[meta-virtualization][wrynose][PATCH 2/2] crun: patch CVE-2026-47766

[Peter Marko <peter.marko@siemens.com>]

From: Peter Marko <peter.marko@siemens.com>

Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-47766

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../crun/crun/CVE-2026-47766.patch            | 161 ++++++++++++++++++
 recipes-containers/crun/crun_git.bb           |   1 +
 2 files changed, 162 insertions(+)
 create mode 100644 recipes-containers/crun/crun/CVE-2026-47766.patch

diff --git a/recipes-containers/crun/crun/CVE-2026-47766.patch b/recipes-containers/crun/crun/CVE-2026-47766.patch
new file mode 100644
index 00000000..0a369b46
--- /dev/null
+++ b/recipes-containers/crun/crun/CVE-2026-47766.patch
@@ -0,0 +1,161 @@
+From c6f338ac2e26e216ab7820b91863a0b84e608097 Mon Sep 17 00:00:00 2001
+From: JUNYI LIU <moss80199.cs05@nycu.edu.tw>
+Date: Mon, 25 May 2026 22:45:06 +0800
+Subject: [PATCH] Do not follow rootfs /dev symlinks (CVE-2026-47766)
+
+Open rootfs /dev with safe_openat before creating default devices or handler-specific devices. This keeps rootfs-controlled /dev symlinks from redirecting device setup outside the container rootfs.
+
+Add a regression test covering a rootfs /dev symlink to an outside directory and verify that the outside target is not populated or replaced.
+
+Signed-off-by: JUNYI LIU <moss80199.cs05@nycu.edu.tw>
+
+CVE: CVE-2026-47766
+Upstream-Status: Backport [https://github.com/containers/crun/commit/c6f338ac2e26e216ab7820b91863a0b84e608097]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/libcrun/handlers/krun.c |  4 +-
+ src/libcrun/linux.c         |  4 +-
+ tests/test_devices.py       | 84 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 88 insertions(+), 4 deletions(-)
+
+diff --git a/src/libcrun/handlers/krun.c b/src/libcrun/handlers/krun.c
+index 5e1f3e54..6e249a9b 100644
+--- a/src/libcrun/handlers/krun.c
++++ b/src/libcrun/handlers/krun.c
+@@ -609,9 +609,9 @@ libkrun_configure_container (void *cookie, enum handler_configure_phase phase,
+         }
+     }
+ 
+-  devfd = openat (rootfsfd, "dev", O_PATH | O_DIRECTORY | O_CLOEXEC);
++  devfd = safe_openat (rootfsfd, rootfs, "dev", O_PATH | O_DIRECTORY | O_CLOEXEC, 0, err);
+   if (UNLIKELY (devfd < 0))
+-    return crun_make_error (err, errno, "open /dev directory in `%s`", rootfs);
++    return devfd;
+ 
+   ret = check_running_in_user_namespace (err);
+   if (UNLIKELY (ret < 0))
+diff --git a/src/libcrun/linux.c b/src/libcrun/linux.c
+index 24569dec..fcb62dbf 100644
+--- a/src/libcrun/linux.c
++++ b/src/libcrun/linux.c
+@@ -1754,9 +1754,9 @@ create_missing_devs (libcrun_container_t *container, bool binds, libcrun_error_t
+   if (! def || ! def->linux)
+     return 0;
+ 
+-  devfd = openat (get_private_data (container)->rootfsfd, "dev", O_CLOEXEC | O_PATH | O_DIRECTORY);
++  devfd = safe_openat (get_private_data (container)->rootfsfd, rootfs, "dev", O_CLOEXEC | O_PATH | O_DIRECTORY, 0, err);
+   if (UNLIKELY (devfd < 0))
+-    return crun_make_error (err, errno, "open `/dev` directory in `%s`", rootfs);
++    return devfd;
+ 
+   for (i = 0; i < def->linux->devices_len; i++)
+     {
+diff --git a/tests/test_devices.py b/tests/test_devices.py
+index 1a973025..4f0a2bb6 100755
+--- a/tests/test_devices.py
++++ b/tests/test_devices.py
+@@ -18,6 +18,7 @@
+ import os
+ import subprocess
+ import shutil
++import json
+ from tests_utils import *
+ 
+ def test_mode_device():
+@@ -368,6 +369,88 @@ def test_mknod_char_device():
+         return -1
+     return 0
+ 
++def test_dev_symlink_does_not_populate_outside_rootfs():
++    if is_rootless():
++        return (77, "requires root privileges")
++
++    workdir = os.path.join(get_tests_root(), "dev-symlink")
++    bundle = os.path.join(workdir, "bundle")
++    rootfs = os.path.join(bundle, "rootfs")
++    outside_dev = os.path.join(workdir, "outside-dev")
++    runtime_root = os.path.join(workdir, "run")
++    shutil.rmtree(workdir, ignore_errors=True)
++    try:
++        os.makedirs(rootfs)
++        os.makedirs(outside_dev)
++        os.makedirs(runtime_root)
++        ptmx_marker = os.path.join(outside_dev, "ptmx")
++        with open(ptmx_marker, "w") as f:
++            f.write("outside marker\n")
++
++        os.symlink(outside_dev, os.path.join(rootfs, "dev"))
++        shutil.copy2(get_init_path(), os.path.join(rootfs, "init"))
++        os.chmod(os.path.join(rootfs, "init"), 0o755)
++
++        conf = {
++            "ociVersion": "1.0.2",
++            "process": {
++                "terminal": False,
++                "user": {"uid": 0, "gid": 0},
++                "args": ["/init", "true"],
++                "env": ["PATH=/bin"],
++                "cwd": "/",
++            },
++            "root": {
++                "path": "rootfs",
++                "readonly": True,
++            },
++            "mounts": [
++                {"destination": "/proc", "type": "proc", "source": "proc"},
++            ],
++            "linux": {
++                "namespaces": [
++                    {"type": "mount"},
++                    {"type": "pid"},
++                    {"type": "ipc"},
++                    {"type": "uts"},
++                ],
++            },
++        }
++        with open(os.path.join(bundle, "config.json"), "w") as f:
++            f.write(json.dumps(conf))
++
++        container_id = "test-dev-symlink"
++        crun = get_crun_path()
++
++        try:
++            subprocess.check_output([crun, "--root", runtime_root, "run", "-b", bundle, container_id],
++                                    stderr=subprocess.STDOUT)
++            logger.info("container unexpectedly started with rootfs /dev symlink")
++            return -1
++        except subprocess.CalledProcessError:
++            pass
++        finally:
++            subprocess.run([crun, "--root", runtime_root, "delete", "-f", container_id],
++                           stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
++
++        outside_entries = sorted(os.listdir(outside_dev))
++        if outside_entries != ["ptmx"]:
++            logger.info("rootfs /dev symlink target was populated outside rootfs: %s", outside_entries)
++            return -1
++
++        if os.path.islink(ptmx_marker):
++            logger.info("rootfs /dev symlink target ptmx marker was replaced with a symlink")
++            return -1
++
++        with open(ptmx_marker) as f:
++            if f.read() != "outside marker\n":
++                logger.info("rootfs /dev symlink target ptmx marker content changed")
++                return -1
++
++        return 0
++    finally:
++        shutil.rmtree(workdir, ignore_errors=True)
++
+ def test_allow_device_read_only():
+     if is_rootless():
+         return (77, "requires root privileges")
+@@ -425,6 +508,7 @@ def test_allow_device_read_only():
+ all_tests = {
+     "mknod-fifo-device": test_mknod_fifo_device,
+     "mknod-char-device": test_mknod_char_device,
++    "dev-symlink-does-not-populate-outside-rootfs": test_dev_symlink_does_not_populate_outside_rootfs,
+     "allow-device-read-only": test_allow_device_read_only,
+     "owner-device" : test_owner_device,
+     "deny-devices" : test_deny_devices,
diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/crun_git.bb
index e8d87484..809b6c01 100644
--- a/recipes-containers/crun/crun_git.bb
+++ b/recipes-containers/crun/crun_git.bb
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/containers/crun.git;branch=main;name=crun;protocol=h
            file://0001-libocispec-correctly-parse-JSON-schema-references.patch;patchdir=libocispec \
            file://0002-libocispec-fix-array-items-parsing.patch;patchdir=libocispec \
            file://CVE-2026-30892.patch \
+           file://CVE-2026-47766.patch \
           "
 
 PV = "1.26.0+git"