Debian Patches
Status for util-linux/2.41.5-0+deb13u1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| upstream/loopdev-use-openat2-RESOLVE_NO_SYMLINKS-for-backing-file.patch | loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file Use ul_open_no_symlinks() instead of open(O_NOFOLLOW) when LOOPDEV_FL_NOFOLLOW is set. O_NOFOLLOW only rejects symlinks at the last path component, but TOCTOU attacks swap intermediate components. openat2(RESOLVE_NO_SYMLINKS) rejects symlinks at any component. (cherry picked from commit 119d23f1e3f55cf10e3c66dab80fc308c9f26456) |
Karel Zak <kzak@redhat.com> | no | 2026-05-27 | ||
| upstream/libmount-restrict-source-path-canonicalization-for-non-ro.patch | libmount: restrict source path canonicalization for non-root users In restricted (suid, non-root) mode, mnt_context_prepare_srcpath() calls realpath() as euid=0 to canonicalize the source path. This follows symlinks through directories where the real user has write access (e.g. /home/user/), allowing redirection to arbitrary files. Only canonicalize /dev/ paths (e.g. /dev/cdrom -> /dev/sr0) and verify the result stays within /dev/. For non-/dev/ paths (e.g. disk images in user-writable directories), keep the original fstab path. Symlink protection for these paths is handled at open time by RESOLVE_NO_SYMLINKS in ul_open_no_symlinks(). This is a follow-up to commits: 5e390467b ("loopdev: add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks") d07aad41e ("libmount: ignore X-mount.nocanonicalize for restricted users") [zeha@d.o: apply to v2.41.5] |
Karel Zak <kzak@redhat.com> | no | 2026-07-31 | ||
| debian/man-getopt-examples.patch | util-linux: getopt(1) should point to where examples are on a Debian system Debian BTS #913049 |
Matthew Vernon <matthew@debian.org> | no | 2018-11-06 | ||
| debian/verbose-tests.patch | verbose-tests Enable verbose tests and print content of failing tests output file. |
Andreas Henriksson <andreas@fatal.se> | no | 2014-07-30 | ||
| debian/hardlink-tests-known-failed.patch | hardlink tests: set known failed sha256 cannot be initialized on some archs / buildds. |
Chris Hofstaedtler <zeha@debian.org> | no | 2022-04-12 | ||
| debian/lsfd-usrbin.patch | Install lsfd into /usr/bin | Chris Hofstaedtler <zeha@debian.org> | no | 2022-04-14 | ||
| debian/sensible-pager.patch | Use sensible-pager | Chris Hofstaedtler <zeha@debian.org> | no | 2022-07-14 | ||
| debian/login-support-LOG_OK_LOGINS.patch | login: support LOG_OK_LOGINS | Chris Hofstaedtler <zeha@debian.org> | no | 2024-08-05 | ||
| debian/login-do-not-print-motd-done-by-PAM.patch | login: do not print motd, done by PAM | Chris Hofstaedtler <zeha@debian.org> | no | 2024-08-05 | ||
| debian/login-turn-off-btmp-utmp-lastlog-writing.patch | login: turn off btmp, utmp, lastlog writing Should be done by PAM instead. login from src:shadow had turned it off, especially with --enable-logind. |
Chris Hofstaedtler <zeha@debian.org> | no | 2024-08-05 | ||
| debian/salsa-ci-skip-tests.patch | Skip fadvise/drop test in Salsa CI | Chris Hofstaedtler <zeha@debian.org> | no | 2025-02-16 |
All known versions for source package 'util-linux'
- 2.42.2-3 (sid)
- 2.42.2-2 (forky)
- 2.41.5-0+deb13u1 (trixie-security)
- 2.41-5 (trixie)
- 2.38.1-5+deb12u3 (bookworm)
- 2.38.1-5+deb12u1 (bookworm-security)