Debian Patches
Status for incus/7.0.1-2~bpo13+1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 001-skip-TestConvertNetworkConfig.patch | lxc prior to version 4.0.12 had a logic bug in do_lxcapi_create() that returned success in error conditions. Since this is a very simple test, that didn’t actually matter, but now to properly pass would require the setting up of a user-specific lxc configuration and sub[u|g]id mappings, which is just too much effort for a small test.diff --git a/cmd/lxc-to-incus/main_migrate_test.go b/cmd/lxc-to-incus/main_migrate_test.go index 6fbff5fce..d3783b998 100644 |
Mathias Gibbens <gibmat@debian.org> | not-needed | |||
| 002-adjust-import-paths.patch | Adjust import paths to reflect Debian packagingdiff --git a/cmd/incusd/daemon.go b/cmd/incusd/daemon.go index caae61fd4..6ca3b1b5f 100644 |
Mathias Gibbens <gibmat@debian.org> | not-needed | |||
| 003-Compile-against-go-criu-v7.patch | Compile against go-criu v7 | Reinhard Tartler <siretart@tauware.de> | no | 2024-08-08 | ||
| 004-include-incusos-network-structs.patch | Incus now consumes the IncusOS network API and cli package. This causes a dependency loop, so extract the relevant structs needed by Incus.diff --git a/cmd/incus/admin_os.go b/cmd/incus/admin_os.go index 12a8baf06..35cb3385d 100644 |
Mathias Gibbens <gibmat@debian.org> | not-needed | |||
| 005-fix-x509keypairleaf.patch | Debian's reliance on GO111MODULE=off is causing generation of a pfx client certificate to crash. Set the x509keypairleaf GODEBUG environment variable to use modern behavior.diff --git a/cmd/incus/main.go b/cmd/incus/main.go index 26d1fb4e6..fff211f30 100644 |
Mathias Gibbens <gibmat@debian.org> | not-needed | |||
| 006-fix-net-http-mux.patch | Debian's reliance on GO111MODULE=off is causing net/http to revert to incompatible behavior when serving requests. Set the httpmuxgo GODEBUG environment variable to use modern behavior.diff --git a/cmd/incusd/main.go b/cmd/incusd/main.go index 9fab6b3be..825995b86 100644 |
Mathias Gibbens <gibmat@debian.org> | not-needed | |||
| 100-CVE-2026-62313.patch | incusd/project: Enforce isolated restriction when idmap key omitted restricted.containers.privilege=isolated only rejected an explicit security.idmap.isolated=false, but the key defaults to non-isolated when omitted. Require containers to explicitly enable isolation. This addresses CVE-2026-62313 |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 101-CVE-2026-62867.patch | incusd/project: Restrict volume creation options in restricted projects A user in a restricted project could set block.create_options to inject arguments into the filesystem creation command run as root. Restrict such projects to the pool's configured default for that option. This addresses CVE-2026-62867 |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 102-CVE-2026-62940.patch | incusd/instance: Enforce project restrictions on migration overrides The migration handler applied user-supplied config, device and profile overrides without any project restriction check, letting a restricted project set keys like security.privileged or raw.lxc. This addresses CVE-2026-62940 |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 103-CVE-2026-62941.patch | incusd/instances: Re-check restrictions after copy config merge The source instance's config is merged into the request only after the initial project restriction check, letting a cross-project copy carry restricted keys into the target project. Re-check the merged config. This addresses CVE-2026-62941 |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 104-CVE-2026-63125.patch | incusd/storage: Confine backup.yaml write to instance root This addresses CVE-2026-63125 |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 105-CVE-2026-63343.patch | incusd/instance: Confine metadata.yaml access to instance root This addresses CVE-2026-63343 |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 106-GHSA-26gp-p5fw-3r2h.patch | incusd/instances: Validate instance name on backup import This addresses GHSA-26gp-p5fw-3r2h (CVE pending) |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 107-GHSA-4qxq-p5hm-3q3p.patch | incusd/instance/qemu: Confine template access to instance root The template traversal guard from CVE-2026-48752 was only applied to the LXC driver. Apply the same checks to the QEMU driver. This addresses GHSA-4qxq-p5hm-3q3p (CVE pending) |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 108-GHSA-67qw-68v3-36h6.patch | incusd/storage: Validate volume name on ISO and backup import This addresses GHSA-67qw-68v3-36h6 (CVE pending) |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 109-GHSA-6v6x-387m-rj4w.patch | incusd: Expand network address set project for authorization The project expansion used for authorization had no branch for network address sets, so their access checks ran against the requested project rather than the effective one, letting a restricted project act on the default project's address sets. This addresses GHSA-6v6x-387m-rj4w (CVE pending) |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 110-GHSA-7fj9-65v4-rp7h.patch | incusd/instance: Confine OCI network writes to instance root Also rejects line breaks in the oci.dns.domain and oci.dns.search values which are written to the generated resolv.conf. This addresses GHSA-7fj9-65v4-rp7h (CVE pending) |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 111-GHSA-m3j6-p3v3-qmjv.patch | internal/instance: Prevent line breaks in NVIDIA config values This addresses GHSA-m3j6-p3v3-qmjv (CVE pending) |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 112-GHSA-p2v3-6wvc-cv3p.patch | incusd/images: Validate image fingerprint for all protocols The fingerprint validation added for CVE-2026-48769 was only applied to the direct protocol. Validate it for all protocols and re-check after it is taken from the remote server's response. This addresses GHSA-p2v3-6wvc-cv3p (CVE pending) |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 | ||
| 113-incus-7.3-fixes.patch | [PATCH 14/17] incusd/instance: Fix NVIDIA require.cuda and require.driver handling The condition was inverted, so a configured value was silently dropped while an empty value wrote an empty environment variable. Only write the variable when a value is set. |
Stéphane Graber <stgraber@stgraber.org> | no | 2026-07-24 |
All known versions for source package 'incus'
- 7.3.0-1~exp1 (experimental)
- 7.0.1-2 (forky, sid)
- 7.0.1-2~bpo13+1 (trixie-backports)
- 6.0.4-2+deb13u9 (trixie-security, trixie-proposed-updates)
- 6.0.4-2+deb13u8 (trixie)
- 6.0.4-2+deb13u7~bpo12+1 (bookworm-backports)