From: Adolf Belka Date: Sat, 4 Jul 2026 15:38:44 +0000 (+0200) Subject: acl: Update to version 2.4.0 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ccbae939a5e3e5bcdd5895534cb54825cb4aa12a;p=ipfire-2.x.git acl: Update to version 2.4.0 - Update from version 2.3.2 to 2.4.0 - Update of rootfile - 2 CVE fixes - Changelog 2.4.0 * Major security and robustness improvements: - Fix multiple security vulnerabilities: CVE-2026-54369 and CVE-2026-54370 - Harden setfacl, getfacl, and chacl against malicious input - Prevent NULL pointer dereferences and memory corruption - Fix setfacl --restore for pathnames beginning with whitespace - Prevent setfacl --restore --test from changing file permissions * New library functions: - Add acl_get_file_at(), acl_set_file_at(), acl_delete_def_file_at() for safer file operations using file descriptors and to control symlink following - acl_delete_def_file_at() allows removing default ACLs via file descriptor * API improvements and bug fixes: - Remove libacl dependency on libattr - Reject invalid numeric UIDs and GIDs in libacl - Fix memory wasting loop when user does not exist - Retry harder in acl_get_file/acl_get_fd operations - Improve errno handling in acl permission functions - Fix compiler warnings and sequence point issues * Build system and code organization: - Rename internal symbols with __acl_ prefix to avoid conflicts - Internalize walk_tree API and replace with hardened version - Mark local variables and functions static where appropriate - Remove unnecessary dependencies and dead code * Test suite improvements: - Fix test compatibility issues with getpwnam/getgrnam functions - Add comprehensive restore.run test for --restore functionality - Fix shell quoting errors in test scripts - Improve test lookup library accessibility * Documentation updates: - Clarify symlink following behavior in manual pages - Document new _at function variants - Clarify that on Linux, acl_perm_t is a bitset * Translation updates: - German translation update Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer --- diff --git a/config/rootfiles/common/acl b/config/rootfiles/common/acl index 505fd563c..9d449a60a 100644 --- a/config/rootfiles/common/acl +++ b/config/rootfiles/common/acl @@ -7,7 +7,7 @@ usr/bin/setfacl #usr/lib/libacl.la usr/lib/libacl.so usr/lib/libacl.so.1 -usr/lib/libacl.so.1.1.2302 +usr/lib/libacl.so.1.2.2400 #usr/lib/pkgconfig/libacl.pc #usr/share/doc/acl #usr/share/doc/acl/CHANGES @@ -37,6 +37,7 @@ usr/lib/libacl.so.1.1.2302 #usr/share/man/man3/acl_copy_int.3 #usr/share/man/man3/acl_create_entry.3 #usr/share/man/man3/acl_delete_def_file.3 +#usr/share/man/man3/acl_delete_def_file_at.3 #usr/share/man/man3/acl_delete_entry.3 #usr/share/man/man3/acl_delete_perm.3 #usr/share/man/man3/acl_dup.3 @@ -45,6 +46,7 @@ usr/lib/libacl.so.1.1.2302 #usr/share/man/man3/acl_error.3 #usr/share/man/man3/acl_extended_fd.3 #usr/share/man/man3/acl_extended_file.3 +#usr/share/man/man3/acl_extended_file_at.3 #usr/share/man/man3/acl_extended_file_nofollow.3 #usr/share/man/man3/acl_free.3 #usr/share/man/man3/acl_from_mode.3 @@ -52,6 +54,7 @@ usr/lib/libacl.so.1.1.2302 #usr/share/man/man3/acl_get_entry.3 #usr/share/man/man3/acl_get_fd.3 #usr/share/man/man3/acl_get_file.3 +#usr/share/man/man3/acl_get_file_at.3 #usr/share/man/man3/acl_get_perm.3 #usr/share/man/man3/acl_get_permset.3 #usr/share/man/man3/acl_get_qualifier.3 @@ -59,6 +62,7 @@ usr/lib/libacl.so.1.1.2302 #usr/share/man/man3/acl_init.3 #usr/share/man/man3/acl_set_fd.3 #usr/share/man/man3/acl_set_file.3 +#usr/share/man/man3/acl_set_file_at.3 #usr/share/man/man3/acl_set_permset.3 #usr/share/man/man3/acl_set_qualifier.3 #usr/share/man/man3/acl_set_tag_type.3 diff --git a/lfs/acl b/lfs/acl index b0008d4db..9b6f90b96 100644 --- a/lfs/acl +++ b/lfs/acl @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.3.2 +VER = 2.4.0 THISAPP = acl-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 9f2abfddcd403df2c716c05f02a1b52453613d10948dc58a65b9ef41b44e37db6de99fb22dcfc4f6f0fb5d0319c939da61bd4e0fba2cdb5643e8087ecd34eeac +$(DL_FILE)_BLAKE2 = c7e4cd5dc482b1e9e283ca0ec6740cd1051d23e9cb533917e3d58e8d2381af516bb74d340f195a5e38f9f76466406a7b2e8f31dff5362ae2cc09e9d1f47eeec7 install : $(TARGET)