summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/util-linux
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-core/util-linux')
-rw-r--r--meta/recipes-core/util-linux/util-linux.inc7
-rw-r--r--meta/recipes-core/util-linux/util-linux/CVE-2021-37600.patch33
-rw-r--r--meta/recipes-core/util-linux/util-linux/CVE-2021-3995.patch139
-rw-r--r--meta/recipes-core/util-linux/util-linux/CVE-2021-3996.patch226
-rw-r--r--meta/recipes-core/util-linux/util-linux/CVE-2022-0563.patch161
-rw-r--r--meta/recipes-core/util-linux/util-linux/include-strutils-cleanup-strto-functions.patch270
-rw-r--r--meta/recipes-core/util-linux/util-linux_2.35.1.bb5
7 files changed, 838 insertions, 3 deletions
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 0e85603d9a..7b780352be 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -59,12 +59,13 @@ python util_linux_binpackages () {
59 continue 59 continue
60 60
61 pkg = os.path.basename(os.readlink(file)) 61 pkg = os.path.basename(os.readlink(file))
62 extras[pkg] = extras.get(pkg, '') + ' ' + file.replace(dvar, '', 1) 62 extras.setdefault(pkg, [])
63 extras[pkg].append(file.replace(dvar, '', 1))
63 64
64 pn = d.getVar('PN') 65 pn = d.getVar('PN')
65 for pkg, links in extras.items(): 66 for pkg, links in extras.items():
66 of = d.getVar('FILES_' + pn + '-' + pkg) 67 of = d.getVar('FILES_' + pn + '-' + pkg)
67 links = of + links 68 links = of + " " + " ".join(sorted(links))
68 d.setVar('FILES_' + pn + '-' + pkg, links) 69 d.setVar('FILES_' + pn + '-' + pkg, links)
69} 70}
70 71
@@ -94,7 +95,7 @@ EXTRA_OECONF = "\
94 \ 95 \
95 --disable-bfs --disable-chfn-chsh --disable-login \ 96 --disable-bfs --disable-chfn-chsh --disable-login \
96 --disable-makeinstall-chown --disable-minix --disable-newgrp \ 97 --disable-makeinstall-chown --disable-minix --disable-newgrp \
97 --disable-use-tty-group --disable-vipw \ 98 --disable-use-tty-group --disable-vipw --disable-raw \
98 \ 99 \
99 --without-udev \ 100 --without-udev \
100 \ 101 \
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2021-37600.patch b/meta/recipes-core/util-linux/util-linux/CVE-2021-37600.patch
new file mode 100644
index 0000000000..2b306c435b
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2021-37600.patch
@@ -0,0 +1,33 @@
1From 1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c Mon Sep 17 00:00:00 2001
2From: Karel Zak <kzak@redhat.com>
3Date: Tue, 27 Jul 2021 11:58:31 +0200
4Subject: [PATCH] sys-utils/ipcutils: be careful when call calloc() for uint64
5 nmembs
6
7Fix: https://github.com/karelzak/util-linux/issues/1395
8Signed-off-by: Karel Zak <kzak@redhat.com>
9
10CVE: CVE-2021-37600
11Upstream-Status: Backport [1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c]
12
13Signed-off-by: Dragos-Marian Panait <dragos.panait@windriver.com>
14---
15 sys-utils/ipcutils.c | 2 +-
16 1 file changed, 1 insertion(+), 1 deletion(-)
17
18diff --git a/sys-utils/ipcutils.c b/sys-utils/ipcutils.c
19index e784c4dcb..18868cfd3 100644
20--- a/sys-utils/ipcutils.c
21+++ b/sys-utils/ipcutils.c
22@@ -218,7 +218,7 @@ static void get_sem_elements(struct sem_data *p)
23 {
24 size_t i;
25
26- if (!p || !p->sem_nsems || p->sem_perm.id < 0)
27+ if (!p || !p->sem_nsems || p->sem_nsems > SIZE_MAX || p->sem_perm.id < 0)
28 return;
29
30 p->elements = xcalloc(p->sem_nsems, sizeof(struct sem_elem));
31--
322.25.1
33
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2021-3995.patch b/meta/recipes-core/util-linux/util-linux/CVE-2021-3995.patch
new file mode 100644
index 0000000000..1dcb66ad1d
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2021-3995.patch
@@ -0,0 +1,139 @@
1From f3db9bd609494099f0c1b95231c5dfe383346929 Mon Sep 17 00:00:00 2001
2From: Karel Zak <kzak@redhat.com>
3Date: Wed, 24 Nov 2021 13:53:25 +0100
4Subject: [PATCH] libmount: fix UID check for FUSE umount [CVE-2021-3995]
5
6Improper UID check allows an unprivileged user to unmount FUSE
7filesystems of users with similar UID.
8
9Signed-off-by: Karel Zak <kzak@redhat.com>
10
11CVE: CVE-2021-3995
12Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/f3db9bd609494099f0c1b95231c5dfe383346929]
13Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
14
15---
16 include/strutils.h | 2 +-
17 libmount/src/context_umount.c | 14 +++---------
18 libmount/src/mountP.h | 1 +
19 libmount/src/optstr.c | 42 +++++++++++++++++++++++++++++++++++
20 4 files changed, 47 insertions(+), 12 deletions(-)
21
22diff --git a/include/strutils.h b/include/strutils.h
23index 6e95707ea9..a84d29594d 100644
24--- a/include/strutils.h
25+++ b/include/strutils.h
26@@ -91,8 +91,8 @@ static inline char *mem2strcpy(char *dest, const void *src, size_t n, size_t nma
27 if (n + 1 > nmax)
28 n = nmax - 1;
29
30+ memset(dest, '\0', nmax);
31 memcpy(dest, src, n);
32- dest[nmax-1] = '\0';
33 return dest;
34 }
35
36diff --git a/libmount/src/context_umount.c b/libmount/src/context_umount.c
37index 173637a15a..8773c65ffa 100644
38--- a/libmount/src/context_umount.c
39+++ b/libmount/src/context_umount.c
40@@ -393,10 +393,7 @@ static int is_fuse_usermount(struct libmnt_context *cxt, int *errsv)
41 struct libmnt_ns *ns_old;
42 const char *type = mnt_fs_get_fstype(cxt->fs);
43 const char *optstr;
44- char *user_id = NULL;
45- size_t sz;
46- uid_t uid;
47- char uidstr[sizeof(stringify_value(ULONG_MAX))];
48+ uid_t uid, entry_uid;
49
50 *errsv = 0;
51
52@@ -413,11 +410,7 @@ static int is_fuse_usermount(struct libmnt_context *cxt, int *errsv)
53 optstr = mnt_fs_get_fs_options(cxt->fs);
54 if (!optstr)
55 return 0;
56-
57- if (mnt_optstr_get_option(optstr, "user_id", &user_id, &sz) != 0)
58- return 0;
59-
60- if (sz == 0 || user_id == NULL)
61+ if (mnt_optstr_get_uid(optstr, "user_id", &entry_uid) != 0)
62 return 0;
63
64 /* get current user */
65@@ -434,8 +427,7 @@ static int is_fuse_usermount(struct libmnt_context *cxt, int *errsv)
66 return 0;
67 }
68
69- snprintf(uidstr, sizeof(uidstr), "%lu", (unsigned long) uid);
70- return strncmp(user_id, uidstr, sz) == 0;
71+ return uid == entry_uid;
72 }
73
74 /*
75diff --git a/libmount/src/mountP.h b/libmount/src/mountP.h
76index d43a835418..22442ec55e 100644
77--- a/libmount/src/mountP.h
78+++ b/libmount/src/mountP.h
79@@ -400,6 +400,7 @@ extern const struct libmnt_optmap *mnt_optmap_get_entry(
80 const struct libmnt_optmap **mapent);
81
82 /* optstr.c */
83+extern int mnt_optstr_get_uid(const char *optstr, const char *name, uid_t *uid);
84 extern int mnt_optstr_remove_option_at(char **optstr, char *begin, char *end);
85 extern int mnt_optstr_fix_gid(char **optstr, char *value, size_t valsz, char **next);
86 extern int mnt_optstr_fix_uid(char **optstr, char *value, size_t valsz, char **next);
87diff --git a/libmount/src/optstr.c b/libmount/src/optstr.c
88index 921b9318e7..16800f571c 100644
89--- a/libmount/src/optstr.c
90+++ b/libmount/src/optstr.c
91@@ -1090,6 +1090,48 @@ int mnt_optstr_fix_user(char **optstr)
92 return rc;
93 }
94
95+/*
96+ * Converts value from @optstr addressed by @name to uid.
97+ *
98+ * Returns: 0 on success, 1 if not found, <0 on error
99+ */
100+int mnt_optstr_get_uid(const char *optstr, const char *name, uid_t *uid)
101+{
102+ char *value = NULL;
103+ size_t valsz = 0;
104+ char buf[sizeof(stringify_value(UINT64_MAX))];
105+ int rc;
106+ uint64_t num;
107+
108+ assert(optstr);
109+ assert(name);
110+ assert(uid);
111+
112+ rc = mnt_optstr_get_option(optstr, name, &value, &valsz);
113+ if (rc != 0)
114+ goto fail;
115+
116+ if (valsz > sizeof(buf) - 1) {
117+ rc = -ERANGE;
118+ goto fail;
119+ }
120+ mem2strcpy(buf, value, valsz, sizeof(buf));
121+
122+ rc = ul_strtou64(buf, &num, 10);
123+ if (rc != 0)
124+ goto fail;
125+ if (num > ULONG_MAX || (uid_t) num != num) {
126+ rc = -ERANGE;
127+ goto fail;
128+ }
129+ *uid = (uid_t) num;
130+
131+ return 0;
132+fail:
133+ DBG(UTILS, ul_debug("failed to convert '%s'= to number [rc=%d]", name, rc));
134+ return rc;
135+}
136+
137 /**
138 * mnt_match_options:
139 * @optstr: options string
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2021-3996.patch b/meta/recipes-core/util-linux/util-linux/CVE-2021-3996.patch
new file mode 100644
index 0000000000..1610b5a0fe
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2021-3996.patch
@@ -0,0 +1,226 @@
1From 018a10907fa9885093f6d87401556932c2d8bd2b Mon Sep 17 00:00:00 2001
2From: Karel Zak <kzak@redhat.com>
3Date: Tue, 4 Jan 2022 10:54:20 +0100
4Subject: [PATCH] libmount: fix (deleted) suffix issue [CVE-2021-3996]
5
6This issue is related to parsing the /proc/self/mountinfo file allows an
7unprivileged user to unmount other user's filesystems that are either
8world-writable themselves or mounted in a world-writable directory.
9
10The support for "(deleted)" is no more necessary as the Linux kernel does
11not use it in /proc/self/mountinfo and /proc/self/mount files anymore.
12
13Signed-off-by: Karel Zak <kzak@redhat.com>
14
15CVE: CVE-2021-3996
16Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/018a10907fa9885093f6d87401556932c2d8bd2b]
17Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
18
19---
20 libmount/src/tab_parse.c | 5 -----
21 tests/expected/findmnt/filter-options | 1 -
22 tests/expected/findmnt/filter-options-nameval-neg | 3 +--
23 tests/expected/findmnt/filter-types-neg | 1 -
24 tests/expected/findmnt/outputs-default | 3 +--
25 tests/expected/findmnt/outputs-force-tree | 3 +--
26 tests/expected/findmnt/outputs-kernel | 3 +--
27 tests/expected/libmount/tabdiff-mount | 1 -
28 tests/expected/libmount/tabdiff-move | 1 -
29 tests/expected/libmount/tabdiff-remount | 1 -
30 tests/expected/libmount/tabdiff-umount | 1 -
31 tests/expected/libmount/tabfiles-parse-mountinfo | 11 -----------
32 tests/expected/libmount/tabfiles-py-parse-mountinfo | 11 -----------
33 tests/ts/findmnt/files/mountinfo | 1 -
34 tests/ts/findmnt/files/mountinfo-nonroot | 1 -
35 tests/ts/libmount/files/mountinfo | 1 -
36 16 files changed, 4 insertions(+), 44 deletions(-)
37
38diff --git a/libmount/src/tab_parse.c b/libmount/src/tab_parse.c
39index 917779ab6d..4407f9c9c7 100644
40--- a/libmount/src/tab_parse.c
41+++ b/libmount/src/tab_parse.c
42@@ -225,11 +225,6 @@ static int mnt_parse_mountinfo_line(struct libmnt_fs *fs, const char *s)
43 goto fail;
44 }
45
46- /* remove "\040(deleted)" suffix */
47- p = (char *) endswith(fs->target, PATH_DELETED_SUFFIX);
48- if (p && *p)
49- *p = '\0';
50-
51 s = skip_separator(s);
52
53 /* (6) vfs options (fs-independent) */
54diff --git a/tests/expected/findmnt/filter-options b/tests/expected/findmnt/filter-options
55index 2606bce76b..97b0ead0ad 100644
56--- a/tests/expected/findmnt/filter-options
57+++ b/tests/expected/findmnt/filter-options
58@@ -28,5 +28,4 @@ TARGET SOURCE FSTYPE OPTIONS
59 /home/kzak/.gvfs gvfs-fuse-daemon fuse.gvfs-fuse-daemon rw,nosuid,nodev,relatime,user_id=500,group_id=500
60 /var/lib/nfs/rpc_pipefs sunrpc rpc_pipefs rw,relatime
61 /mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
62-/mnt/foo /fooooo bar rw,relatime
63 rc=0
64diff --git a/tests/expected/findmnt/filter-options-nameval-neg b/tests/expected/findmnt/filter-options-nameval-neg
65index 5471d65af1..f0467ef755 100644
66--- a/tests/expected/findmnt/filter-options-nameval-neg
67+++ b/tests/expected/findmnt/filter-options-nameval-neg
68@@ -29,6 +29,5 @@ TARGET SOURCE FSTYPE OPTIO
69 |-/home/kzak /dev/mapper/kzak-home ext4 rw,noatime,barrier=1,data=ordered
70 | `-/home/kzak/.gvfs gvfs-fuse-daemon fuse.gvfs-fuse-daemon rw,nosuid,nodev,relatime,user_id=500,group_id=500
71 |-/var/lib/nfs/rpc_pipefs sunrpc rpc_pipefs rw,relatime
72-|-/mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
73-`-/mnt/foo /fooooo bar rw,relatime
74+`-/mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
75 rc=0
76diff --git a/tests/expected/findmnt/filter-types-neg b/tests/expected/findmnt/filter-types-neg
77index 2606bce76b..97b0ead0ad 100644
78--- a/tests/expected/findmnt/filter-types-neg
79+++ b/tests/expected/findmnt/filter-types-neg
80@@ -28,5 +28,4 @@ TARGET SOURCE FSTYPE OPTIONS
81 /home/kzak/.gvfs gvfs-fuse-daemon fuse.gvfs-fuse-daemon rw,nosuid,nodev,relatime,user_id=500,group_id=500
82 /var/lib/nfs/rpc_pipefs sunrpc rpc_pipefs rw,relatime
83 /mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
84-/mnt/foo /fooooo bar rw,relatime
85 rc=0
86diff --git a/tests/expected/findmnt/outputs-default b/tests/expected/findmnt/outputs-default
87index 59495797bd..01599355ec 100644
88--- a/tests/expected/findmnt/outputs-default
89+++ b/tests/expected/findmnt/outputs-default
90@@ -30,6 +30,5 @@ TARGET SOURCE FSTYPE OPTIO
91 |-/home/kzak /dev/mapper/kzak-home ext4 rw,noatime,barrier=1,data=ordered
92 | `-/home/kzak/.gvfs gvfs-fuse-daemon fuse.gvfs-fuse-daemon rw,nosuid,nodev,relatime,user_id=500,group_id=500
93 |-/var/lib/nfs/rpc_pipefs sunrpc rpc_pipefs rw,relatime
94-|-/mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
95-`-/mnt/foo /fooooo bar rw,relatime
96+`-/mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
97 rc=0
98diff --git a/tests/expected/findmnt/outputs-force-tree b/tests/expected/findmnt/outputs-force-tree
99index 59495797bd..01599355ec 100644
100--- a/tests/expected/findmnt/outputs-force-tree
101+++ b/tests/expected/findmnt/outputs-force-tree
102@@ -30,6 +30,5 @@ TARGET SOURCE FSTYPE OPTIO
103 |-/home/kzak /dev/mapper/kzak-home ext4 rw,noatime,barrier=1,data=ordered
104 | `-/home/kzak/.gvfs gvfs-fuse-daemon fuse.gvfs-fuse-daemon rw,nosuid,nodev,relatime,user_id=500,group_id=500
105 |-/var/lib/nfs/rpc_pipefs sunrpc rpc_pipefs rw,relatime
106-|-/mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
107-`-/mnt/foo /fooooo bar rw,relatime
108+`-/mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
109 rc=0
110diff --git a/tests/expected/findmnt/outputs-kernel b/tests/expected/findmnt/outputs-kernel
111index 59495797bd..01599355ec 100644
112--- a/tests/expected/findmnt/outputs-kernel
113+++ b/tests/expected/findmnt/outputs-kernel
114@@ -30,6 +30,5 @@ TARGET SOURCE FSTYPE OPTIO
115 |-/home/kzak /dev/mapper/kzak-home ext4 rw,noatime,barrier=1,data=ordered
116 | `-/home/kzak/.gvfs gvfs-fuse-daemon fuse.gvfs-fuse-daemon rw,nosuid,nodev,relatime,user_id=500,group_id=500
117 |-/var/lib/nfs/rpc_pipefs sunrpc rpc_pipefs rw,relatime
118-|-/mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
119-`-/mnt/foo /fooooo bar rw,relatime
120+`-/mnt/sounds //foo.home/bar/ cifs rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
121 rc=0
122diff --git a/tests/expected/libmount/tabdiff-mount b/tests/expected/libmount/tabdiff-mount
123index 420aeacd5e..3c18f8dc4f 100644
124--- a/tests/expected/libmount/tabdiff-mount
125+++ b/tests/expected/libmount/tabdiff-mount
126@@ -1,3 +1,2 @@
127 /dev/mapper/kzak-home on /home/kzak: MOUNTED
128-/fooooo on /mnt/foo: MOUNTED
129 tmpfs on /mnt/test/foo bar: MOUNTED
130diff --git a/tests/expected/libmount/tabdiff-move b/tests/expected/libmount/tabdiff-move
131index 24f9bc791b..95820d93ef 100644
132--- a/tests/expected/libmount/tabdiff-move
133+++ b/tests/expected/libmount/tabdiff-move
134@@ -1,3 +1,2 @@
135 //foo.home/bar/ on /mnt/music: MOVED to /mnt/music
136-/fooooo on /mnt/foo: UMOUNTED
137 tmpfs on /mnt/test/foo bar: UMOUNTED
138diff --git a/tests/expected/libmount/tabdiff-remount b/tests/expected/libmount/tabdiff-remount
139index 82ebeab390..876bfd9539 100644
140--- a/tests/expected/libmount/tabdiff-remount
141+++ b/tests/expected/libmount/tabdiff-remount
142@@ -1,4 +1,3 @@
143 /dev/mapper/kzak-home on /home/kzak: REMOUNTED from 'rw,noatime,barrier=1,data=ordered' to 'ro,noatime,barrier=1,data=ordered'
144 //foo.home/bar/ on /mnt/sounds: REMOUNTED from 'rw,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344' to 'ro,relatime,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344'
145-/fooooo on /mnt/foo: UMOUNTED
146 tmpfs on /mnt/test/foo bar: UMOUNTED
147diff --git a/tests/expected/libmount/tabdiff-umount b/tests/expected/libmount/tabdiff-umount
148index a3e0fe48a1..c7be725b92 100644
149--- a/tests/expected/libmount/tabdiff-umount
150+++ b/tests/expected/libmount/tabdiff-umount
151@@ -1,3 +1,2 @@
152 /dev/mapper/kzak-home on /home/kzak: UMOUNTED
153-/fooooo on /mnt/foo: UMOUNTED
154 tmpfs on /mnt/test/foo bar: UMOUNTED
155diff --git a/tests/expected/libmount/tabfiles-parse-mountinfo b/tests/expected/libmount/tabfiles-parse-mountinfo
156index 47eb770061..d5ba5248e4 100644
157--- a/tests/expected/libmount/tabfiles-parse-mountinfo
158+++ b/tests/expected/libmount/tabfiles-parse-mountinfo
159@@ -351,17 +351,6 @@ id: 47
160 parent: 20
161 devno: 0:38
162 ------ fs:
163-source: /fooooo
164-target: /mnt/foo
165-fstype: bar
166-optstr: rw,relatime
167-VFS-optstr: rw,relatime
168-FS-opstr: rw
169-root: /
170-id: 48
171-parent: 20
172-devno: 0:39
173------- fs:
174 source: tmpfs
175 target: /mnt/test/foo bar
176 fstype: tmpfs
177diff --git a/tests/expected/libmount/tabfiles-py-parse-mountinfo b/tests/expected/libmount/tabfiles-py-parse-mountinfo
178index 47eb770061..d5ba5248e4 100644
179--- a/tests/expected/libmount/tabfiles-py-parse-mountinfo
180+++ b/tests/expected/libmount/tabfiles-py-parse-mountinfo
181@@ -351,17 +351,6 @@ id: 47
182 parent: 20
183 devno: 0:38
184 ------ fs:
185-source: /fooooo
186-target: /mnt/foo
187-fstype: bar
188-optstr: rw,relatime
189-VFS-optstr: rw,relatime
190-FS-opstr: rw
191-root: /
192-id: 48
193-parent: 20
194-devno: 0:39
195------- fs:
196 source: tmpfs
197 target: /mnt/test/foo bar
198 fstype: tmpfs
199diff --git a/tests/ts/findmnt/files/mountinfo b/tests/ts/findmnt/files/mountinfo
200index 475ea1a337..ff1e664a84 100644
201--- a/tests/ts/findmnt/files/mountinfo
202+++ b/tests/ts/findmnt/files/mountinfo
203@@ -30,4 +30,3 @@
204 44 41 0:36 / /home/kzak/.gvfs rw,nosuid,nodev,relatime - fuse.gvfs-fuse-daemon gvfs-fuse-daemon rw,user_id=500,group_id=500
205 45 20 0:37 / /var/lib/nfs/rpc_pipefs rw,relatime - rpc_pipefs sunrpc rw
206 47 20 0:38 / /mnt/sounds rw,relatime - cifs //foo.home/bar/ rw,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
207-48 20 0:39 / /mnt/foo\040(deleted) rw,relatime - bar /fooooo rw
208diff --git a/tests/ts/findmnt/files/mountinfo-nonroot b/tests/ts/findmnt/files/mountinfo-nonroot
209index e15b467016..87b421d2ef 100644
210--- a/tests/ts/findmnt/files/mountinfo-nonroot
211+++ b/tests/ts/findmnt/files/mountinfo-nonroot
212@@ -29,4 +29,3 @@
213 44 41 0:36 / /home/kzak/.gvfs rw,nosuid,nodev,relatime - fuse.gvfs-fuse-daemon gvfs-fuse-daemon rw,user_id=500,group_id=500
214 45 20 0:37 / /var/lib/nfs/rpc_pipefs rw,relatime - rpc_pipefs sunrpc rw
215 47 20 0:38 / /mnt/sounds rw,relatime - cifs //foo.home/bar/ rw,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
216-48 20 0:39 / /mnt/foo\040(deleted) rw,relatime - bar /fooooo rw
217diff --git a/tests/ts/libmount/files/mountinfo b/tests/ts/libmount/files/mountinfo
218index c063071833..2b01740481 100644
219--- a/tests/ts/libmount/files/mountinfo
220+++ b/tests/ts/libmount/files/mountinfo
221@@ -30,5 +30,4 @@
222 44 41 0:36 / /home/kzak/.gvfs rw,nosuid,nodev,relatime - fuse.gvfs-fuse-daemon gvfs-fuse-daemon rw,user_id=500,group_id=500
223 45 20 0:37 / /var/lib/nfs/rpc_pipefs rw,relatime - rpc_pipefs sunrpc rw
224 47 20 0:38 / /mnt/sounds rw,relatime - cifs //foo.home/bar/ rw,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
225-48 20 0:39 / /mnt/foo\040(deleted) rw,relatime - bar /fooooo rw
226 49 20 0:56 / /mnt/test/foo bar rw,relatime shared:323 - tmpfs tmpfs rw
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2022-0563.patch b/meta/recipes-core/util-linux/util-linux/CVE-2022-0563.patch
new file mode 100644
index 0000000000..54b496ea3f
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2022-0563.patch
@@ -0,0 +1,161 @@
1From faa5a3a83ad0cb5e2c303edbfd8cd823c9d94c17 Mon Sep 17 00:00:00 2001
2From: Karel Zak <kzak@redhat.com>
3Date: Thu, 10 Feb 2022 12:03:17 +0100
4Subject: [PATCH] chsh, chfn: remove readline support [CVE-2022-0563]
5
6The readline library uses INPUTRC= environment variable to get a path
7to the library config file. When the library cannot parse the
8specified file, it prints an error message containing data from the
9file.
10
11Unfortunately, the library does not use secure_getenv() (or a similar
12concept) to avoid vulnerabilities that could occur if set-user-ID or
13set-group-ID programs.
14
15Reported-by: Rory Mackie <rory.mackie@trailofbits.com>
16Signed-off-by: Karel Zak <kzak@redhat.com>
17
18Upstream-status: Backport
19https://github.com/util-linux/util-linux/commit/faa5a3a83ad0cb5e2c303edbfd8cd823c9d94c17
20
21CVE: CVE-2022-0563
22
23Signed-off-by: Steve Sakoman <steve@sakoman.com>
24
25---
26 login-utils/Makemodule.am | 2 +-
27 login-utils/chfn.c | 16 +++------------
28 login-utils/chsh.c | 42 ++-------------------------------------
29 3 files changed, 6 insertions(+), 54 deletions(-)
30
31diff --git a/login-utils/Makemodule.am b/login-utils/Makemodule.am
32index fac5bfc..73636af 100644
33--- a/login-utils/Makemodule.am
34+++ b/login-utils/Makemodule.am
35@@ -82,7 +82,7 @@ chfn_chsh_sources = \
36 login-utils/ch-common.c
37 chfn_chsh_cflags = $(SUID_CFLAGS) $(AM_CFLAGS)
38 chfn_chsh_ldflags = $(SUID_LDFLAGS) $(AM_LDFLAGS)
39-chfn_chsh_ldadd = libcommon.la $(READLINE_LIBS)
40+chfn_chsh_ldadd = libcommon.la
41
42 if CHFN_CHSH_PASSWORD
43 chfn_chsh_ldadd += -lpam
44diff --git a/login-utils/chfn.c b/login-utils/chfn.c
45index b739555..2f8e44a 100644
46--- a/login-utils/chfn.c
47+++ b/login-utils/chfn.c
48@@ -56,11 +56,6 @@
49 # include "auth.h"
50 #endif
51
52-#ifdef HAVE_LIBREADLINE
53-# define _FUNCTION_DEF
54-# include <readline/readline.h>
55-#endif
56-
57 struct finfo {
58 char *full_name;
59 char *office;
60@@ -229,22 +224,17 @@ static char *ask_new_field(struct chfn_control *ctl, const char *question,
61 {
62 int len;
63 char *buf;
64-#ifndef HAVE_LIBREADLINE
65- size_t dummy = 0;
66-#endif
67
68 if (!def_val)
69 def_val = "";
70+
71 while (true) {
72 printf("%s [%s]: ", question, def_val);
73 __fpurge(stdin);
74-#ifdef HAVE_LIBREADLINE
75- rl_bind_key('\t', rl_insert);
76- if ((buf = readline(NULL)) == NULL)
77-#else
78+
79 if (getline(&buf, &dummy, stdin) < 0)
80-#endif
81 errx(EXIT_FAILURE, _("Aborted."));
82+
83 /* remove white spaces from string end */
84 ltrim_whitespace((unsigned char *) buf);
85 len = rtrim_whitespace((unsigned char *) buf);
86diff --git a/login-utils/chsh.c b/login-utils/chsh.c
87index a9ebec8..ee6ff87 100644
88--- a/login-utils/chsh.c
89+++ b/login-utils/chsh.c
90@@ -58,11 +58,6 @@
91 # include "auth.h"
92 #endif
93
94-#ifdef HAVE_LIBREADLINE
95-# define _FUNCTION_DEF
96-# include <readline/readline.h>
97-#endif
98-
99 struct sinfo {
100 char *username;
101 char *shell;
102@@ -121,33 +116,6 @@ static void print_shells(void)
103 endusershell();
104 }
105
106-#ifdef HAVE_LIBREADLINE
107-static char *shell_name_generator(const char *text, int state)
108-{
109- static size_t len;
110- char *s;
111-
112- if (!state) {
113- setusershell();
114- len = strlen(text);
115- }
116-
117- while ((s = getusershell())) {
118- if (strncmp(s, text, len) == 0)
119- return xstrdup(s);
120- }
121- return NULL;
122-}
123-
124-static char **shell_name_completion(const char *text,
125- int start __attribute__((__unused__)),
126- int end __attribute__((__unused__)))
127-{
128- rl_attempted_completion_over = 1;
129- return rl_completion_matches(text, shell_name_generator);
130-}
131-#endif
132-
133 /*
134 * parse_argv () --
135 * parse the command line arguments, and fill in "pinfo" with any
136@@ -198,20 +166,14 @@ static char *ask_new_shell(char *question, char *oldshell)
137 {
138 int len;
139 char *ans = NULL;
140-#ifdef HAVE_LIBREADLINE
141- rl_attempted_completion_function = shell_name_completion;
142-#else
143 size_t dummy = 0;
144-#endif
145+
146 if (!oldshell)
147 oldshell = "";
148 printf("%s [%s]\n", question, oldshell);
149-#ifdef HAVE_LIBREADLINE
150- if ((ans = readline("> ")) == NULL)
151-#else
152 if (getline(&ans, &dummy, stdin) < 0)
153-#endif
154 return NULL;
155+
156 /* remove the newline at the end of ans. */
157 ltrim_whitespace((unsigned char *) ans);
158 len = rtrim_whitespace((unsigned char *) ans);
159--
1602.25.1
161
diff --git a/meta/recipes-core/util-linux/util-linux/include-strutils-cleanup-strto-functions.patch b/meta/recipes-core/util-linux/util-linux/include-strutils-cleanup-strto-functions.patch
new file mode 100644
index 0000000000..5d5a370821
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/include-strutils-cleanup-strto-functions.patch
@@ -0,0 +1,270 @@
1From 84825b161ba5d18da4142893b9789b3fc71284d9 Mon Sep 17 00:00:00 2001
2From: Karel Zak <kzak@redhat.com>
3Date: Tue, 22 Jun 2021 14:20:42 +0200
4Subject: [PATCH] include/strutils: cleanup strto..() functions
5
6* add ul_strtos64() and ul_strtou64()
7* add simple test
8
9Addresses: https://github.com/karelzak/util-linux/issues/1358
10Signed-off-by: Karel Zak <kzak@redhat.com>
11
12Upstream-Backport: [https://github.com/util-linux/util-linux/commit/84825b161ba5d18da4142893b9789b3fc71284d9]
13Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
14
15---
16 include/strutils.h | 3 +
17 lib/strutils.c | 174 ++++++++++++++++++++++++++-------------------
18 2 files changed, 105 insertions(+), 72 deletions(-)
19
20diff --git a/include/strutils.h b/include/strutils.h
21index e75a2f0e17..389e849905 100644
22--- a/include/strutils.h
23+++ b/include/strutils.h
24@@ -19,6 +19,9 @@ extern int parse_size(const char *str, uintmax_t *res, int *power);
25 extern int strtosize(const char *str, uintmax_t *res);
26 extern uintmax_t strtosize_or_err(const char *str, const char *errmesg);
27
28+extern int ul_strtos64(const char *str, int64_t *num, int base);
29+extern int ul_strtou64(const char *str, uint64_t *num, int base);
30+
31 extern int16_t strtos16_or_err(const char *str, const char *errmesg);
32 extern uint16_t strtou16_or_err(const char *str, const char *errmesg);
33 extern uint16_t strtox16_or_err(const char *str, const char *errmesg);
34diff --git a/lib/strutils.c b/lib/strutils.c
35index ee2c835495..d9976dca70 100644
36--- a/lib/strutils.c
37+++ b/lib/strutils.c
38@@ -319,39 +319,80 @@ char *strndup(const char *s, size_t n)
39 }
40 #endif
41
42-static uint32_t _strtou32_or_err(const char *str, const char *errmesg, int base);
43-static uint64_t _strtou64_or_err(const char *str, const char *errmesg, int base);
44+/*
45+ * convert strings to numbers; returns <0 on error, and 0 on success
46+ */
47+int ul_strtos64(const char *str, int64_t *num, int base)
48+{
49+ char *end = NULL;
50
51-int16_t strtos16_or_err(const char *str, const char *errmesg)
52+ errno = 0;
53+ if (str == NULL || *str == '\0')
54+ return -EINVAL;
55+ *num = (int64_t) strtoimax(str, &end, base);
56+
57+ if (errno || str == end || (end && *end))
58+ return -EINVAL;
59+ return 0;
60+}
61+
62+int ul_strtou64(const char *str, uint64_t *num, int base)
63 {
64- int32_t num = strtos32_or_err(str, errmesg);
65+ char *end = NULL;
66
67- if (num < INT16_MIN || num > INT16_MAX) {
68- errno = ERANGE;
69- err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
70- }
71- return num;
72+ errno = 0;
73+ if (str == NULL || *str == '\0')
74+ return -EINVAL;
75+ *num = (uint64_t) strtoumax(str, &end, base);
76+
77+ if (errno || str == end || (end && *end))
78+ return -EINVAL;
79+ return 0;
80 }
81
82-static uint16_t _strtou16_or_err(const char *str, const char *errmesg, int base)
83+/*
84+ * Covert strings to numbers and print message on error.
85+ *
86+ * Note that hex functions (strtox..()) returns unsigned numbers, if you need
87+ * something else then use ul_strtos64(s, &n, 16).
88+ */
89+int64_t strtos64_or_err(const char *str, const char *errmesg)
90 {
91- uint32_t num = _strtou32_or_err(str, errmesg, base);
92+ int64_t num = 0;
93
94- if (num > UINT16_MAX) {
95- errno = ERANGE;
96- err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
97+ if (ul_strtos64(str, &num, 10) != 0) {
98+ if (errno == ERANGE)
99+ err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
100+
101+ errx(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
102 }
103 return num;
104 }
105
106-uint16_t strtou16_or_err(const char *str, const char *errmesg)
107+uint64_t strtou64_or_err(const char *str, const char *errmesg)
108 {
109- return _strtou16_or_err(str, errmesg, 10);
110+ uint64_t num = 0;
111+
112+ if (ul_strtou64(str, &num, 10)) {
113+ if (errno == ERANGE)
114+ err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
115+
116+ errx(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
117+ }
118+ return num;
119 }
120
121-uint16_t strtox16_or_err(const char *str, const char *errmesg)
122+uint64_t strtox64_or_err(const char *str, const char *errmesg)
123 {
124- return _strtou16_or_err(str, errmesg, 16);
125+ uint64_t num = 0;
126+
127+ if (ul_strtou64(str, &num, 16)) {
128+ if (errno == ERANGE)
129+ err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
130+
131+ errx(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
132+ }
133+ return num;
134 }
135
136 int32_t strtos32_or_err(const char *str, const char *errmesg)
137@@ -365,9 +406,9 @@ int32_t strtos32_or_err(const char *str, const char *errmesg)
138 return num;
139 }
140
141-static uint32_t _strtou32_or_err(const char *str, const char *errmesg, int base)
142+uint32_t strtou32_or_err(const char *str, const char *errmesg)
143 {
144- uint64_t num = _strtou64_or_err(str, errmesg, base);
145+ uint64_t num = strtou64_or_err(str, errmesg);
146
147 if (num > UINT32_MAX) {
148 errno = ERANGE;
149@@ -376,66 +417,48 @@ static uint32_t _strtou32_or_err(const char *str, const char *errmesg, int base)
150 return num;
151 }
152
153-uint32_t strtou32_or_err(const char *str, const char *errmesg)
154-{
155- return _strtou32_or_err(str, errmesg, 10);
156-}
157-
158 uint32_t strtox32_or_err(const char *str, const char *errmesg)
159 {
160- return _strtou32_or_err(str, errmesg, 16);
161+ uint64_t num = strtox64_or_err(str, errmesg);
162+
163+ if (num > UINT32_MAX) {
164+ errno = ERANGE;
165+ err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
166+ }
167+ return num;
168 }
169
170-int64_t strtos64_or_err(const char *str, const char *errmesg)
171+int16_t strtos16_or_err(const char *str, const char *errmesg)
172 {
173- int64_t num;
174- char *end = NULL;
175-
176- errno = 0;
177- if (str == NULL || *str == '\0')
178- goto err;
179- num = strtoimax(str, &end, 10);
180-
181- if (errno || str == end || (end && *end))
182- goto err;
183+ int64_t num = strtos64_or_err(str, errmesg);
184
185- return num;
186-err:
187- if (errno == ERANGE)
188+ if (num < INT16_MIN || num > INT16_MAX) {
189+ errno = ERANGE;
190 err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
191-
192- errx(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
193+ }
194+ return num;
195 }
196
197-static uint64_t _strtou64_or_err(const char *str, const char *errmesg, int base)
198+uint16_t strtou16_or_err(const char *str, const char *errmesg)
199 {
200- uintmax_t num;
201- char *end = NULL;
202-
203- errno = 0;
204- if (str == NULL || *str == '\0')
205- goto err;
206- num = strtoumax(str, &end, base);
207-
208- if (errno || str == end || (end && *end))
209- goto err;
210+ uint64_t num = strtou64_or_err(str, errmesg);
211
212- return num;
213-err:
214- if (errno == ERANGE)
215+ if (num > UINT16_MAX) {
216+ errno = ERANGE;
217 err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
218-
219- errx(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
220+ }
221+ return num;
222 }
223
224-uint64_t strtou64_or_err(const char *str, const char *errmesg)
225+uint16_t strtox16_or_err(const char *str, const char *errmesg)
226 {
227- return _strtou64_or_err(str, errmesg, 10);
228-}
229+ uint64_t num = strtox64_or_err(str, errmesg);
230
231-uint64_t strtox64_or_err(const char *str, const char *errmesg)
232-{
233- return _strtou64_or_err(str, errmesg, 16);
234+ if (num > UINT16_MAX) {
235+ errno = ERANGE;
236+ err(STRTOXX_EXIT_CODE, "%s: '%s'", errmesg, str);
237+ }
238+ return num;
239 }
240
241 double strtod_or_err(const char *str, const char *errmesg)
242@@ -1051,15 +1051,25 @@ static int test_strutils_cmp_paths(int a
243
244 int main(int argc, char *argv[])
245 {
246- if (argc == 3 && strcmp(argv[1], "--size") == 0)
247+ if (argc == 3 && strcmp(argv[1], "--size") == 0) {
248 return test_strutils_sizes(argc - 1, argv + 1);
249
250- else if (argc == 4 && strcmp(argv[1], "--cmp-paths") == 0)
251+ } else if (argc == 4 && strcmp(argv[1], "--cmp-paths") == 0) {
252 return test_strutils_cmp_paths(argc - 1, argv + 1);
253
254+ } else if (argc == 3 && strcmp(argv[1], "--str2num") == 0) {
255+ uint64_t n;
256+
257+ if (ul_strtou64(argv[2], &n, 10) == 0) {
258+ printf("'%s' --> %ju\n", argv[2], (uintmax_t) n);
259+ return EXIT_SUCCESS;
260+ }
261+ }
262+
263 else {
264 fprintf(stderr, "usage: %1$s --size <number>[suffix]\n"
265- " %1$s --cmp-paths <path> <path>\n",
266+ " %1$s --cmp-paths <path> <path>\n"
267+ " %1$s --num2num <str>\n",
268 argv[0]);
269 exit(EXIT_FAILURE);
270 }
diff --git a/meta/recipes-core/util-linux/util-linux_2.35.1.bb b/meta/recipes-core/util-linux/util-linux_2.35.1.bb
index 516b783887..89dc564ecb 100644
--- a/meta/recipes-core/util-linux/util-linux_2.35.1.bb
+++ b/meta/recipes-core/util-linux/util-linux_2.35.1.bb
@@ -11,6 +11,11 @@ SRC_URI += "file://configure-sbindir.patch \
11 file://0001-libfdisk-script-accept-sector-size-ignore-unknown-he.patch \ 11 file://0001-libfdisk-script-accept-sector-size-ignore-unknown-he.patch \
12 file://0001-kill-include-sys-types.h-before-checking-SYS_pidfd_s.patch \ 12 file://0001-kill-include-sys-types.h-before-checking-SYS_pidfd_s.patch \
13 file://0001-include-cleanup-pidfd-inckudes.patch \ 13 file://0001-include-cleanup-pidfd-inckudes.patch \
14 file://CVE-2021-37600.patch \
15 file://include-strutils-cleanup-strto-functions.patch \
16 file://CVE-2021-3995.patch \
17 file://CVE-2021-3996.patch \
18 file://CVE-2022-0563.patch \
14" 19"
15SRC_URI[md5sum] = "7f64882f631225f0295ca05080cee1bf" 20SRC_URI[md5sum] = "7f64882f631225f0295ca05080cee1bf"
16SRC_URI[sha256sum] = "d9de3edd287366cd908e77677514b9387b22bc7b88f45b83e1922c3597f1d7f9" 21SRC_URI[sha256sum] = "d9de3edd287366cd908e77677514b9387b22bc7b88f45b83e1922c3597f1d7f9"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-09 16:50:38 +0000