Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package suricata for openSUSE:Factory checked in at 2026-07-07 21:06:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/suricata (Old) and /work/SRC/openSUSE:Factory/.suricata.new.1982 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "suricata" Tue Jul 7 21:06:05 2026 rev:6 rq:1364295 version:8.0.5 Changes: -------- --- /work/SRC/openSUSE:Factory/suricata/suricata.changes 2026-05-28 17:29:32.762193396 +0200 +++ /work/SRC/openSUSE:Factory/.suricata.new.1982/suricata.changes 2026-07-07 21:08:33.265400517 +0200 @@ -1,0 +2,5 @@ +Mon Jul 6 12:38:00 UTC 2026 - Eyad Issa <[email protected]> + +- Fix TOCTOU issue in %post (bsc#1270362, CVE-2026-59674) + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ suricata.spec ++++++ --- /var/tmp/diff_new_pack.JsqEGe/_old 2026-07-07 21:08:34.053427752 +0200 +++ /var/tmp/diff_new_pack.JsqEGe/_new 2026-07-07 21:08:34.057427891 +0200 @@ -224,11 +224,11 @@ %fillup_only # Migrate existing logs and libs to the new user if they exist if [ $1 -ge 1 ]; then + # Notify the user about the security hardening only once and migrate files + if [ ! -f %{_localstatedir}/lib/suricata.migrated-to-nonroot ]; then chown -R suricata:suricata %{_localstatedir}/log/suricata || : chown -R suricata:suricata %{_localstatedir}/lib/suricata || : - # Notify the user about the security hardening only once - if [ ! -f %{_localstatedir}/lib/suricata/.migrated-to-nonroot ]; then mkdir -p %{_localstatedir}/adm/update-messages cat > %{_localstatedir}/adm/update-messages/%{name}-%{version}-%{release} << EOF Suricata has been hardened and now runs as a non-privileged 'suricata' user. @@ -238,8 +238,7 @@ If you have custom rule files or configurations outside these directories, please ensure they are readable by the 'suricata' user. EOF - touch %{_localstatedir}/lib/suricata/.migrated-to-nonroot - chown suricata:suricata %{_localstatedir}/lib/suricata/.migrated-to-nonroot || : + touch %{_localstatedir}/lib/suricata.migrated-to-nonroot fi fi suricata-update || : @@ -276,7 +275,7 @@ %{_sysusersdir}/%{name}-user.conf %config(noreplace) %{_sysconfdir}/logrotate.d/%{name} %{_fillupdir}/sysconfig.%{name} -%ghost %{_localstatedir}/lib/suricata/.migrated-to-nonroot +%ghost %{_localstatedir}/lib/suricata.migrated-to-nonroot %ghost %{_localstatedir}/adm/update-messages/%{name}-%{version}-%{release} %files -n libsuricata%{soname}
