Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package lact for openSUSE:Factory checked in at 2026-08-29 17:41:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/lact (Old) and /work/SRC/openSUSE:Factory/.lact.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "lact" Sat Aug 29 17:41:17 2026 rev:5 rq:1374479 version:0.10.0 Changes: -------- --- /work/SRC/openSUSE:Factory/lact/lact.changes 2026-07-01 16:39:50.639756438 +0200 +++ /work/SRC/openSUSE:Factory/.lact.new.1265/lact.changes 2026-08-29 17:42:33.259454768 +0200 @@ -1,0 +2,30 @@ +Mon Aug 24 15:29:16 UTC 2026 - Jehu Marcos Herrera Puentes <[email protected]> + +- Security fixes from SUSE security audit (bsc#1274863): + * CVE-2026-75037: Polkit authentication bypass via peer PID + spoofing/reuse (CWE-290, local root exploit via malicious + profile hooks) + Add lact-CVE-2026-75037-polkit-peer-pid-auth.patch + * CVE-2026-75038: predictable /tmp file creation in snapshot + generation (CWE-377, local DoS without protect_symlinks) + Add lact-CVE-2026-75038-snapshot-tmpfile-race.patch + +------------------------------------------------------------------- +Wed Aug 12 04:20:42 UTC 2026 - pallas wept <[email protected]> + +- Update to version 0.10.0: + * chore: prepare for release + * fix: correctly set "enable editing" in VF curve editor init (#1148) + * Translations update from Fedora Weblate (#1099) + * fix: use consistent reset/default terminlogoy (#1145) + * chore: replace SplitButton with a separate CheckButton in service setup dialog + * feat: enable autostart during the service setup (#1146) + * refactor: gpu stats section (#1132) + * fix: broken padding on nvidia fan control (#1144) + * chore: fix powerset feature compilation + * chore: improve settings apply tests +- Add polkit action for changes as root +- Rebase prevent-strip.patch +- Use config.toml from vendor tarball + +------------------------------------------------------------------- Old: ---- lact-0.9.1.tar.xz New: ---- lact-0.10.0.tar.xz lact-CVE-2026-75037-polkit-peer-pid-auth.patch lact-CVE-2026-75038-snapshot-tmpfile-race.patch ----------(New B)---------- New: profile hooks) Add lact-CVE-2026-75037-polkit-peer-pid-auth.patch * CVE-2026-75038: predictable /tmp file creation in snapshot New: generation (CWE-377, local DoS without protect_symlinks) Add lact-CVE-2026-75038-snapshot-tmpfile-race.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ lact.spec ++++++ --- /var/tmp/diff_new_pack.JBrhbq/_old 2026-08-29 17:42:40.653715725 +0200 +++ /var/tmp/diff_new_pack.JBrhbq/_new 2026-08-29 17:42:40.655715795 +0200 @@ -29,7 +29,7 @@ %endif Name: %{pname} -Version: 0.9.1 +Version: 0.10.0 Release: 0 Summary: Linux GPU Configuration And Monitoring Tool License: MIT @@ -68,6 +68,12 @@ # PATCH-FIX-OPENSUSE fix-clang-args.patch -- Fix clang args for bindgen to find vendored DRM headers. Patch1: fix-clang-args.patch +# PATCH-FIX-UPSTREAM lact-CVE-2026-75037-polkit-peer-pid-auth.patch bsc#1274863 CVE-2026-75037 -- Fixes Polkit auth bypass via PID reuse/spoofing (CWE-290) +Patch2: lact-CVE-2026-75037-polkit-peer-pid-auth.patch + +# PATCH-FIX-UPSTREAM lact-CVE-2026-75038-snapshot-tmpfile-race.patch bsc#1274863 CVE-2026-75038 -- Fixes predictable /tmp file creation (CWE-377) +Patch3: lact-CVE-2026-75038-snapshot-tmpfile-race.patch + # Rust is only available on these architectures ExclusiveArch: x86_64 aarch64 @@ -81,6 +87,7 @@ BuildRequires: pkgconfig(libdrm) BuildRequires: pkgconfig(vulkan) BuildRequires: pkgconfig(OpenCL) +BuildRequires: pkgconfig(polkit-agent-1) BuildRequires: pkgconfig(libdisplay-info) BuildRequires: clinfo BuildRequires: systemd-rpm-macros @@ -139,16 +146,6 @@ # Unpack the source and apply any necessary patches or modifications %autosetup -p1 -n %{sname}-%{version} -a1 -# Configure cargo to use vendored dependencies -mkdir -p .cargo -cat > .cargo/config.toml <<EOF -[source.crates-io] -replace-with = "vendored-sources" - -[source.vendored-sources] -directory = "vendor" -EOF - %build # Copy the post-installation/uninstallation guides cp %_sourcedir/*install-guide.txt . @@ -217,6 +214,9 @@ %{_datadir}/icons/hicolor/*/apps/io.github.ilya_zlobintsev.LACT.* %{_datadir}/metainfo/*.xml +# Polkit policy +%{_datadir}/polkit-1/actions/io.github.ilya_zlobintsev.LACT.policy + # LACT Configuration file %dir %attr(0755,root,lact) %{_sysconfdir}/lact %config(noreplace) %attr(0644,root,lact) %{_sysconfdir}/lact/config.yaml ++++++ _service ++++++ --- /var/tmp/diff_new_pack.JBrhbq/_old 2026-08-29 17:42:40.699717348 +0200 +++ /var/tmp/diff_new_pack.JBrhbq/_new 2026-08-29 17:42:40.702717454 +0200 @@ -3,7 +3,7 @@ <service name="tar_scm" mode="manual"> <param name="scm">git</param> <param name="url">https://github.com/ilya-zlobintsev/LACT</param> - <param name="revision">v0.9.1</param> + <param name="revision">v0.10.0</param> <param name="match-tag">v[0-9]*</param> <param name="filename">lact</param> <param name="changesgenerate">enable</param> @@ -12,14 +12,14 @@ <param name="versionrewrite-replacement">\1</param> </service> + <!-- Update the version in spec file --> + <service name="set_version" mode="manual"/> + <service name="recompress" mode="manual"> <param name="file">*.tar</param> <param name="compression">xz</param> </service> - <!-- Update the version in spec file --> - <service name="set_version" mode="manual"/> - <!-- Generate Rust vendor tarball --> <service name="cargo_vendor" mode="manual"> <param name="src">lact-*.tar.xz</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.JBrhbq/_old 2026-08-29 17:42:40.721718124 +0200 +++ /var/tmp/diff_new_pack.JBrhbq/_new 2026-08-29 17:42:40.724718230 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/ilya-zlobintsev/LACT</param> - <param name="changesrevision">6a7d0960eed5f05cab7b6f1a01d87dbf31d425d1</param></service></servicedata> + <param name="changesrevision">2aa6d0d770546fb36dd8714801c373060e4dd912</param></service></servicedata> (No newline at EOF) ++++++ lact-0.9.1.tar.xz -> lact-0.10.0.tar.xz ++++++ ++++ 17541 lines of diff (skipped) ++++++ lact-CVE-2026-75037-polkit-peer-pid-auth.patch ++++++ >From d0478fe42c2219454e272f96b1cbd29ab37ee566 Mon Sep 17 00:00:00 2001 From: Ilya Zlobintsev <[email protected]> Date: Wed, 19 Aug 2026 17:42:08 +0300 Subject: [PATCH] fix: pass uid from unix socket creds instead of inferring from pid in polkit checks --- lact-daemon/src/server.rs | 7 +++++-- lact-daemon/src/server/handler.rs | 5 +++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lact-daemon/src/server.rs b/lact-daemon/src/server.rs index dd0bd3854..29676cc8a 100644 --- a/lact-daemon/src/server.rs +++ b/lact-daemon/src/server.rs @@ -78,8 +78,10 @@ impl Server { let client_credentials = getsockopt(&stream, PeerCredentials) .inspect_err(|err| warn!("could not get client credentials: {err:#}")) .ok(); + let ctx = ClientContext { - client_pid: client_credentials.map(|creds| creds.pid().cast_unsigned()), + pid: client_credentials.map(|creds| creds.pid().cast_unsigned()), + uid: client_credentials.map(|creds| creds.uid()), }; let handler = unix_handler.clone(); tokio::task::spawn_local(async move { @@ -125,7 +127,8 @@ impl Server { #[derive(Clone, Copy, Debug, Default)] pub(crate) struct ClientContext { - pub client_pid: Option<u32>, + pub pid: Option<u32>, + pub uid: Option<u32>, } #[instrument(level = "debug", skip(stream, handler))] diff --git a/lact-daemon/src/server/handler.rs b/lact-daemon/src/server/handler.rs index 1ce00a152..8a9c79050 100644 --- a/lact-daemon/src/server/handler.rs +++ b/lact-daemon/src/server/handler.rs @@ -1282,8 +1282,9 @@ impl<'a> Handler { .as_ref() .context("Polkit not available, cannot ask for authorization")?; - let pid = ctx.client_pid.context("No client PID available")?; - let subject = policykit1::Subject::new_for_owner(pid, None, None)?; + let pid = ctx.pid.context("No client PID available")?; + let uid = ctx.uid.context("No client UID available")?; + let subject = policykit1::Subject::new_for_owner(pid, None, Some(uid))?; let result = polkit_proxy .check_authorization( &subject, ++++++ lact-CVE-2026-75038-snapshot-tmpfile-race.patch ++++++ >From 2aae677d0e94bd2824cbe3dab6dc9ac795cae013 Mon Sep 17 00:00:00 2001 From: Ilya Zlobintsev <[email protected]> Date: Wed, 19 Aug 2026 17:54:05 +0300 Subject: [PATCH] fix: only create new file when writing debug snapshot --- lact-daemon/src/server/handler.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lact-daemon/src/server/handler.rs b/lact-daemon/src/server/handler.rs index 8a9c79050..fdeaa1001 100644 --- a/lact-daemon/src/server/handler.rs +++ b/lact-daemon/src/server/handler.rs @@ -719,7 +719,7 @@ impl<'a> Handler { let datetime = jiff::Zoned::now().strftime("%Y%m%d-%H%M%S"); let out_path = format!("/tmp/LACT-v{DAEMON_VERSION}-snapshot-{datetime}.tar.gz"); - let out_file = File::create(&out_path) + let out_file = File::create_new(&out_path) .with_context(|| "Could not create output file at {out_path}")?; let out_writer = gzip::Encoder::new(BufWriter::new(out_file)) .context("Could not create GZIP encoder")?; ++++++ prevent-strip.patch ++++++ --- /var/tmp/diff_new_pack.JBrhbq/_old 2026-08-29 17:42:42.095766617 +0200 +++ /var/tmp/diff_new_pack.JBrhbq/_new 2026-08-29 17:42:42.099766758 +0200 @@ -1,9 +1,9 @@ Index: lact-0.9.1/Cargo.toml =================================================================== ---- lact-0.9.1.orig/Cargo.toml -+++ lact-0.9.1/Cargo.toml +--- lact-0.10.0.orig/Cargo.toml ++++ lact-0.10.0/Cargo.toml @@ -41,9 +41,7 @@ - rust-embed = { version = "8.11.0", features = ["debug-embed"] } + zbus = { version = "5.14.0", default-features = false, features = ["tokio"] } [profile.release] -strip = "symbols" ++++++ vendor.tar.xz ++++++ /work/SRC/openSUSE:Factory/lact/vendor.tar.xz /work/SRC/openSUSE:Factory/.lact.new.1265/vendor.tar.xz differ: char 15, line 1
