From 8ac11b153fea9edfa138b746c97456222d9d19ef Mon Sep 17 00:00:00 2001 From: Tomas Bzatek Date: Thu, 19 Jun 2025 15:48:48 +0200 Subject: [PATCH 1/2] * Thu Jun 19 2025 Tomas Bzatek - 2.10.90-3 - Harden temporary private mounts (#2373301) --- ...slinuxfilesystemhelpers_nodev,nosuid.patch | 43 +++++++++++++++++++ udisks2.spec | 8 +++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch diff --git a/udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch b/udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch new file mode 100644 index 0000000..d6b0f9a --- /dev/null +++ b/udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch @@ -0,0 +1,43 @@ +From 5e7277debea926370e587408517560afe87d28c9 Mon Sep 17 00:00:00 2001 +From: Tomas Bzatek +Date: Wed, 4 Jun 2025 15:26:46 +0200 +Subject: [PATCH] udiskslinuxfilesystemhelpers: Mount private mounts with + 'nodev,nosuid' + +The private mount done in take_filesystem_ownership() should always +default to 'nodev,nosuid' for security and 'errors=remount-ro' for +selected filesystem types to handle an corrupted filesystem. This is +consistent with mount options calculation for regular mounts. +--- + src/udiskslinuxfilesystemhelpers.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/src/udiskslinuxfilesystemhelpers.c b/src/udiskslinuxfilesystemhelpers.c +index 7c5fc037c4..9eb7742c77 100644 +--- a/src/udiskslinuxfilesystemhelpers.c ++++ b/src/udiskslinuxfilesystemhelpers.c +@@ -123,6 +123,7 @@ take_filesystem_ownership (const gchar *device, + + { + gchar *mountpoint = NULL; ++ const gchar *mount_opts; + GError *local_error = NULL; + gboolean unmount = FALSE; + gboolean success = TRUE; +@@ -151,8 +152,15 @@ take_filesystem_ownership (const gchar *device, + goto out; + } + ++ mount_opts = "nodev,nosuid"; ++ if (g_strcmp0 (fstype, "ext2") == 0 || ++ g_strcmp0 (fstype, "ext3") == 0 || ++ g_strcmp0 (fstype, "ext4") == 0 || ++ g_strcmp0 (fstype, "jfs") == 0) ++ mount_opts = "nodev,nosuid,errors=remount-ro"; ++ + /* TODO: mount to a private mount namespace */ +- if (!bd_fs_mount (device, mountpoint, fstype, NULL, NULL, &local_error)) ++ if (!bd_fs_mount (device, mountpoint, fstype, mount_opts, NULL, &local_error)) + { + g_set_error (error, UDISKS_ERROR, UDISKS_ERROR_FAILED, + "Cannot mount %s at %s: %s", diff --git a/udisks2.spec b/udisks2.spec index b16123b..6846793 100644 --- a/udisks2.spec +++ b/udisks2.spec @@ -25,11 +25,14 @@ Name: udisks2 Summary: Disk Manager Version: 2.10.90 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later URL: https://github.com/storaged-project/udisks Source0: https://github.com/storaged-project/udisks/releases/download/udisks-%{version}/udisks-%{version}.tar.bz2 +# https://bugzilla.redhat.com/show_bug.cgi?id=2373301 +Patch0: udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch + BuildRequires: make BuildRequires: glib2-devel >= %{glib2_version} BuildRequires: gobject-introspection-devel >= %{gobject_introspection_version} @@ -340,6 +343,9 @@ fi %endif %changelog +* Thu Jun 19 2025 Tomas Bzatek - 2.10.90-3 +- Harden temporary private mounts (#2373301) + * Sun Jan 19 2025 Fedora Release Engineering - 2.10.90-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From c01932b6c619da688245a735be0f2e03e4527471 Mon Sep 17 00:00:00 2001 From: Tomas Bzatek Date: Fri, 29 Aug 2025 13:26:12 +0200 Subject: [PATCH 2/2] * Fri Aug 29 2025 Tomas Bzatek - 2.10.91-1 - Version 2.10.91 --- .gitignore | 1 + sources | 2 +- ...slinuxfilesystemhelpers_nodev,nosuid.patch | 43 ------------------- udisks2.spec | 10 ++--- 4 files changed, 7 insertions(+), 49 deletions(-) delete mode 100644 udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch diff --git a/.gitignore b/.gitignore index 5efa339..459124a 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /udisks-2.10.0.tar.bz2 /udisks-2.10.1.tar.bz2 /udisks-2.10.90.tar.bz2 +/udisks-2.10.91.tar.bz2 diff --git a/sources b/sources index 55741ad..cf76c85 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (udisks-2.10.90.tar.bz2) = 7e2507ee9b235925af6d367a0d55608f7a2780a07efba9db3c4bc06a3d42728ce74fc9edc42255fc9259aa3426c83eb164e1e99740a2d2c1b80ec2265b51df90 +SHA512 (udisks-2.10.91.tar.bz2) = 85a11c7509317b1d53d2864f474b03a70773cc5964ab16ba42ed2704f9f95aa704585d40e55a5b86a63a8b4363caafafad03b1bdfecf282c9ee05a1b5644d3a2 diff --git a/udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch b/udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch deleted file mode 100644 index d6b0f9a..0000000 --- a/udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 5e7277debea926370e587408517560afe87d28c9 Mon Sep 17 00:00:00 2001 -From: Tomas Bzatek -Date: Wed, 4 Jun 2025 15:26:46 +0200 -Subject: [PATCH] udiskslinuxfilesystemhelpers: Mount private mounts with - 'nodev,nosuid' - -The private mount done in take_filesystem_ownership() should always -default to 'nodev,nosuid' for security and 'errors=remount-ro' for -selected filesystem types to handle an corrupted filesystem. This is -consistent with mount options calculation for regular mounts. ---- - src/udiskslinuxfilesystemhelpers.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/src/udiskslinuxfilesystemhelpers.c b/src/udiskslinuxfilesystemhelpers.c -index 7c5fc037c4..9eb7742c77 100644 ---- a/src/udiskslinuxfilesystemhelpers.c -+++ b/src/udiskslinuxfilesystemhelpers.c -@@ -123,6 +123,7 @@ take_filesystem_ownership (const gchar *device, - - { - gchar *mountpoint = NULL; -+ const gchar *mount_opts; - GError *local_error = NULL; - gboolean unmount = FALSE; - gboolean success = TRUE; -@@ -151,8 +152,15 @@ take_filesystem_ownership (const gchar *device, - goto out; - } - -+ mount_opts = "nodev,nosuid"; -+ if (g_strcmp0 (fstype, "ext2") == 0 || -+ g_strcmp0 (fstype, "ext3") == 0 || -+ g_strcmp0 (fstype, "ext4") == 0 || -+ g_strcmp0 (fstype, "jfs") == 0) -+ mount_opts = "nodev,nosuid,errors=remount-ro"; -+ - /* TODO: mount to a private mount namespace */ -- if (!bd_fs_mount (device, mountpoint, fstype, NULL, NULL, &local_error)) -+ if (!bd_fs_mount (device, mountpoint, fstype, mount_opts, NULL, &local_error)) - { - g_set_error (error, UDISKS_ERROR, UDISKS_ERROR_FAILED, - "Cannot mount %s at %s: %s", diff --git a/udisks2.spec b/udisks2.spec index 6846793..f3c8a8f 100644 --- a/udisks2.spec +++ b/udisks2.spec @@ -24,15 +24,12 @@ Name: udisks2 Summary: Disk Manager -Version: 2.10.90 -Release: 3%{?dist} +Version: 2.10.91 +Release: 1%{?dist} License: GPL-2.0-or-later URL: https://github.com/storaged-project/udisks Source0: https://github.com/storaged-project/udisks/releases/download/udisks-%{version}/udisks-%{version}.tar.bz2 -# https://bugzilla.redhat.com/show_bug.cgi?id=2373301 -Patch0: udisks-2.10.91-udiskslinuxfilesystemhelpers_nodev,nosuid.patch - BuildRequires: make BuildRequires: glib2-devel >= %{glib2_version} BuildRequires: gobject-introspection-devel >= %{gobject_introspection_version} @@ -343,6 +340,9 @@ fi %endif %changelog +* Fri Aug 29 2025 Tomas Bzatek - 2.10.91-1 +- Version 2.10.91 + * Thu Jun 19 2025 Tomas Bzatek - 2.10.90-3 - Harden temporary private mounts (#2373301)