Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: [email protected], Andy Pugh <[email protected]>, Hannes Diethelm <[email protected]> Control: affects -1 + src:linuxcnc User: [email protected] Usertags: pu
The LinuxCNC project and maintainers would like to address a security related issue in the oldstable edition of linuxcnc in Debian. The issue at hand is reported as #1140943 and a fix was recently included in an upstream release and included in yesterdays unstable release. I am not sure when the issue was released, but it will be good to have it fixed in unstable. It will affect any LinuxCNC user who is also not root on the machine used to control a machine, which the upstream developers suspect is a fairly rare occation, but nevertheless it is a use case to protect. The impact on machine owner granting LinuxCNC user access to non-privileged users is that the local user can become root with some craftwork. The normal path through the relevant code is tested by the normal self testing during build. The fix is fairly trivial, and the risc associated with upgrading is minimal. [ Checklist ] [*] *all* changes are documented in the d/changelog [*] I reviewed all changes and I approve them [*] attach debdiff against the package in (old)stable [*] the issue is verified as fixed in unstable This is the complete set of changes. I will upload them to debian shortly, as I believe this change is non-controversial and expect it to be accepted unchanged into the oldstable update. diff --git a/debian/changelog b/debian/changelog index b818f54..f7846ac 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,16 @@ +linuxcnc (2.9.0~pre1+git20230208.f1270d6ed7-1+deb12u2) bookworm; urgency=medium + + * Team upload. + + * Told gbp to use xz compression, to match already uploaded + orig.tar.gz. + * Added 0010-sanitize-hal-paths.patch to sanitize name for module in + rtapi_app (Closes: #1140943). + * Added a small patch to fix missing gettimeofday() declaration with + newer GCC/glibc version. + + -- Petter Reinholdtsen <[email protected]> Sun, 28 Jun 2026 23:34:48 +0200 + linuxcnc (2.9.0~pre1+git20230208.f1270d6ed7-1+deb12u1) bookworm; urgency=medium [ CMorley ] diff --git a/debian/gbp.conf b/debian/gbp.conf index 3796750..97c6480 100644 --- a/debian/gbp.conf +++ b/debian/gbp.conf @@ -1,3 +1,4 @@ [DEFAULT] debian-branch = debian/bookworm upstream-branch = upstream +compression = xz diff --git a/debian/patches/0010-sanitize-hal-paths.patch b/debian/patches/0010-sanitize-hal-paths.patch new file mode 100644 index 0000000..60f86d8 --- /dev/null +++ b/debian/patches/0010-sanitize-hal-paths.patch @@ -0,0 +1,23 @@ +Description: Fix rtapi_app: Sanitize name for module +From: Hannes Diethelm <[email protected]> +Origin: https://github.com/LinuxCNC/linuxcnc/commit/00d534c87464a3ed446656998aa02b8abc74b391 +Reviewed-by: Petter Reinholdtsen <[email protected]> +Forwarded: not-needed +Last-Update: 2026-06-28 + +diff --git a/src/rtapi/uspace_rtapi_app.cc b/src/rtapi/uspace_rtapi_app.cc +index 6e6298831b..8e600cc4b7 100644 +--- a/src/rtapi/uspace_rtapi_app.cc ++++ b/src/rtapi/uspace_rtapi_app.cc +@@ -274,6 +274,11 @@ static int do_comp_args(void *module, vector<string> args) { + static int do_load_cmd(string name, vector<string> args) { + void *w = modules[name]; + if(w == NULL) { ++ //Sanitize the name ++ if(name.find("/") != std::string::npos || name.find("..") != std::string::npos){ ++ rtapi_print_msg(RTAPI_MSG_ERR, "%s: Not allowed as module name. Slashes or with \"..\" (even /a..b/) are not allowed.\n", name.c_str()); ++ return -1; ++ } + char what[LINELEN+1]; + snprintf(what, LINELEN, "%s/%s.so", EMC2_RTLIB_DIR, name.c_str()); + void *module = modules[name] = dlopen(what, RTLD_GLOBAL | RTLD_NOW); diff --git a/debian/patches/1000-gettimeofday-include.patch b/debian/patches/1000-gettimeofday-include.patch new file mode 100644 index 0000000..db72943 --- /dev/null +++ b/debian/patches/1000-gettimeofday-include.patch @@ -0,0 +1,19 @@ +Description: Add missing include for gettimeofday() + This get the source building with more recent gcc/glibc too +From: Petter Reinholdtsen <[email protected]> +Reviewed-by: Petter Reinholdtsen <[email protected]> +Forwarded: not-needed +Last-Update: 2026-06-28 + +diff --git a/src/emc/rs274ngc/gcodemodule.cc b/src/emc/rs274ngc/gcodemodule.cc +index ff222e7..88b08b7 100644 +--- a/src/emc/rs274ngc/gcodemodule.cc ++++ b/src/emc/rs274ngc/gcodemodule.cc +@@ -16,6 +16,7 @@ + // along with this program; if not, write to the Free Software + // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + ++#include <sys/time.h> + #include <Python.h> + #include <structmember.h> + diff --git a/debian/patches/series b/debian/patches/series index f427620..39265bb 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,4 @@ #0010-arm-hppa.patch +0010-sanitize-hal-paths.patch 0020-mdi-fix-unwanted-movement.patch +1000-gettimeofday-include.patch -- Happy hacking Petter Reinholdtsen
