From e8612fd096b0ffb25a6148aa505f5ef864a45597 Mon Sep 17 00:00:00 2001 From: deepin-ci-robot Date: Mon, 27 Jul 2026 00:06:45 +0800 Subject: [PATCH 1/3] fix(cve): CVE-2026-59677 - sandbox/seunshare: fix killall() realloc and missing type comparison CVE: CVE-2026-59677 (medium) - The killall() realloc() can produce an integer overflow. Check and handle this correctly. The killall() logic also only compares the MCS category set when deciding whether to kill the process. We should at least also compare the type to avoid incorrectly killing an unrelated process with the same category set. Upstream: https://github.com/SELinuxProject/selinux/commit/8b1ab2d13c1f25c4f3d779d89ffe8da165d2f0ad Co-authored-by: hudeng Generated-By: qwen3.6-35b --- debian/changelog | 6 +++ debian/patches/CVE-2026-59677.patch | 75 +++++++++++++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 82 insertions(+) create mode 100644 debian/patches/CVE-2026-59677.patch diff --git a/debian/changelog b/debian/changelog index 29c7274..67012fd 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +selinux-python (3.5-1deepin1) unstable; urgency=medium + + * fix(cve): CVE-2026-59677 + + -- deepin-ci-robot Mon, 27 Jul 2026 00:06:45 +0800 + selinux-python (3.5-1) unstable; urgency=medium * New upstream release diff --git a/debian/patches/CVE-2026-59677.patch b/debian/patches/CVE-2026-59677.patch new file mode 100644 index 0000000..e84504f --- /dev/null +++ b/debian/patches/CVE-2026-59677.patch @@ -0,0 +1,75 @@ +Description: CVE-2026-59677 - 安全修复 +Author: Stephen Smalley +Origin: https://github.com/SELinuxProject/selinux/commit/8b1ab2d13c1f25c4f3d779d89ffe8da165d2f0ad +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-59677 +Last-Update: 2026-05-13 12:21:47 -0400 +--- +diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c +index 1d38ea9..dd248d2 100644 +--- a/sandbox/seunshare.c ++++ b/sandbox/seunshare.c +@@ -555,8 +555,8 @@ killall (const char *execcon) + char *scon; + struct dirent *de; + pid_t *pid_table, pid, self; +- int i; +- int pids, max_pids; ++ unsigned int i; ++ unsigned int pids, max_pids; + int running = 0; + self = getpid(); + if (!(dir = opendir(PROC_BASE))) { +@@ -571,21 +571,35 @@ killall (const char *execcon) + pids = 0; + context_t con; + con = context_new(execcon); +- const char *mcs = context_range_get(con); +- printf("mcs=%s\n", mcs); ++ const char *const mcs = context_range_get(con); ++ const char *const type = context_type_get(con); ++ if (!mcs || !type) { ++ context_free(con); ++ free(pid_table); ++ (void)closedir(dir); ++ return -1; ++ } ++ if (verbose) ++ printf("mcs=%s type=%s\n", mcs, type); + while ((de = readdir (dir)) != NULL) { + if (!(pid = (pid_t)atoi(de->d_name)) || pid == self) + continue; + + if (pids == max_pids) { +- pid_t *new_pid_table = realloc(pid_table, 2*pids*sizeof(pid_t)); ++ max_pids *= 2; ++ if (max_pids <= pids) ++ { ++ free(pid_table); ++ (void)closedir(dir); ++ return -1; ++ } ++ pid_t *new_pid_table = reallocarray(pid_table, max_pids, sizeof(pid_t)); + if (!new_pid_table) { + free(pid_table); + (void)closedir(dir); + return -1; + } + pid_table = new_pid_table; +- max_pids *= 2; + } + pid_table[pids++] = pid; + } +@@ -598,8 +612,12 @@ killall (const char *execcon) + if (getpidcon(id, &scon) == 0) { + + context_t pidcon = context_new(scon); ++ const char *const pmcs = context_range_get(pidcon); ++ const char *const ptype = context_type_get(pidcon); ++ + /* Attempt to kill remaining processes */ +- if (strcmp(context_range_get(pidcon), mcs) == 0) ++ if (pmcs && ptype && !strcmp(pmcs, mcs) && ++ !strcmp(ptype, type)) + kill(id, SIGKILL); + + context_free(pidcon); diff --git a/debian/patches/series b/debian/patches/series index 5344249..ae18cb2 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ 0023-sepolicy-help-path.patch sandbox-x-window-manager.patch +CVE-2026-59677.patch From ffafa13a7edbc18bacd5151e885786213ccba168 Mon Sep 17 00:00:00 2001 From: deepin-ci-robot Date: Mon, 27 Jul 2026 10:19:03 +0800 Subject: [PATCH 2/3] fix(cve): CVE-2026-59676 - sandbox/seunshare: remove files under tmpdir as user CVE: CVE-2026-59676 (medium) - A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files. This issue affects policycoreutils through 3.10. Upstream: https://github.com/SELinuxProject/selinux/commit/adef1aa562c107f1d0181bd21cfe0dfb3231b9b0 Co-authored-by: hudeng Generated-By: qwen3.6-35b --- debian/changelog | 6 ++++ debian/patches/CVE-2026-59676.patch | 51 +++++++++++++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 58 insertions(+) create mode 100644 debian/patches/CVE-2026-59676.patch diff --git a/debian/changelog b/debian/changelog index 67012fd..502cc51 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +selinux-python (3.5-1deepin2) unstable; urgency=medium + + * fix(cve): CVE-2026-59676 + + -- deepin-ci-robot Mon, 27 Jul 2026 10:19:03 +0800 + selinux-python (3.5-1deepin1) unstable; urgency=medium * fix(cve): CVE-2026-59677 diff --git a/debian/patches/CVE-2026-59676.patch b/debian/patches/CVE-2026-59676.patch new file mode 100644 index 0000000..f181dc4 --- /dev/null +++ b/debian/patches/CVE-2026-59676.patch @@ -0,0 +1,51 @@ +Description: CVE-2026-59676 - 安全修复 +Author: Stephen Smalley +Origin: https://github.com/SELinuxProject/selinux/commit/adef1aa562c107f1d0181bd21cfe0dfb3231b9b0 +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-59676 +Last-Update: Fri, 17 Jul 2026 14:34:21 -0400 +--- +diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c +index dd248d2..c0d100d 100644 +--- a/sandbox/seunshare.c ++++ b/sandbox/seunshare.c +@@ -398,26 +398,29 @@ static int cleanup_tmpdir(const char *tmpdir, const char *src, + free(cmdbuf); cmdbuf = NULL; + } + +- /* remove files from the runtime temporary directory */ ++ /* Remove files under the tmpdir as the user */ ++ if (setfsuid_checked(0, pwd->pw_uid) < 0) { ++ fprintf(stderr, ++ _("unable to switch to user for removing files under tmp dir\n")); ++ return ++rc; ++ } + if (asprintf(&cmdbuf, "/bin/rm -r '%s/' 2>/dev/null", tmpdir) == -1) { + fprintf(stderr, _("Out of memory\n")); + cmdbuf = NULL; + rc++; + } +- /* this may fail if there's root-owned file left in the runtime tmpdir */ + if (cmdbuf && spawn_command(cmdbuf, pwd->pw_uid) != 0) rc++; + free(cmdbuf); cmdbuf = NULL; + +- /* remove runtime temporary directory */ +- if ((uid_t)setfsuid(0) != 0) { +- /* setfsuid does not return error, but this check makes code checkers happy */ +- rc++; ++ /* Then remove the tmpdir itself as root */ ++ if (setfsuid_checked(pwd->pw_uid, 0) < 0) { ++ fprintf(stderr, ++ _("unable to switch back to root to delete tmpdir\n")); ++ return ++rc; + } +- +- if (pwd->pw_uid != 0 && rmdir(tmpdir) == -1) +- fprintf(stderr, _("Failed to remove directory %s: %s\n"), tmpdir, strerror(errno)); +- if ((uid_t)setfsuid(pwd->pw_uid) != 0) { +- fprintf(stderr, _("unable to switch back to user after clearing tmp dir\n")); ++ if (rmdir(tmpdir) < 0) { ++ fprintf(stderr, _("Failed to remove directory %s: %m\n"), ++ tmpdir); + rc++; + } + diff --git a/debian/patches/series b/debian/patches/series index ae18cb2..870cdfa 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1,4 @@ 0023-sepolicy-help-path.patch sandbox-x-window-manager.patch CVE-2026-59677.patch +CVE-2026-59676.patch From c5a74c8e5231f00d3125606d166a367db2bf2b0b Mon Sep 17 00:00:00 2001 From: hudeng Date: Mon, 27 Jul 2026 16:26:40 +0800 Subject: [PATCH 3/3] fix(CVE-2026-59676): replace setfsuid_checked with setfsuid for Deepin codebase compatibility --- debian/patches/CVE-2026-59676.patch | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/debian/patches/CVE-2026-59676.patch b/debian/patches/CVE-2026-59676.patch index f181dc4..9506d88 100644 --- a/debian/patches/CVE-2026-59676.patch +++ b/debian/patches/CVE-2026-59676.patch @@ -4,17 +4,17 @@ Origin: https://github.com/SELinuxProject/selinux/commit/adef1aa562c107f1d0181bd Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-59676 Last-Update: Fri, 17 Jul 2026 14:34:21 -0400 --- -diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c -index dd248d2..c0d100d 100644 ---- a/sandbox/seunshare.c -+++ b/sandbox/seunshare.c -@@ -398,26 +398,29 @@ static int cleanup_tmpdir(const char *tmpdir, const char *src, +Index: selinux-python/sandbox/seunshare.c +=================================================================== +--- selinux-python.orig/sandbox/seunshare.c ++++ selinux-python/sandbox/seunshare.c +@@ -398,26 +398,29 @@ static int cleanup_tmpdir(const char *tm free(cmdbuf); cmdbuf = NULL; } - /* remove files from the runtime temporary directory */ + /* Remove files under the tmpdir as the user */ -+ if (setfsuid_checked(0, pwd->pw_uid) < 0) { ++ if ((uid_t)setfsuid(pwd->pw_uid) != 0) { + fprintf(stderr, + _("unable to switch to user for removing files under tmp dir\n")); + return ++rc; @@ -33,7 +33,7 @@ index dd248d2..c0d100d 100644 - /* setfsuid does not return error, but this check makes code checkers happy */ - rc++; + /* Then remove the tmpdir itself as root */ -+ if (setfsuid_checked(pwd->pw_uid, 0) < 0) { ++ if ((uid_t)setfsuid(0) != pwd->pw_uid) { + fprintf(stderr, + _("unable to switch back to root to delete tmpdir\n")); + return ++rc;