Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gerbera for openSUSE:Factory checked in at 2026-09-23 14:36:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gerbera (Old) and /work/SRC/openSUSE:Factory/.gerbera.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gerbera" Wed Sep 23 14:36:06 2026 rev:32 rq:1379911 version:3.3.0 Changes: -------- --- /work/SRC/openSUSE:Factory/gerbera/gerbera.changes 2026-09-22 15:54:45.486050023 +0200 +++ /work/SRC/openSUSE:Factory/.gerbera.new.383539/gerbera.changes 2026-09-23 14:37:35.975937006 +0200 @@ -1,0 +2,17 @@ +Tue Sep 22 15:40:43 UTC 2026 - Paolo Stivanin <[email protected]> + +- Fix boo#1235893 (CVE-2025-23386): generate and edit the config files + in %post as the gerbera user (via runuser) instead of letting root + write into the gerbera-owned /etc/gerbera directory. The previous fix + only chowned that directory to root for the duration of %post, so + symlinks staged there before the transaction were still followed by + root. + - Add Requires(post): util-linux for runuser. + - Drop the use of sudo in %post, which was never a dependency of this + package. +- Set a restrictive umask so generated config files have mode 0640. +- Pass --home to gerbera --create-config/--create-example-config, so the + generated <home> no longer depends on the home directory of the user + running %post. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gerbera.spec ++++++ --- /var/tmp/diff_new_pack.QflFWJ/_old 2026-09-23 14:37:36.763969957 +0200 +++ /var/tmp/diff_new_pack.QflFWJ/_new 2026-09-23 14:37:36.765970041 +0200 @@ -79,6 +79,8 @@ BuildRequires: pkgconfig(zlib) Requires: diffutils Requires: logrotate +# runuser, used by %%post +Requires(post): util-linux %{?systemd_requires} %sysusers_requires @@ -188,25 +190,31 @@ %post %service_add_post %{name}.service -chown -R root:root %{_sysconfdir}/%{name} +# Fix boo#1235893 (CVE-2025-23386): %{_sysconfdir}/%{name} is owned by the +# unprivileged gerbera user, so root must never create or edit files in there: +# a symlink staged in that directory would be followed. Generate and edit the +# configuration as the gerbera user instead. +# -h (and no -R) only repairs the ownership left behind by pre-fix versions of +# this package, without following symlinks or descending into the directory. +chown -h gerbera:gerbera %{_sysconfdir}/%{name}/*.xml 2>/dev/null || : +runuser -u gerbera -- /bin/sh -c ' +umask 027 # only do on install if [ "$1" -eq 1 ]; then echo "o Create config.xml..." || : - gerbera --create-config | sudo tee %{_sysconfdir}/gerbera/config.xml || : - sed -i -e 's|<home>/root/</home>|<home>%{_sysconfdir}/gerbera</home>|g' %{_sysconfdir}/gerbera/config.xml || : - sed -i -e 's|<database-file>gerbera.db</database-file>|<database-file>%{_localstatedir}/lib/gerbera/gerbera.db</database-file>|g' %{_sysconfdir}/gerbera/config.xml || : + gerbera --home %{_sysconfdir}/gerbera --create-config > %{_sysconfdir}/gerbera/config.xml || : + sed -i -e "s|<database-file>gerbera.db</database-file>|<database-file>%{_localstatedir}/lib/gerbera/gerbera.db</database-file>|g" %{_sysconfdir}/gerbera/config.xml || : fi # only do on upgrade if [ "$1" -gt 1 ]; then echo "o Create config-diff.xml from own config to new config..." || : - gerbera --create-config | sudo tee %{_sysconfdir}/gerbera/config-new.xml || : - sed -i -e 's|<home>/root/</home>|<home>%{_sysconfdir}/gerbera</home>|g' %{_sysconfdir}/gerbera/config-new.xml || : - sed -i -e 's|<database-file>gerbera.db</database-file>|<database-file>%{_localstatedir}/lib/gerbera/gerbera.db</database-file>|g' %{_sysconfdir}/gerbera/config-new.xml || : + gerbera --home %{_sysconfdir}/gerbera --create-config > %{_sysconfdir}/gerbera/config-new.xml || : + sed -i -e "s|<database-file>gerbera.db</database-file>|<database-file>%{_localstatedir}/lib/gerbera/gerbera.db</database-file>|g" %{_sysconfdir}/gerbera/config-new.xml || : diff %{_sysconfdir}/gerbera/config.xml %{_sysconfdir}/gerbera/config-new.xml > %{_sysconfdir}/gerbera/config-diff.xml || : fi echo "o Create new config-example.xml with almost all options..." || : -gerbera --create-example-config | sudo tee %{_sysconfdir}/gerbera/config-example.xml || : -chown -R gerbera:gerbera %{_sysconfdir}/%{name} +gerbera --home %{_sysconfdir}/gerbera --create-example-config > %{_sysconfdir}/gerbera/config-example.xml || : +' sh "$1" || echo "gerbera: could not generate the configuration as user gerbera" >&2 %preun %service_del_preun %{name}.service
