Re: [OE-core] [PATCH v2 3/7] pseudo: fix for build with glibc-2.43

["Böszörményi Zoltán" <zboszor@gmail.com>]

2026. 04. 08. 11:44 keltezéssel, Paul Barker írta:
> On Tue, 2026-04-07 at 17:38 +0200, Zoltan Boszormenyi via
> lists.openembedded.org wrote:
>> 2026. 04. 07. 17:21 keltezéssel, Zoltan Boszormenyi via lists.openembedded.org írta:
>>> The issue turns out to be with GNU tar, specifically this build:
>>> https://koji.fedoraproject.org/koji/buildinfo?buildID=2924033
>>>
>>> Manually downgrading to the previous build fixed the packaging problem:
>>> https://koji.fedoraproject.org/koji/buildinfo?buildID=2917292
>>>
>>> I reported it here:
>>> https://bugzilla.redhat.com/show_bug.cgi?id=2455965
>> According to the changelog of the current GNU tar 1.35-8.fc44 build,
>> it contains backports from what will be the official 1.36 version.
>> With that release, whenever it will be out, other distros would fail, too.
>>
>> Note this from the Fedora package changelog:
>>
>> - Backport upstream changes to jailify extraction directory
>>     Includes related gnulib changes to add openat2
>>     Fixes CVE-2025-45582 (fedora#2380007)
>>
>> which seems to be this commit:
>> https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=75b03fdff48916bd0654677ed21379bdb0db016d
>>
>> commit 75b03fdff48916bd0654677ed21379bdb0db016d
>> Author: Paul Eggert <eggert@cs.ucla.edu>
>> Date:   Thu Nov 13 13:44:10 2025 -0800
>>
>>       Use openat2 to jailify the extraction directory
>>
>>       This addresses CVE-2025-45582.
>>       * gnulib.modules: Add openat2.
>>       * src/misc.c (open_subdir): New static function.
>>       (fdbase_opendir): Use it.
>>       * src/tar.c (open_searchdir_how): New var, replacing and
>>       augmenting open_searchdir_flags.  All uses changed.
>>       * tests/extrac31.at: New file.
>>       * tests/Makefile (TESTSUITE_AT), tests/testuite.at: Add it.
>>
>> I guess it will really need fixes in pseudo to overcome this.
> Hi Zoltan,
>
> The issue is that our intercept function for openat2 is a stub [1], it
> returns -ENOSYS. This works on other distros as the gnulib
> implementation of openat2 in userspace can be used as a fallback. If tar
> in F44 doesn't have any fallback for when openat2 isn't implemented that
> that won't work.
>
> So it looks like we will need to complete openat2 handling in pseudo. We
> have an issue for that in bugzilla [2], I'll update it.
>
> [1]: https://git.yoctoproject.org/pseudo/tree/ports/linux/openat2/guts/openat2.c
> [2]: https://bugzilla.yoctoproject.org/show_bug.cgi?id=16126

Thank you.