Hi Yoann, Thanks for reporting this.
I checked the Debian 11 build failure. The Scarthgap rsync changes currently include <linux/openat2.h> and use SYS_openat2 unconditionally. The Debian 11 build headers do not define SYS_openat2, so the compilation fails. My local validation passed because the available build headers define SYS_openat2, so it did not cover this older-host case. I also checked whether upgrading to the upstream v3.2.7-sec-patches1 tag would resolve the problem. It would not: that tag has the same unconditional SYS_openat2 use and does not contain the required configure-time portability check. The current upstream v3.2.7-sec-patches branch includes the follow-up commit: https://github.com/RsyncProject/rsync/commit/729ec83612d43e361ada1870173b525bc0b9ebac This checks for both <linux/openat2.h> and SYS_openat2 during configure, defines HAVE_OPENAT2 only when both are available, and retains the existing fallback on older systems. Once you confirm, I will add this follow-up to the Scarthgap series and rerun both rsync-native and rsync build validation before sending a v2. Thanks, Ashish ________________________________ From: Yoann Congal <[email protected]> Sent: 28 July 2026 18:46 To: Ashishkumar Parmar -X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Cc: xe-linux-external (Internal Group) <[email protected]> Subject: Re: [OE-core][scarthgap][PATCH 1/6] rsync: Fix CVE-2026-29518 On Fri Jun 12, 2026 at 2:13 PM CEST, Ashishkumar Parmar X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > From: Ashishkumar Parmar <[email protected]> > > Pick the upstream backport [1] for CVE-2026-29518 as mentioned in [3], > where a non-chrooted rsync daemon could be exposed to a parent path > TOCTOU race that allowed file access outside the module. > > Also include the dependent upstream fix that followed the CVE fix: > - CVE-2026-29518_p2.patch [2] secures sender read-path opens by > opening files from the module root, closing the same race on the > read side. > > [1] > https://github.com/RsyncProject/rsync/commit/1a5ad81add1004354a3d8ba841b94ffe19cd2505 > [2] > https://github.com/RsyncProject/rsync/commit/99b36291d06ca66229942c7a525a1f5566f10c85 > [3] https://www.cve.org/CVERecord?id=CVE-2026-29518 > > Signed-off-by: Ashishkumar Parmar <[email protected]> > --- > .../rsync/files/CVE-2026-29518_p1.patch | 330 ++++++++++++++++++ > .../rsync/files/CVE-2026-29518_p2.patch | 73 ++++ > meta/recipes-devtools/rsync/rsync_3.2.7.bb | 2 + > 3 files changed, 405 insertions(+) > create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch > create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch Hello, Something in this series made the test fail on debian 11: https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/4395/steps/15/logs/stdio | 399 ERROR: rsync-native-3.2.7-r0 do_compile: oe_runmake failed | 400 ERROR: rsync-native-3.2.7-r0 do_compile: ExecutionError('/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/run.do_compile.2977888', 1, None, None) | 401 NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_patch: Succeeded | 402 NOTE: Running task 392 of 412 (/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/gcc/gcc-source_13.4.bb:do_preconfigure) | 403 NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_preconfigure: Started | 404 NOTE: recipe gcc-source-13.4.0-13.4.0-r0: task do_preconfigure: Succeeded | 405 ERROR: Logfile of failure stored in: /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/log.do_compile.2977888 | 406 Log data follows: | 407 | DEBUG: Executing python function autotools_aclocals | 408 | DEBUG: SITE files ['endian-little', 'common-linux', 'common-glibc', 'bit-64', 'x86_64-linux', 'common'] | 409 | DEBUG: Python function autotools_aclocals finished | 410 | DEBUG: Executing shell function do_compile | 411 | NOTE: make -j 16 -l 75 STRIP= | 412 | gawk -f ./daemon-parm.awk ./daemon-parm.txt | 413 | sed 's;\@bindir\@;/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/bin;g' <./stunnel-rsyncd.conf.in >stunnel-rsyncd.conf | 414 | gawk -f ./mkproto.awk ./*.c ./lib/compat.c daemon-parm.h | 415 | gawk -f ./define-from-md.awk -v hfile=default-dont-compress.h ./rsync.1.md | 416 | gawk -f ./define-from-md.awk -v hfile=default-cvsignore.h ./rsync.1.md | 417 | gcc -I. -I. -I./zlib -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -O2 -pipe -DHAVE_CONFIG_H -Wall -W -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -c match.c -o match.o | 418 | gcc -I. -I. -I./zlib -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -O2 -pipe -DHAVE_CONFIG_H -Wall -W -isystem/srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/recipe-sysroot-native/usr/include -c syscall.c -o syscall.o | 419 | syscall.c: In function 'secure_relative_open_linux': | 420 | syscall.c:1723:19: error: 'SYS_openat2' undeclared (first use in this function); did you mean 'SYS_openat'? | 421 | 1723 | dirfd = syscall(SYS_openat2, AT_FDCWD, basedir, &bhow, sizeof bhow); | 422 | | ^~~~~~~~~~~ | 423 | | SYS_openat | 424 | syscall.c:1723:19: note: each undeclared identifier is reported only once for each function it appears in | 425 | make: *** [Makefile:76: syscall.o] Error 1 | 426 | ERROR: oe_runmake failed | 427 | WARNING: exit code 1 from a shell command. | 428 NOTE: recipe rsync-native-3.2.7-r0: task do_compile: Failed | 429 ERROR: Task (virtual:native:/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/rsync/rsync_3.2.7.bb:do_compile) failed with exit code '1' | 430 NOTE: recipe linux-libc-headers-6.6-r0: task do_unpack: Succeeded | 431 NOTE: Tasks Summary: Attempted 394 tasks of which 381 didn't need to be rerun and 1 failed. | 432 NOTE: The errors for this build are stored in /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/log/error-report/error_report_20260728100237.txt | 433 You can send the errors to a reports server by running: | 434 send-error-report /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/log/error-report/error_report_20260728100237.txt [-s server] | 435 NOTE: The contents of these logs will be posted in public if you use the above command with the default server. Please ensure you remove any identifying or proprietary information when prompted before sending. | 436 | 437 Summary: 1 task failed: | 438 virtual:native:/srv/pokybuild/yocto-worker/oe-selftest-debian/build/meta/recipes-devtools/rsync/rsync_3.2.7.bb:do_compile | 439 log: /srv/pokybuild/yocto-worker/oe-selftest-debian/build/build-st-2690503/tmp/work/x86_64-linux/rsync-native/3.2.7/temp/log.do_compile.2977888 | 440 Summary: There was 1 WARNING message. | 441 Summary: There were 2 ERROR messages, returning a non-zero exit code. Can you look into this? My guess is the newly introduced openat2 syscall is not compatible with debian11. FYI, same goes for the wrynose series, I'll answer there. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242194): https://lists.openembedded.org/g/openembedded-core/message/242194 Mute This Topic: https://lists.openembedded.org/mt/119772227/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
