2.28.2-2: fix CVE-2017-2616

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -50,59 +50,3 @@
 /util-linux-2.28.tar.xz
 /util-linux-2.28.1.tar.xz
 /util-linux-2.28.2.tar.xz
-/util-linux-2.29-rc1.tar.xz
-/util-linux-2.29-rc2.tar.xz
-/util-linux-2.29.tar.xz
-/util-linux-2.29.1.tar.xz
-/util-linux-2.29.2.tar.xz
-/util-linux-2.30-rc1.tar.xz
-/util-linux-2.30.tar.xz
-/util-linux-2.30.1.tar.xz
-/util-linux-2.30.2.tar.xz
-/util-linux-2.31-rc1.tar.xz
-/util-linux-2.31-rc2.tar.xz
-/util-linux-2.31.tar.xz
-/util-linux-2.32-rc1.tar.xz
-/util-linux-2.32.tar.xz
-/util-linux-2.32.1.tar.xz
-/util-linux-2.33-rc2.tar.xz
-/util-linux-2.33.1.tar.xz
-/util-linux-2.33.2.tar.xz
-/util-linux-2.34-rc1.tar.xz
-/util-linux-2.34-rc2.tar.xz
-/util-linux-2.34.tar.xz
-/util-linux-2.35-rc1.tar.xz
-/util-linux-2.35-rc1-20-63f8.tar.xz
-/util-linux-2.35-rc2.tar.xz
-/util-linux-2.35.tar.xz
-/util-linux-2.35.1.tar.xz
-/util-linux-2.35.2.tar.xz
-/util-linux-2.36.tar.xz
-/util-linux-2.36.1.tar.xz
-/util-linux-2.36.2.tar.xz
-/util-linux-2.37-rc2.tar.xz
-/util-linux-2.37.tar.xz
-/util-linux-2.37.2.tar.xz
-/util-linux-2.38-rc1.tar.xz
-/util-linux-2.38-rc3.tar.xz
-/util-linux-2.38.tar.xz
-/util-linux-2.38.1.tar.xz
-/util-linux-2.39-rc1.tar.xz
-/util-linux-2.39-rc2.tar.xz
-/util-linux-2.39-rc3.tar.xz
-/util-linux-2.39.tar.xz
-/util-linux-2.39.1.tar.xz
-/util-linux-2.39.2.tar.xz
-/util-linux-2.39.3.tar.xz
-/util-linux-2.40-rc1.tar.xz
-/util-linux-2.40.tar.xz
-/util-linux-2.40.1.tar.xz
-/util-linux-2.40.2.tar.xz
-/util-linux-2.40.4.tar.xz
-/util-linux-2.41.tar.xz
-/util-linux-2.41.1.tar.xz
-/util-linux-2.41.2.tar.xz
-/util-linux-2.41.3.tar.xz
-/util-linux-2.42.tar.xz
-/util-linux-2.42.1.tar.xz
-/util-linux-2.42.2.tar.xz

0000-login-use-O_CREAT-on-lastlog.patch

@@ -1,27 +0,0 @@
-From a2357184ff3dc3beb001fcb12e1e4c0dcf8d0dbd Mon Sep 17 00:00:00 2001
-From: Karel Zak <kzak@redhat.com>
-Date: Tue, 2 Dec 2025 16:15:44 +0100
-Subject: login: use O_CREAT on lastlog
-
-Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=151635
-Signed-off-by: Karel Zak <kzak@redhat.com>
----
- login-utils/login.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/login-utils/login.c b/login-utils/login.c
-index 321f9d6ce..edc69fd9a 100644
---- a/login-utils/login.c
-+++ b/login-utils/login.c
-@@ -682,7 +682,7 @@ static void log_lastlog(struct login_context *cxt)
- 	sa.sa_handler = SIG_IGN;
- 	sigaction(SIGXFSZ, &sa, &oldsa_xfsz);
- 
--	fd = open(_PATH_LASTLOG, O_RDWR, 0);
-+	fd = open(_PATH_LASTLOG, O_RDWR | O_CREAT, 0);
- 	if (fd < 0)
- 		goto done;
- 	offset = cxt->pwd->pw_uid * sizeof(ll);
--- 
-2.51.1
-

0001-login-add-run-motd.d-to-the-hardcoded-MOTD_FILE.patch

@@ -1,27 +0,0 @@
-From 617a887a6ec7e433f6a9f4c60592ed38b12b9f18 Mon Sep 17 00:00:00 2001
-From: Karel Zak <kzak@redhat.com>
-Date: Tue, 2 Dec 2025 16:17:55 +0100
-Subject: login: add /run/motd.d` to the hardcoded MOTD_FILE
-
-Addresses: https://github.com/coreos/console-login-helper-messages/issues/60
-Signed-off-by: Karel Zak <kzak@redhat.com>
----
- include/pathnames.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/pathnames.h b/include/pathnames.h
-index 34ba11ca3..c91a077e1 100644
---- a/include/pathnames.h
-+++ b/include/pathnames.h
-@@ -41,7 +41,7 @@
- #ifndef _PATH_MAILDIR
- # define _PATH_MAILDIR		"/var/spool/mail"
- #endif
--#define	_PATH_MOTDFILE		"/usr/share/misc/motd:/run/motd:/etc/motd"
-+#define	_PATH_MOTDFILE		"/usr/share/misc/motd:/run/motd:/run/motd.d:/etc/motd:/etc/motd.d"
- #ifndef _PATH_NOLOGIN
- # define _PATH_NOLOGIN		"/etc/nologin"
- #endif
--- 
-2.51.1
-

2.27-blkid-zfs-raid.patch

@@ -0,0 +1,13 @@
+diff -up util-linux-2.27.1/libblkid/src/probe.c.kzak util-linux-2.27.1/libblkid/src/probe.c
+diff -up util-linux-2.27.1/libblkid/src/superblocks/zfs.c.kzak util-linux-2.27.1/libblkid/src/superblocks/zfs.c
+--- util-linux-2.27.1/libblkid/src/superblocks/zfs.c.kzak	2015-11-02 10:07:34.567648465 +0100
++++ util-linux-2.27.1/libblkid/src/superblocks/zfs.c	2015-11-18 12:13:32.716188023 +0100
+@@ -258,7 +258,7 @@ static int probe_zfs(blkid_probe pr, con
+ const struct blkid_idinfo zfs_idinfo =
+ {
+ 	.name		= "zfs_member",
+-	.usage		= BLKID_USAGE_RAID,
++	.usage		= BLKID_USAGE_FILESYSTEM,
+ 	.probefunc	= probe_zfs,
+ 	.minsz		= 64 * 1024 * 1024,
+ 	.magics		= BLKID_NONE_MAGIC

2.28-libblkid-cdrom.patch

@@ -0,0 +1,34 @@
+From 55ad13c26fe5d0e606be5a83937f31b8cf576588 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Thu, 28 Apr 2016 13:54:01 +0200
+Subject: [PATCH] libblkid: make I/O errors on CDROMs non-fatal
+
+It seems too tricky to get a real size of the data track on hybrid
+disks with audio+data. It seems overkill to analyze all header in
+libblkid and on some disks it's probably possible to get I/O error
+almost everywhere due to crazy copy protection etc.
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ libblkid/src/probe.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libblkid/src/probe.c b/libblkid/src/probe.c
+index 63baed3..5d9f701 100644
+--- a/libblkid/src/probe.c
++++ b/libblkid/src/probe.c
+@@ -615,7 +615,10 @@ static struct blkid_bufinfo *read_buffer(blkid_probe pr, uint64_t real_off, uint
+ 	if (ret != (ssize_t) len) {
+ 		DBG(LOWPROBE, ul_debug("\tread failed: %m"));
+ 		free(bf);
+-		if (ret >= 0)
++
++		/* I/O errors on CDROMs are non-fatal to work with hybrid
++		 * audio+data disks */
++		if (ret >= 0 || blkid_probe_is_cdrom(pr))
+ 			errno = 0;
+ 		return NULL;
+ 	}
+-- 
+2.4.11
+

2.28-login-lastlog-create.patch

@@ -0,0 +1,12 @@
+diff -up util-linux-2.28/login-utils/login.c.kzak util-linux-2.28/login-utils/login.c
+--- util-linux-2.28/login-utils/login.c.kzak	2016-03-08 14:28:16.724156218 +0100
++++ util-linux-2.28/login-utils/login.c	2016-04-26 12:45:29.235326017 +0200
+@@ -510,7 +510,7 @@ static void log_lastlog(struct login_con
+ 	sa.sa_handler = SIG_IGN;
+ 	sigaction(SIGXFSZ, &sa, &oldsa_xfsz);
+ 
+-	fd = open(_PATH_LASTLOG, O_RDWR, 0);
++	fd = open(_PATH_LASTLOG, O_RDWR | O_CREAT, 0);
+ 	if (fd < 0)
+ 		goto done;
+ 

adjtime

@@ -1,2 +0,0 @@
-0.0 0 0.0
-0

libblkid-minix.patch

@@ -0,0 +1,13 @@
+diff -up util-linux-2.27.1/libblkid/src/superblocks/minix.c.kzak util-linux-2.27.1/libblkid/src/superblocks/minix.c
+--- util-linux-2.27.1/libblkid/src/superblocks/minix.c.kzak	2016-01-18 15:02:05.493738910 +0100
++++ util-linux-2.27.1/libblkid/src/superblocks/minix.c	2016-01-18 15:04:20.020773281 +0100
+@@ -90,7 +90,8 @@ static int probe_minix(blkid_probe pr, c
+ 		struct minix_super_block *sb = (struct minix_super_block *) data;
+ 		int zones, ninodes, imaps, zmaps, firstz;
+ 
+-		if (sb->s_imap_blocks == 0 || sb->s_zmap_blocks == 0)
++		if (sb->s_imap_blocks == 0 || sb->s_zmap_blocks == 0 ||
++		    sb->s_log_zone_size != 0)
+ 			return 1;
+ 
+ 		zones = version == 2 ? minix_swab32(swabme, sb->s_zones) :

plans/ci.fmf

@@ -1,5 +0,0 @@
-summary: Basic smoke test
-discover:
-    how: fmf
-execute:
-    how: tmt

sources

@@ -1 +1 @@
-SHA512 (util-linux-2.42.2.tar.xz) = 7415add0be2930654e322830808dde03ff6d511bd357f0679e6b6287a13ca79fe58ce4ac05edef86b76fb381b3a36ca2da9d3c31b5dc0a1d889c203156a57277
+46a232a37bce45371a86d19300edc47a  util-linux-2.28.2.tar.xz

su-properly-clear-child-PID.patch

@@ -0,0 +1,56 @@
+From dffab154d29a288aa171ff50263ecc8f2e14a891 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Wed, 1 Feb 2017 11:58:09 +0100
+Subject: [PATCH] su: properly clear child PID
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported-by: Tobias Stöckmann <tobias@stoeckmann.org>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ login-utils/su-common.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/login-utils/su-common.c b/login-utils/su-common.c
+index 5aefd3f..696adc8 100644
+--- a/login-utils/su-common.c
++++ b/login-utils/su-common.c
+@@ -368,6 +368,9 @@ create_watching_parent (void)
+             }
+           else
+             status = WEXITSTATUS (status);
++
++	  /* child is gone, don't use the PID anymore */
++	  child = (pid_t) -1;
+         }
+       else if (caught_signal)
+         status = caught_signal + 128;
+@@ -377,7 +380,7 @@ create_watching_parent (void)
+   else
+     status = 1;
+ 
+-  if (caught_signal)
++  if (caught_signal && child != (pid_t)-1)
+     {
+       fprintf (stderr, _("\nSession terminated, killing shell..."));
+       kill (child, SIGTERM);
+@@ -387,9 +390,12 @@ create_watching_parent (void)
+ 
+   if (caught_signal)
+     {
+-      sleep (2);
+-      kill (child, SIGKILL);
+-      fprintf (stderr, _(" ...killed.\n"));
++      if (child != (pid_t)-1)
++	{
++	  sleep (2);
++	  kill (child, SIGKILL);
++	  fprintf (stderr, _(" ...killed.\n"));
++	}
+ 
+       /* Let's terminate itself with the received signal.
+        *
+-- 
+2.9.3
+

tests/various/Makefile

@@ -1,64 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/util-linux/various
-#   Description: This test groups small sanity and regression tests for util-linux
-#   Author: Miroslav Vadkerti <mvadkert@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/util-linux/Sanity/various
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	test -x runtest.sh || chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Miroslav Vadkerti <mvadkert@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     This test groups small sanity and regression tests for util-linux" >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        10m" >> $(METADATA)
-	@echo "RunFor:          util-linux" >> $(METADATA)
-	@echo "Requires:        util-linux util-linux-user" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL3 -RHEL4 -RHEL5Server -RHEL5Client -RHEL6" >> $(METADATA)
-
-	rhts-lint $(METADATA)

tests/various/PURPOSE

@@ -1,3 +0,0 @@
-PURPOSE of /CoreOS/util-linux/various
-Description: This test groups small sanity and regression tests for util-linux
-Author: Miroslav Vadkerti <mvadkert@redhat.com>

tests/various/main.fmf

@@ -1,13 +0,0 @@
-summary: This test groups small sanity and regression tests for util-linux
-description: ''
-contact: Miroslav Vadkerti <mvadkert@redhat.com>
-component:
-  - util-linux
-test: ./runtest.sh
-framework: beakerlib
-recommend:
-  - util-linux
-  - util-linux-user
-duration: 10m
-extra-summary: /CoreOS/util-linux/Sanity/various
-extra-task: /CoreOS/util-linux/Sanity/various

tests/various/runtest.sh

@@ -1,51 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/util-linux/various
-#   Description: This test groups small sanity and regression tests for util-linux
-#   Author: Miroslav Vadkerti <mvadkert@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGE="util-linux"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
-    rlPhaseEnd
-
-    rlPhaseStartTest "return code of chfn should be always 1 in case failure"
-        rlRun "chfn -f a:b" 1
-        rlRun "chfn -o a:b" 1
-        rlRun "chfn -p a:b" 1
-        rlRun "chfn -h a:b" 1
-        rlRun "chfn -x a:b" 1
-        rlRun "chfn -f a -o b -p c -h d unknown-user" 1
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd

util-linux-60-raw.rules

@@ -0,0 +1,8 @@
+#
+# Enter raw device bindings here.
+#
+# An example would be:
+#   ACTION=="add", KERNEL=="sda", RUN+="/usr/bin/raw /dev/raw/raw1 %N"
+# to bind /dev/raw/raw1 to /dev/sda, or
+#   ACTION=="add", ENV{MAJOR}=="8", ENV{MINOR}=="1", RUN+="/usr/bin/raw /dev/raw/raw2 %M %m"
+# to bind /dev/raw/raw2 to the device with major 8, minor 1.

util-linux-login.pamd

@@ -7,6 +7,7 @@ password   include      system-auth
 # pam_selinux.so close should be the first session rule
 session    required     pam_selinux.so close
 session    required     pam_loginuid.so
+session    optional     pam_console.so
 # pam_selinux.so open should only be followed by sessions to be executed in the user context
 session    required     pam_selinux.so open
 session    required     pam_namespace.so

util-linux-su.pamd

@@ -1,5 +1,4 @@
 #%PAM-1.0
-auth		required	pam_env.so
 auth		sufficient	pam_rootok.so
 # Uncomment the following line to implicitly trust users in the "wheel" group.
 #auth		sufficient	pam_wheel.so trust use_uid

uuidd-tmpfiles.conf

@@ -1 +0,0 @@
-d /run/uuidd 2775 uuidd uuidd