From: "Yoann Congal" <yoann.congal@smile.fr>
To: <dkelaiya@cisco.com>, <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][wrynose][PATCH 0/3] acl: Security fixes
Date: Sun, 15 Nov 2026 01:09:29 +0100 [thread overview]
Message-ID: <DMVCJFB6GMSJ.278YTTU78ZCM0@smile.fr> (raw)
In-Reply-To: <20261104055335.2080900-1-dkelaiya@cisco.com>
On Wed Nov 4, 2026 at 6:53 AM CET, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via openembedded-core wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> Backport the upstream fixes for CVE-2026-54369 and CVE-2026-54370 to
> ACL 2.3.2.
>
> CVE-2026-54369 adds descriptor-relative ACL APIs so callers can control
> symlink traversal. CVE-2026-54370 uses those APIs to harden getfacl,
> setfacl, setfacl --restore and chacl against path replacement races and
> unsafe symlink traversal.
>
> Retain ACL 2.3.2 on the stable Wrynose branch and backport the security
> fixes with the required _at APIs and helper dependencies. This follows
> OE-Core's focus on security and bug fixes for stable branches [1],
> avoiding a general recipe upgrade to ACL 2.4.0. Existing pathname API
> behavior is preserved.
>
> The new public acl_*_at declarations conflict with private helpers
> using the same names in GNU tar 1.35. Patch 1 backports the upstream
> tar rename before patches 2 and 3 introduce and consume
> the new ACL APIs.
>
> [1] https://docs.yoctoproject.org/6.0/ref-manual/release-process.html#stable-release-process
>
> Darsh Kelaiya (3):
> tar: avoid name conflicts with new libacl APIs
> acl: fix CVE-2026-54369
> acl: fix CVE-2026-54370
>
> .../tar/tar/Avoid-acl_-prefix-for-functions.patch | 103 ++
> meta/recipes-extended/tar/tar_1.35.bb | 1 +
> .../attr/acl/CVE-2026-54369-dependent_p1.patch | 69 ++
> .../attr/acl/CVE-2026-54369-dependent_p2.patch | 200 ++++
> .../attr/acl/CVE-2026-54369-dependent_p3.patch | 712 +++++++++++++
> meta/recipes-support/attr/acl/CVE-2026-54369_p1.patch | 719 +++++++++++++
> meta/recipes-support/attr/acl/CVE-2026-54369_p2.patch | 957 ++++++++++++++++++
> meta/recipes-support/attr/acl/CVE-2026-54369_p3.patch | 109 ++
> .../attr/acl/CVE-2026-54370-dependent_p1.patch | 168 +++
> .../attr/acl/CVE-2026-54370-dependent_p2.patch | 761 ++++++++++++++
> .../attr/acl/CVE-2026-54370-dependent_p3.patch | 439 ++++++++
> .../attr/acl/CVE-2026-54370-dependent_p4.patch | 140 +++
> meta/recipes-support/attr/acl/CVE-2026-54370_p1.patch | 299 ++++++
> meta/recipes-support/attr/acl/CVE-2026-54370_p2.patch | 403 ++++++++
> meta/recipes-support/attr/acl/CVE-2026-54370_p3.patch | 603 +++++++++++
> meta/recipes-support/attr/acl/CVE-2026-54370_p4.patch | 213 ++++
> meta/recipes-support/attr/acl_2.3.2.bb | 14 +
> 17 files changed, 5910 insertions(+)
> create mode 100644 meta/recipes-extended/tar/tar/Avoid-acl_-prefix-for-functions.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369-dependent_p1.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369-dependent_p2.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369-dependent_p3.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369_p1.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369_p2.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54369_p3.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370-dependent_p1.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370-dependent_p2.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370-dependent_p3.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370-dependent_p4.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370_p1.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370_p2.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370_p3.patch
> create mode 100644 meta/recipes-support/attr/acl/CVE-2026-54370_p4.patch
Hello,
This is quite a big series ("5910 insertions(+)"). Looking at it, I think
this might be just backporting most of the risky parts of the 2.4.0
upgrade, but then, we might just be better off simply upgrading to
2.4.0. Do you have thoughts about that? Are there definite breakage on a
potential 2.4.0 upgrade?
Obviously, a 2.4.0 upgrade would need serious thoughts/discussion but
this might be the way forward.
Regards,
--
Yoann Congal
Smile ECS
prev parent reply other threads:[~2026-11-15 0:09 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-04 5:53 [OE-core][wrynose][PATCH 0/3] acl: Security fixes Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-11-04 5:53 ` [OE-core][wrynose][PATCH 1/3] tar: avoid name conflicts with new libacl APIs Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-11-04 6:01 ` Patchtest results for " patchtest
2026-11-04 5:53 ` [OE-core][wrynose][PATCH 2/3] acl: fix CVE-2026-54369 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-11-04 5:53 ` [OE-core][wrynose][PATCH 3/3] acl: fix CVE-2026-54370 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-11-15 0:09 ` Yoann Congal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DMVCJFB6GMSJ.278YTTU78ZCM0@smile.fr \
--to=yoann.congal@smile.fr \
--cc=dkelaiya@cisco.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.