* [PATCH 3/6] attr: Update to version 2.6.0
2026-07-04 15:38 [PATCH 1/6] acl: Update to version 2.4.0 Adolf Belka
2026-07-04 15:38 ` [PATCH 2/6] core204: Ship acl Adolf Belka
@ 2026-07-04 15:38 ` Adolf Belka
2026-07-04 15:38 ` [PATCH 4/6] core203: Ship attr Adolf Belka
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Adolf Belka @ 2026-07-04 15:38 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 2.5.2 to 2.6.0
- Update rootfile
- 1 CVE fix
- Changelog
2.6.0
- Security fixes for CVE-2026-54371:
- Fix symlink traversal privilege escalation vulnerability in getfattr and
setfattr
- Harden getfattr to properly handle symlinks with -h/--no-dereference option
- Harden setfattr --restore with new -P/--physical option for safe restoring
- Add warnings for potentially unsafe restore operations (can be disabled
with the --disable-unsafe-restore-warnings configure option)
- New extended attribute system call support:
- Add wrappers for new xattrat() system calls (getxattrat, setxattrat,
listxattrat, removexattrat) introduced in kernel 6.13
- Add backwards compatibility layer for older systems without xattrat()
support
- Add openat2() syscall wrapper support for enhanced security (kernel 5.6+)
- Code improvements and fixes:
- Add new walk_tree helper, remove old implementation
- Fix multiple memory management issues in attr_copy_* functions
- Fix race conditions in listxattr and lgetxattr operations
- Fix buffer overflow and use-after-free bugs in setfattr --restore
- Remove dead code and improve compiler warning handling
- Add visibility attribute support for better library symbol management
- Build system and compatibility:
- Improve test suite for SELinux environments
- Add License variable to pkg-config file
- Fix various compiler warnings with -Wall, -Wextra, -Wmissing-prototypes
- Add missing header includes and mark local functions static
- Translation updates:
- Update the German translation
- Configuration updates:
- Remove obsolete system.nfs4acl entry from xattr.conf
- Add configure option --disable-unsafe-restore-warnings
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/attr | 3 +--
lfs/attr | 6 +++---
2 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/config/rootfiles/common/attr b/config/rootfiles/common/attr
index 73f8e9500..4307e1dd0 100644
--- a/config/rootfiles/common/attr
+++ b/config/rootfiles/common/attr
@@ -1,7 +1,6 @@
usr/bin/attr
usr/bin/getfattr
usr/bin/setfattr
-#usr/etc
#usr/etc/xattr.conf
#usr/include/attr
#usr/include/attr/attributes.h
@@ -11,7 +10,7 @@ usr/bin/setfattr
#usr/lib/libattr.la
#usr/lib/libattr.so
usr/lib/libattr.so.1
-usr/lib/libattr.so.1.1.2502
+usr/lib/libattr.so.1.1.2600
#usr/lib/pkgconfig/libattr.pc
#usr/share/doc/attr
#usr/share/doc/attr/CHANGES
diff --git a/lfs/attr b/lfs/attr
index 8a85b109e..2c005d7b3 100644
--- a/lfs/attr
+++ b/lfs/attr
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2024 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.5.2
+VER = 2.6.0
THISAPP = attr-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = cf26348c3a96622e4f62493ac7655e14b6580d36a5784ef4c3750178856eceabd33192fd58516be21c8aa1ad41d56c024ad440ef4bc922bed8f7a4984ea16c63
+$(DL_FILE)_BLAKE2 = 10e36188a11344e1cc1dd7d0bcc8724a62bfc945799755cff6a54fff6c6d7e306596628fca4f882e84a156cf2ea790a1a8411599819de4e60b0a21dc3b400d64
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 5/6] tar: Avoid acl_ prefixes for functions
2026-07-04 15:38 [PATCH 1/6] acl: Update to version 2.4.0 Adolf Belka
` (2 preceding siblings ...)
2026-07-04 15:38 ` [PATCH 4/6] core203: Ship attr Adolf Belka
@ 2026-07-04 15:38 ` Adolf Belka
2026-07-04 15:38 ` [PATCH 6/6] core204: Ship tar Adolf Belka
4 siblings, 0 replies; 6+ messages in thread
From: Adolf Belka @ 2026-07-04 15:38 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- The latest updates for acl and attr created some functions that ended up duplicating
ones that tar had created. This patch has been implemented to make these functions
start with tar_ so that they are specific to the tar project.
- No change to the rootfile
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/tar | 5 +-
...1.35_Avoid_acl__prefix_for_functions.patch | 83 +++++++++++++++++++
2 files changed, 85 insertions(+), 3 deletions(-)
create mode 100644 src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch
diff --git a/lfs/tar b/lfs/tar
index 745b658e7..b4e8ff656 100644
--- a/lfs/tar
+++ b/lfs/tar
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2023 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -80,9 +80,8 @@ $(subst %,%_BLAKE2,$(objects)) :
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
-
cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/tar/01_extract.c.patch
-
+ cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch
cd $(DIR_APP) && ./configure $(EXTRA_CONFIG) FORCE_UNSAFE_CONFIGURE=1
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
diff --git a/src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch b/src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch
new file mode 100644
index 000000000..66788ce77
--- /dev/null
+++ b/src/patches/tar/tar-1.35_Avoid_acl__prefix_for_functions.patch
@@ -0,0 +1,83 @@
+--- tar-1.35/src/xattrs.c.orig 2023-07-10 09:29:17.000000000 +0200
++++ tar-1.35/src/xattrs.c 2026-07-04 13:16:07.585006365 +0200
+@@ -139,13 +139,13 @@
+ #ifdef HAVE_POSIX_ACLS
+
+ /* acl-at wrappers, TODO: move to gnulib in future? */
+-static acl_t acl_get_file_at (int, const char *, acl_type_t);
+-static int acl_set_file_at (int, const char *, acl_type_t, acl_t);
++static acl_t tar_acl_get_file_at (int, const char *, acl_type_t);
++static int tar_acl_set_file_at (int, const char *, acl_type_t, acl_t);
+ static int file_has_acl_at (int, char const *, struct stat const *);
+-static int acl_delete_def_file_at (int, char const *);
++static int tar_acl_delete_def_file_at (int, char const *);
+
+-/* acl_get_file_at */
+-#define AT_FUNC_NAME acl_get_file_at
++/* tar_acl_get_file_at */
++#define AT_FUNC_NAME tar_acl_get_file_at
+ #define AT_FUNC_RESULT acl_t
+ #define AT_FUNC_FAIL (acl_t)NULL
+ #define AT_FUNC_F1 acl_get_file
+@@ -159,8 +159,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+
+-/* acl_set_file_at */
+-#define AT_FUNC_NAME acl_set_file_at
++/* tar_acl_set_file_at */
++#define AT_FUNC_NAME tar_acl_set_file_at
+ #define AT_FUNC_F1 acl_set_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS , acl_type_t type, acl_t acl
+ #define AT_FUNC_POST_FILE_ARGS , type, acl
+@@ -170,8 +170,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+
+-/* acl_delete_def_file_at */
+-#define AT_FUNC_NAME acl_delete_def_file_at
++/* tar_acl_delete_def_file_at */
++#define AT_FUNC_NAME tar_acl_delete_def_file_at
+ #define AT_FUNC_F1 acl_delete_def_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS
+ #define AT_FUNC_POST_FILE_ARGS
+@@ -299,10 +299,10 @@
+ /* No "default" IEEE 1003.1e ACL set for directory. At this moment,
+ FILE_NAME may already have inherited default acls from parent
+ directory; clean them up. */
+- if (acl_delete_def_file_at (chdir_fd, file_name))
++ if (tar_acl_delete_def_file_at (chdir_fd, file_name))
+ WARNOPT (WARN_XATTR_WRITE,
+ (0, errno,
+- _("acl_delete_def_file_at: Cannot drop default POSIX ACLs "
++ _("tar_acl_delete_def_file_at: Cannot drop default POSIX ACLs "
+ "for file '%s'"),
+ file_name));
+ return;
+@@ -316,11 +316,11 @@
+ return;
+ }
+
+- if (acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
++ if (tar_acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
+ /* warn even if filesystem does not support acls */
+ WARNOPT (WARN_XATTR_WRITE,
+ (0, errno,
+- _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
++ _ ("tar_acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
+ file_name));
+
+ acl_free (acl);
+@@ -357,10 +357,10 @@
+ char *val = NULL;
+ acl_t acl;
+
+- if (!(acl = acl_get_file_at (parentfd, file_name, type)))
++ if (!(acl = tar_acl_get_file_at (parentfd, file_name, type)))
+ {
+ if (errno != ENOTSUP)
+- call_arg_warn ("acl_get_file_at", file_name);
++ call_arg_warn ("tar_acl_get_file_at", file_name);
+ return;
+ }
+
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread