From 90a2a27796f9ca7f8b6fd96cc70c29cc1e60d2dd Mon Sep 17 00:00:00 2001 From: wenyuzifang Date: Fri, 15 Aug 2025 03:36:53 +0800 Subject: [PATCH] Update code from upstream --- ...-allow-suid-and-dev-set-on-fs-resize.patch | 26 +++++++++++++++++++ libblockdev.spec | 8 ++++-- 2 files changed, 32 insertions(+), 2 deletions(-) create mode 100644 0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch diff --git a/0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch b/0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch new file mode 100644 index 0000000..d2fd952 --- /dev/null +++ b/0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch @@ -0,0 +1,26 @@ +From 9d1465a9093dd9929ab4c57f6c83df362699820d Mon Sep 17 00:00:00 2001 +From: Thomas Blume +Date: Fri, 16 May 2025 14:27:10 +0200 +Subject: [PATCH] Don't allow suid and dev set on fs resize + +Fixes: CVE-2025-6019 +--- + src/plugins/fs/generic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/plugins/fs/generic.c b/src/plugins/fs/generic.c +index 2b2180aa..60f7d75e 100644 +--- a/src/plugins/fs/generic.c ++++ b/src/plugins/fs/generic.c +@@ -661,7 +661,7 @@ static gchar* fs_mount (const gchar *device, gchar *fstype, gboolean read_only, + "Failed to create temporary directory for mounting '%s'.", device); + return NULL; + } +- ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "ro" : NULL, NULL, &l_error); ++ ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "nosuid,nodev,ro" : "nosuid,nodev", NULL, &l_error); + if (!ret) { + g_propagate_prefixed_error (error, l_error, "Failed to mount '%s': ", device); + g_rmdir (mountpoint); +-- +2.49.0 + diff --git a/libblockdev.spec b/libblockdev.spec index 5b43adc..2ab58b6 100644 --- a/libblockdev.spec +++ b/libblockdev.spec @@ -1,4 +1,4 @@ -%define anolis_release 2 +%define anolis_release 3 %define with_python3 1 @@ -85,7 +85,7 @@ %define configure_opts %{?python3_copts} %{?lvm_dbus_copts} %{?btrfs_copts} %{?crypto_copts} %{?dm_copts} %{?loop_copts} %{?lvm_copts} %{?lvm_dbus_copts} %{?mdraid_copts} %{?mpath_copts} %{?swap_copts} %{?part_copts} %{?fs_copts} %{?nvdimm_copts} %{?tools_copts} %{?gi_copts} %{?nvme_copts} %{?smart_copts} %{?smartmontools_copts} Name: libblockdev -Version: 3.2.0 +Version: 3.2.0 Release: %{anolis_release}%{?dist} Summary: A library for low-level manipulation with block devices License: LGPL-2.1-or-later @@ -93,6 +93,7 @@ URL: https://github.com/storaged-project/libblockdev Source0: https://github.com/storaged-project/libblockdev/releases/download/%{version}/%{name}-%{version}.tar.gz Patch0: 0001-nvme_Avoid_element-type_g-i_annotations.patch Patch1: 0002-dont_allow_suid_and_dev_set_on_fs_resize.patch +Patch2: 0003-Don-t-allow-suid-and-dev-set-on-fs-resize.patch BuildRequires: make BuildRequires: glib2-devel @@ -530,6 +531,7 @@ Requires: %{name} Requires: %{name}-lvm BuildRequires: libbytesize-devel BuildRequires: parted-devel +BuildRequires: 2.3.0 %if %{with_lvm_dbus} == 1 Recommends: %{name}-lvm-dbus %endif @@ -932,6 +934,8 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm} %doc README.md %changelog +* Fri Aug 15 2025 wenyuzifang - 3.2.0-3 +- Apply this patch to prevent privilege escalation and unauthorized device access during filesystem resize. * Fri Jun 20 2025 Shile Zhang - 3.2.0-2 - Fix CVE-2025-6019 -- Gitee