On Fri Jun 12, 2026 at 2:13 PM CEST, Ashishkumar Parmar X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > From: Ashishkumar Parmar <[email protected]> > > Pick the upstream backport [1] for CVE-2026-29518 as mentioned in [3], > where a non-chrooted rsync daemon could be exposed to a parent path > TOCTOU race that allowed file access outside the module. > > Also include the dependent upstream fix that followed the CVE fix: > - CVE-2026-29518_p2.patch [2] secures sender read-path opens by > opening files from the module root, closing the same race on the > read side. > > [1] > https://github.com/RsyncProject/rsync/commit/1a5ad81add1004354a3d8ba841b94ffe19cd2505 > [2] > https://github.com/RsyncProject/rsync/commit/99b36291d06ca66229942c7a525a1f5566f10c85 > [3] https://www.cve.org/CVERecord?id=CVE-2026-29518 > > Signed-off-by: Ashishkumar Parmar <[email protected]> > --- > .../rsync/files/CVE-2026-29518_p1.patch | 330 ++++++++++++++++++ > .../rsync/files/CVE-2026-29518_p2.patch | 73 ++++ > meta/recipes-devtools/rsync/rsync_3.2.7.bb | 2 + > 3 files changed, 405 insertions(+) > create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch > create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch
Hello, Something in this series made the test fail on debian 11: https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/4395/steps/15/logs/stdio | 399 ERROR: rsync-native-3.2.7-r0 do_compile: oe_runmake failed | 400 ERROR: rsync-native-3.2.7-r0 do_compile: ExecutionError('/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/run.do_compile.2977888', 1, None, None) | 401 NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_patch: Succeeded | 402 NOTE: Running task 392 of 412 (/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/gcc/gcc-source_13.4.bb:do_preconfigure) | 403 NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_preconfigure: Started | 404 NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_preconfigure: Succeeded | 405 ERROR: Logfile of failure stored in: /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/log.do_compile.2977888 | 406 Log data follows: | 407 | DEBUG: Executing python function autotools_aclocals | 408 | DEBUG: SITE files ['endian-little', 'common-linux', 'common-glibc', 'bit-64', 'x86_64-linux', 'common'] | 409 | DEBUG: Python function autotools_aclocals finished | 410 | DEBUG: Executing shell function do_compile | 411 | NOTE: make -j 16 -l 75 STRIP= | 412 | gawk -f ./daemon-parm.awk ./daemon-parm.txt | 413 | sed 's;\@bindir\@;/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/bin;g' <./stunnel-rsyncd.conf.in >stunnel-rsyncd.conf | 414 | gawk -f ./mkproto.awk ./*.c ./lib/compat.c daemon-parm.h | 415 | gawk -f ./define-from-md.awk -v hfile=default-dont-compress.h ./rsync.1.md | 416 | gawk -f ./define-from-md.awk -v hfile=default-cvsignore.h ./rsync.1.md | 417 | gcc -I. -I. -I./zlib -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -O2 -pipe -DHAVE_CONFIG_H -Wall -W -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -c match.c -o match.o | 418 | gcc -I. -I. -I./zlib -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -O2 -pipe -DHAVE_CONFIG_H -Wall -W -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -c syscall.c -o syscall.o | 419 | syscall.c: In function 'secure_relative_open_linux': | 420 | syscall.c:1723:19: error: 'SYS_openat2' undeclared (first use in this function); did you mean 'SYS_openat'? | 421 | 1723 | dirfd = syscall(SYS_openat2, AT_FDCWD, basedir, &bhow, sizeof bhow); | 422 | | ^~~~~~~~~~~ | 423 | | SYS_openat | 424 | syscall.c:1723:19: note: each undeclared identifier is reported only once for each function it appears in | 425 | make: *** [Makefile:76: syscall.o] Error 1 | 426 | ERROR: oe_runmake failed | 427 | WARNING: exit code 1 from a shell command. | 428 NOTE: recipe rsync-native-3.2.7-r0: task do_compile: Failed | 429 ERROR: Task (virtual:native:/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/rsync/rsync_3.2.7.bb:do_compile) failed with exit code '1' | 430 NOTE: recipe linux-libc-headers-6.6-r0: task do_unpack: Succeeded | 431 NOTE: Tasks Summary: Attempted 394 tasks of which 381 didn't need to be rerun and 1 failed. | 432 NOTE: The errors for this build are stored in /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/log/error-report/error_report_20260728100237.txt | 433 You can send the errors to a reports server by running: | 434 send-error-report /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/log/error-report/error_report_20260728100237.txt [-s server] | 435 NOTE: The contents of these logs will be posted in public if you use the above command with the default server. Please ensure you remove any identifying or proprietary information when prompted before sending. | 436 | 437 Summary: 1 task failed: | 438 virtual:native:/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/rsync/rsync_3.2.7.bb:do_compile | 439 log: /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/log.do_compile.2977888 | 440 Summary: There was 1 WARNING message. | 441 Summary: There were 2 ERROR messages, returning a non-zero exit code. Can you look into this? My guess is the newly introduced openat2 syscall is not compatible with debian11. FYI, same goes for the wrynose series, I'll answer there. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242191): https://lists.openembedded.org/g/openembedded-core/message/242191 Mute This Topic: https://lists.openembedded.org/mt/119772227/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
