Re: [OE-core][scarthgap][PATCH 1/6] rsync: Fix CVE-2026-29518

["Yoann Congal" <yoann.congal@smile.fr>]

On Fri Jun 12, 2026 at 2:13 PM CEST, Ashishkumar Parmar X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Ashishkumar Parmar <asparmar@cisco.com>
>
> Pick the upstream backport [1] for CVE-2026-29518 as mentioned in [3],
> where a non-chrooted rsync daemon could be exposed to a parent path
> TOCTOU race that allowed file access outside the module.
>
> Also include the dependent upstream fix that followed the CVE fix:
> - CVE-2026-29518_p2.patch [2] secures sender read-path opens by
>   opening files from the module root, closing the same race on the
>   read side.
>
> [1] https://github.com/RsyncProject/rsync/commit/1a5ad81add1004354a3d8ba841b94ffe19cd2505
> [2] https://github.com/RsyncProject/rsync/commit/99b36291d06ca66229942c7a525a1f5566f10c85
> [3] https://www.cve.org/CVERecord?id=CVE-2026-29518
>
> Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
> ---
>  .../rsync/files/CVE-2026-29518_p1.patch       | 330 ++++++++++++++++++
>  .../rsync/files/CVE-2026-29518_p2.patch       |  73 ++++
>  meta/recipes-devtools/rsync/rsync_3.2.7.bb    |   2 +
>  3 files changed, 405 insertions(+)
>  create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch
>  create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch

Hello,

Something in this series made the test fail on debian 11:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/4395/steps/15/logs/stdio
|   399	ERROR: rsync-native-3.2.7-r0 do_compile: oe_runmake failed
|   400	ERROR: rsync-native-3.2.7-r0 do_compile: ExecutionError('/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/run.do_compile.2977888', 1, None, None)
|   401	NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_patch: Succeeded
|   402	NOTE: Running task 392 of 412 (/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/gcc/gcc-source_13.4.bb:do_preconfigure)
|   403	NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_preconfigure: Started
|   404	NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_preconfigure: Succeeded
|   405	ERROR: Logfile of failure stored in: /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/log.do_compile.2977888
|   406	Log data follows:
|   407	| DEBUG: Executing python function autotools_aclocals
|   408	| DEBUG: SITE files ['endian-little', 'common-linux', 'common-glibc', 'bit-64', 'x86_64-linux', 'common']
|   409	| DEBUG: Python function autotools_aclocals finished
|   410	| DEBUG: Executing shell function do_compile
|   411	| NOTE: make -j 16 -l 75 STRIP=
|   412	| gawk -f ./daemon-parm.awk ./daemon-parm.txt
|   413	| sed 's;\@bindir\@;/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/bin;g' <./stunnel-rsyncd.conf.in >stunnel-rsyncd.conf
|   414	| gawk -f ./mkproto.awk ./*.c ./lib/compat.c daemon-parm.h
|   415	| gawk -f ./define-from-md.awk -v hfile=default-dont-compress.h ./rsync.1.md
|   416	| gawk -f ./define-from-md.awk -v hfile=default-cvsignore.h ./rsync.1.md
|   417	| gcc  -I. -I. -I./zlib -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -O2 -pipe -DHAVE_CONFIG_H -Wall -W -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -c match.c -o match.o
|   418	| gcc  -I. -I. -I./zlib -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -O2 -pipe -DHAVE_CONFIG_H -Wall -W -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -c syscall.c -o syscall.o
|   419	| syscall.c: In function 'secure_relative_open_linux':
|   420	| syscall.c:1723:19: error: 'SYS_openat2' undeclared (first use in this function); did you mean 'SYS_openat'?
|   421	|  1723 |   dirfd = syscall(SYS_openat2, AT_FDCWD, basedir, &bhow, sizeof bhow);
|   422	|       |                   ^~~~~~~~~~~
|   423	|       |                   SYS_openat
|   424	| syscall.c:1723:19: note: each undeclared identifier is reported only once for each function it appears in
|   425	| make: *** [Makefile:76: syscall.o] Error 1
|   426	| ERROR: oe_runmake failed
|   427	| WARNING: exit code 1 from a shell command.
|   428	NOTE: recipe rsync-native-3.2.7-r0: task do_compile: Failed
|   429	ERROR: Task (virtual:native:/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/rsync/rsync_3.2.7.bb:do_compile) failed with exit code '1'
|   430	NOTE: recipe linux-libc-headers-6.6-r0: task do_unpack: Succeeded
|   431	NOTE: Tasks Summary: Attempted 394 tasks of which 381 didn't need to be rerun and 1 failed.
|   432	NOTE: The errors for this build are stored in /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/log/error-report/error_report_20260728100237.txt
|   433	You can send the errors to a reports server by running:
|   434	  send-error-report /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/log/error-report/error_report_20260728100237.txt [-s server]
|   435	NOTE: The contents of these logs will be posted in public if you use the above command with the default server. Please ensure you remove any identifying or proprietary information when prompted before sending.
|   436	
|   437	Summary: 1 task failed:
|   438	  virtual:native:/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/rsync/rsync_3.2.7.bb:do_compile
|   439	    log: /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/log.do_compile.2977888
|   440	Summary: There was 1 WARNING message.
|   441	Summary: There were 2 ERROR messages, returning a non-zero exit code.

Can you look into this? My guess is the newly introduced openat2 syscall
is not compatible with debian11.

FYI, same goes for the wrynose series, I'll answer there.

Regards,
-- 
Yoann Congal
Smile ECS