +MAJOR=${1:-0} +MINOR=${2:-0} +if [ "$MAJOR" -le 6 ] || { [ "$MAJOR" -eq 6 ] && [ "$MINOR" -le 15 ]; }; then + if grep -q -e '\([[:space:]]\|,\)user.*X-mount.subdir' /etc/fstab ; then + DISPLAY_MESSAGE=true + fi + if grep -q -e '\([[:space:]]\|,\)X-mount.subdir.*user' /etc/fstab ; then + DISPLAY_MESSAGE=true + fi +fi +if $DISPLAY_MESSAGE ; then + cat >/var/adm/update-messages/%name-%version-%release-1 <<EOF +New /etc/fstab limitations for mount(8)! + +For safety reasons, following mount options are now ignored for user mounts: + +X-mount.nocanonicalize: + + Paths must always be canonicalized for unprivileged users. + +X-mount.subdir (for linux < 6.15): + The safe detached subdirectory is no more supported. + +EOF +fi + %post -n libblkid1 -p /sbin/ldconfig %postun -n libblkid1 -p /sbin/ldconfig @@ -917,14 +958,14 @@ %post -n lastlog2 %tmpfiles_create lastlog2.conf %service_add_post lastlog2-import.service -%{_sbindir}/pam-config -a --lastlog2 --lastlog2-silent_if=gdm,gdm-password,lxdm,lightdm,mdm,sddm +%{_sbindir}/pam-config -a --lastlog2 --lastlog2-silent_if=gdm,gdm-password,lxdm,lightdm,mdm,sddm || : %preun -n lastlog2 %service_del_preun lastlog2-import.service %postun -n lastlog2 if [ "$1" -eq 0 ]; then - %{_sbindir}/pam-config -d --lastlog2 + %{_sbindir}/pam-config -d --lastlog2 || : fi %service_del_postun lastlog2-import.service @@ -1420,6 +1461,8 @@ %exclude %{_mandir}/man1/lslogins.1.gz %exclude %{_mandir}/man8/uuidd.8.gz + +%ghost /var/adm/update-messages/%name-%version-%release-1 %endif # ulsubset == core, ulbuild == base ++++++ Add-documentation-on-blacklisted-modules-to-mount-8-.patch ++++++ --- /var/tmp/diff_new_pack.CaUa3A/_old 2026-07-29 18:58:27.584011469 +0200 +++ /var/tmp/diff_new_pack.CaUa3A/_new 2026-07-29 18:58:27.588011606 +0200 @@ -8,12 +8,14 @@ sys-utils/mount.8 | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) ---- a/sys-utils/mount.8 -+++ b/sys-utils/mount.8 -@@ -205,6 +205,32 @@ Since util\-linux 2.35, \fBmount\fP does - For more details, see \fBfstab\fP(5). Only the user that mounted a filesystem can unmount it again. If any user should be able to unmount it, then use \fBusers\fP instead of \fBuser\fP in the \fIfstab\fP line. The \fBowner\fP option is similar to the \fBuser\fP option, with the restriction that the user must be the owner of the special file. This may be useful e.g. for \fI/dev/fd\fP if a login script makes the console user owner of this device. The \fBgroup\fP option is similar, with the restriction that the user must be a member of the group of the special file. - .sp - The \fBuser\fP mount option is accepted if no username is specified. If used in the format \fBuser=someone\fP, the option is silently ignored and visible only for external mount helpers (/sbin/mount.<type>) for compatibility with some network filesystems. +Index: util-linux-2.42.2/sys-utils/mount.8 +=================================================================== +--- util-linux-2.42.2.orig/sys-utils/mount.8 ++++ util-linux-2.42.2/sys-utils/mount.8 +@@ -219,6 +219,32 @@ The \fBuser\fP mount option is accepted + When using the legacy \fBmount\fP(2) syscall (on older kernels without the new mount API), the mount target path is resolved by the kernel at syscall time. This means there is an inherent time\-of\-check\-to\-time\-of\-use (TOCTOU) window between the permission verification and the actual mount operation. If an ancestor directory of the mount target is writable by the unprivileged user, a path component could be swapped to redirect the mount to an unintended location. The new mount API (available since Linux 5.2) eliminates this issue by using file\-descriptor\-based target resolution. Administrators should ensure that mount target paths for \fBuser\fP mounts do not traverse directories writable by unprivileged users. + .sp .5v + .RE +.SS Blacklisted file systems +In the Linux kernel, file system types are implemented as kernel +modules. While many of these file systems are well maintained, @@ -43,7 +45,7 @@ .SS "Bind mount operation" .sp Remount part of the file hierarchy somewhere else. The call is: -@@ -2571,4 +2597,4 @@ For bug reports, use the issue tracker a +@@ -2772,4 +2798,4 @@ For bug reports, use the \c .SH "AVAILABILITY" .sp The \fBmount\fP command is part of the util\-linux package which can be downloaded from \c ++++++ util-linux-2.42.1.tar.xz -> util-linux-2.42.2.tar.xz ++++++ /work/SRC/openSUSE:Factory/util-linux/util-linux-2.42.1.tar.xz /work/SRC/openSUSE:Factory/.util-linux.new.2004/util-linux-2.42.2.tar.xz differ: char 15, line 1
