Re: [OE-core] [PATCH v2 3/7] pseudo: fix for build with glibc-2.43

[Paul Barker <paul@pbarker.dev>]

[-- Attachment #1: Type: text/plain, Size: 2459 bytes --]

On Tue, 2026-04-07 at 17:38 +0200, Zoltan Boszormenyi via
lists.openembedded.org wrote:
> 2026. 04. 07. 17:21 keltezéssel, Zoltan Boszormenyi via lists.openembedded.org írta:
> > The issue turns out to be with GNU tar, specifically this build:
> > https://koji.fedoraproject.org/koji/buildinfo?buildID=2924033
> > 
> > Manually downgrading to the previous build fixed the packaging problem:
> > https://koji.fedoraproject.org/koji/buildinfo?buildID=2917292
> > 
> > I reported it here:
> > https://bugzilla.redhat.com/show_bug.cgi?id=2455965
> 
> According to the changelog of the current GNU tar 1.35-8.fc44 build,
> it contains backports from what will be the official 1.36 version.
> With that release, whenever it will be out, other distros would fail, too.
> 
> Note this from the Fedora package changelog:
> 
> - Backport upstream changes to jailify extraction directory
>    Includes related gnulib changes to add openat2
>    Fixes CVE-2025-45582 (fedora#2380007)
> 
> which seems to be this commit:
> https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=75b03fdff48916bd0654677ed21379bdb0db016d
> 
> commit 75b03fdff48916bd0654677ed21379bdb0db016d
> Author: Paul Eggert <eggert@cs.ucla.edu>
> Date:   Thu Nov 13 13:44:10 2025 -0800
> 
>      Use openat2 to jailify the extraction directory
> 
>      This addresses CVE-2025-45582.
>      * gnulib.modules: Add openat2.
>      * src/misc.c (open_subdir): New static function.
>      (fdbase_opendir): Use it.
>      * src/tar.c (open_searchdir_how): New var, replacing and
>      augmenting open_searchdir_flags.  All uses changed.
>      * tests/extrac31.at: New file.
>      * tests/Makefile (TESTSUITE_AT), tests/testuite.at: Add it.
> 
> I guess it will really need fixes in pseudo to overcome this.

Hi Zoltan,

The issue is that our intercept function for openat2 is a stub [1], it
returns -ENOSYS. This works on other distros as the gnulib
implementation of openat2 in userspace can be used as a fallback. If tar
in F44 doesn't have any fallback for when openat2 isn't implemented that
that won't work.

So it looks like we will need to complete openat2 handling in pseudo. We
have an issue for that in bugzilla [2], I'll update it.

[1]: https://git.yoctoproject.org/pseudo/tree/ports/linux/openat2/guts/openat2.c
[2]: https://bugzilla.yoctoproject.org/show_bug.cgi?id=16126

Thanks,

-- 
Paul Barker


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]