fix(cve): CVE-2026-59677 - sandbox/seunshare: fix killall() realloc and missing type comparison

debian/changelog

@@ -1,3 +1,15 @@
+selinux-python (3.5-1deepin2) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-59676
+
+ -- deepin-ci-robot <packages@deepin.org>  Mon, 27 Jul 2026 10:19:03 +0800
+
+selinux-python (3.5-1deepin1) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-59677
+
+ -- deepin-ci-robot <packages@deepin.org>  Mon, 27 Jul 2026 00:06:45 +0800
+
 selinux-python (3.5-1) unstable; urgency=medium
 
   * New upstream release

debian/patches/CVE-2026-59676.patch

@@ -0,0 +1,51 @@
+Description: CVE-2026-59676 - 安全修复
+Author: Stephen Smalley <stephen.smalley.work@gmail.com>
+Origin: https://github.com/SELinuxProject/selinux/commit/adef1aa562c107f1d0181bd21cfe0dfb3231b9b0
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-59676
+Last-Update: Fri, 17 Jul 2026 14:34:21 -0400
+---
+Index: selinux-python/sandbox/seunshare.c
+===================================================================
+--- selinux-python.orig/sandbox/seunshare.c
++++ selinux-python/sandbox/seunshare.c
+@@ -398,26 +398,29 @@ static int cleanup_tmpdir(const char *tm
+ 		free(cmdbuf); cmdbuf = NULL;
+ 	}
+
+-	/* remove files from the runtime temporary directory */
++	/* Remove files under the tmpdir as the user */
++	if ((uid_t)setfsuid(pwd->pw_uid) != 0) {
++		fprintf(stderr,
++			_("unable to switch to user for removing files under tmp dir\n"));
++		return ++rc;
++	}
+ 	if (asprintf(&cmdbuf, "/bin/rm -r '%s/' 2>/dev/null", tmpdir) == -1) {
+ 		fprintf(stderr, _("Out of memory\n"));
+ 		cmdbuf = NULL;
+ 		rc++;
+ 	}
+-	/* this may fail if there's root-owned file left in the runtime tmpdir */
+ 	if (cmdbuf && spawn_command(cmdbuf, pwd->pw_uid) != 0) rc++;
+ 	free(cmdbuf); cmdbuf = NULL;
+
+-	/* remove runtime temporary directory */
+-	if ((uid_t)setfsuid(0) != 0) {
+-		/* setfsuid does not return error, but this check makes code checkers happy */
+-		rc++;
++	/* Then remove the tmpdir itself as root */
++	if ((uid_t)setfsuid(0) != pwd->pw_uid) {
++		fprintf(stderr,
++			_("unable to switch back to root to delete tmpdir\n"));
++		return ++rc;
+ 	}
+-
+-	if (pwd->pw_uid != 0 && rmdir(tmpdir) == -1)
+-		fprintf(stderr, _("Failed to remove directory %s: %s\n"), tmpdir, strerror(errno));
+-	if ((uid_t)setfsuid(pwd->pw_uid) != 0) {
+-		fprintf(stderr, _("unable to switch back to user after clearing tmp dir\n"));
++	if (rmdir(tmpdir) < 0) {
++		fprintf(stderr, _("Failed to remove directory %s: %m\n"),
++			tmpdir);
+ 		rc++;
+ 	}
+

debian/patches/CVE-2026-59677.patch

@@ -0,0 +1,75 @@
+Description: CVE-2026-59677 - 安全修复
+Author: Stephen Smalley <stephen.smalley.work@gmail.com>
+Origin: https://github.com/SELinuxProject/selinux/commit/8b1ab2d13c1f25c4f3d779d89ffe8da165d2f0ad
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-59677
+Last-Update: 2026-05-13 12:21:47 -0400
+---
+diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c
+index 1d38ea9..dd248d2 100644
+--- a/sandbox/seunshare.c
++++ b/sandbox/seunshare.c
+@@ -555,8 +555,8 @@ killall (const char *execcon)
+ 	char *scon;
+ 	struct dirent *de;
+ 	pid_t *pid_table, pid, self;
+-	int i;
+-	int pids, max_pids;
++	unsigned int i;
++	unsigned int pids, max_pids;
+ 	int running = 0;
+ 	self = getpid();
+ 	if (!(dir = opendir(PROC_BASE))) {
+@@ -571,21 +571,35 @@ killall (const char *execcon)
+ 	pids = 0;
+ 	context_t con;
+ 	con = context_new(execcon);
+-	const char *mcs = context_range_get(con);
+-	printf("mcs=%s\n", mcs);
++	const char *const mcs = context_range_get(con);
++	const char *const type = context_type_get(con);
++	if (!mcs || !type) {
++		context_free(con);
++		free(pid_table);
++		(void)closedir(dir);
++		return -1;
++	}
++	if (verbose)
++		printf("mcs=%s type=%s\n", mcs, type);
+ 	while ((de = readdir (dir)) != NULL) {
+ 		if (!(pid = (pid_t)atoi(de->d_name)) || pid == self)
+ 			continue;
+
+ 		if (pids == max_pids) {
+-			pid_t *new_pid_table = realloc(pid_table, 2*pids*sizeof(pid_t));
++			max_pids *= 2;
++			if (max_pids <= pids)
++			{
++				free(pid_table);
++				(void)closedir(dir);
++				return -1;
++			}
++			pid_t *new_pid_table = reallocarray(pid_table, max_pids, sizeof(pid_t));
+ 			if (!new_pid_table) {
+ 				free(pid_table);
+ 				(void)closedir(dir);
+ 				return -1;
+ 			}
+ 			pid_table = new_pid_table;
+-			max_pids *= 2;
+ 		}
+ 		pid_table[pids++] = pid;
+ 	}
+@@ -598,8 +612,12 @@ killall (const char *execcon)
+ 		if (getpidcon(id, &scon) == 0) {
+
+ 			context_t pidcon = context_new(scon);
++			const char *const pmcs = context_range_get(pidcon);
++			const char *const ptype = context_type_get(pidcon);
++
+ 			/* Attempt to kill remaining processes */
+-			if (strcmp(context_range_get(pidcon), mcs) == 0)
++			if (pmcs && ptype && !strcmp(pmcs, mcs) &&
++				!strcmp(ptype, type))
+ 				kill(id, SIGKILL);
+
+ 			context_free(pidcon);

debian/patches/series

@@ -1,2 +1,4 @@
 0023-sepolicy-help-path.patch
 sandbox-x-window-manager.patch
+CVE-2026-59677.patch
+CVE-2026-59676.patch