From 0684ad8befd8bf94deb95b2097d1ff61102650a8 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Fri, 24 Jul 2026 16:51:35 +0800 Subject: [PATCH 1/3] Fix openat2() blocked by --suppress-sync=yes causing application breakage (fb73687) --- ...-allow-openat2-with-suppress-fb73687.patch | 77 +++++++++++++++++++ systemd.spec | 7 +- 2 files changed, 83 insertions(+), 1 deletion(-) create mode 100644 systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch diff --git a/systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch b/systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch new file mode 100644 index 0000000..fe14fdb --- /dev/null +++ b/systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch @@ -0,0 +1,77 @@ +From fb736873708f24ee6625c55d29a4a9683430d99f Mon Sep 17 00:00:00 2001 +From: Frantisek Sumsal +Date: Wed, 22 Jul 2026 14:34:05 +0200 +Subject: [PATCH] seccomp-util: allow openat2() with --suppress-sync=yes + +When --suppress-sync=yes was introduced in +4a4654e0241fbeabecb8587fd3520b6b39264b9c it filtered out openat2() +completely, as we can't check its "flags" argument because it's hidden +in an indirect struct. This was perfectly fine at that time, as +openat2() was quite new and software shipped with a fallback to +open()/openat() if the syscall wasn't present. + +However, today the situation is different and an increasing number of +software is moving to openat2() without any fallback - tar [0] being the +most common one in the recent reports and workarounds, and attr recently +fixed a CVE by switching to openat2() [1] as well, to name a few. + +Given that we already block all the sync-family syscalls and calling +openat2() with O_SYNC is relatively rare, let's just blanket-enable it +in the --suppress-sync=yes mode. This means that we might issue a +synchronous write when something calls openat2() with O_SYNC, but not +breaking the apps here feels like a reasonable trade-off, at least until +a better solution pops up. + +Note that the same situation is in seccomp_restrict_sxid(), but allowing +the openat2() syscall there could actually have some security-related +implications under certain circumstances. + +Resolves: #41868 + +[0] https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=75b03fdff48916bd0654677ed21379bdb0db016d +[1] https://cgit.git.savannah.gnu.org/cgit/attr.git/commit/?id=1cea2fc5e8b5c8a5f29abf1141399e01a57a3154 +--- + src/shared/seccomp-util.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) +diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c +index eb40e29..8d83b0a 100644 +--- a/src/shared/seccomp-util.c ++++ b/src/shared/seccomp-util.c +@@ -2437,18 +2437,16 @@ static int block_open_flag(scmp_filter_ctx seccomp, int flag) { + else + any = true; + +-#if defined(__SNR_openat2) +- /* The new openat2() system call can't be filtered sensibly, see above. */ +- r = seccomp_rule_add_exact( +- seccomp, +- SCMP_ACT_ERRNO(ENOSYS), +- SCMP_SYS(openat2), +- 0); +- if (r < 0) +- log_debug_errno(r, "Failed to add filter for openat2: %m"); +- else +- any = true; +-#endif ++ /* We can't reasonably filter openat2() here, because the flags are in an indirect struct instead of ++ * a regular scalar argument, see also the comment in seccomp_restrict_sxid() above. However, ++ * blocking it here causes an increasing number of issues as more software moves to openat2() without ++ * any fallback to open()/openat(). ++ * ++ * Given that calling openat2() with O_SYNC is rather rare, and most of the heavy-lifting is done by ++ * filtering out the sync-family syscalls in seccomp_suppress_sync() below, let's just blanket-allow ++ * openat2() to avoid unnecessarily breaking stuff left and right when nspawn is running with ++ * --suppress-sync=yes. This means that we might issue a synchronous write when something calls ++ * openat2() with O_SYNC, but it is the best we can do at least until a better solution pops up. */ + + return any ? 0 : r; + } +@@ -2460,7 +2458,7 @@ int seccomp_suppress_sync(void) { + /* This behaves slightly differently from SystemCallFilter=~@sync:0, in that negative fds (which + * we can determine to be invalid) are still refused with EBADF. See #34478. + * +- * Additionally, O_SYNC/O_DSYNC are masked. */ ++ * Additionally, O_SYNC/O_DSYNC are masked (except for openat2(), see above). */ + + SECCOMP_FOREACH_LOCAL_ARCH(arch) { + _cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL; diff --git a/systemd.spec b/systemd.spec index ca98e0d..033d76a 100644 --- a/systemd.spec +++ b/systemd.spec @@ -3,7 +3,7 @@ Summary: System and Service Manager Name: systemd Version: 255 -Release: 21%{?dist} +Release: 22%{?dist} License: LGPLv2+ and MIT and GPLv2+ Url: https://www.freedesktop.org/wiki/Software/systemd Source0: https://github.com/systemd/systemd/archive/v%{version}/%{name}-%{version}.tar.gz @@ -1251,6 +1251,7 @@ Patch1279: 1273-test-add-test-case-for-issue-36031.patch Patch1280: 1274-core-escape-UTF-8-in-mount-unit-Where-field-before-s.patch Patch1281: 1275-test-escape-from-uname-r-before-using-in-regex-via.patch Patch1282: 1276-hwdb-update-to-v257-stable-2025-06-25.patch +Patch1283: systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch Patch3000: use-bfq-scheduler.patch @@ -2827,6 +2828,10 @@ fi %changelog +* Fri Jul 24 2026 PkgAgent Robot - 255-22 +- [Type] security +- [DESC] Fix openat2() blocked by --suppress-sync=yes causing application breakage (fb73687) + * Sat Jan 17 2026 doupengda - 255-21 - [Type] bugfix - [DESC] fix not found libsystemd-shared-255.so problem -- Gitee From 7fa8a2ff35a1c035ff95ccbaeeae6b6755af378f Mon Sep 17 00:00:00 2001 From: pkgagent Date: Tue, 28 Jul 2026 11:05:04 +0800 Subject: [PATCH 2/3] Apply security patch for systemd --- systemd.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/systemd.spec b/systemd.spec index 033d76a..6a6420f 100644 --- a/systemd.spec +++ b/systemd.spec @@ -920,7 +920,7 @@ Patch0940: 0934-man-machinectl-1-Fix-description-of-subcommand-power.patch Patch0941: 0935-mount-optimize-mountinfo-traversal-by-decoupling-dev.patch Patch0942: 0936-ukify-Fix-systemd-measure-detection-in-tests.patch Patch0943: 0937-man-reword-comment-a-bit-regarding-ExecStartPre-mult.patch -#Patch0944: 0938-docs-don-t-mention-split-usr-path-anymore.patch +Patch0944: systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch #Patch0945: 0939-docs-DESKTOP_ENVIRONMENTS-fix-formatting.patch Patch0946: 0940-meson-sort-includes.patch #Patch0947: 0941-docs-DESKTOP_ENVIRONMENT-clarify-RANDOM-usage.patch @@ -1251,7 +1251,6 @@ Patch1279: 1273-test-add-test-case-for-issue-36031.patch Patch1280: 1274-core-escape-UTF-8-in-mount-unit-Where-field-before-s.patch Patch1281: 1275-test-escape-from-uname-r-before-using-in-regex-via.patch Patch1282: 1276-hwdb-update-to-v257-stable-2025-06-25.patch -Patch1283: systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch Patch3000: use-bfq-scheduler.patch -- Gitee From 4cc05dc507a418c6c00f6be8574f7e00ada4e97c Mon Sep 17 00:00:00 2001 From: pkgagent Date: Tue, 28 Jul 2026 15:53:07 +0800 Subject: [PATCH 3/3] Apply security patch for systemd --- systemd.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/systemd.spec b/systemd.spec index 6a6420f..033d76a 100644 --- a/systemd.spec +++ b/systemd.spec @@ -920,7 +920,7 @@ Patch0940: 0934-man-machinectl-1-Fix-description-of-subcommand-power.patch Patch0941: 0935-mount-optimize-mountinfo-traversal-by-decoupling-dev.patch Patch0942: 0936-ukify-Fix-systemd-measure-detection-in-tests.patch Patch0943: 0937-man-reword-comment-a-bit-regarding-ExecStartPre-mult.patch -Patch0944: systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch +#Patch0944: 0938-docs-don-t-mention-split-usr-path-anymore.patch #Patch0945: 0939-docs-DESKTOP_ENVIRONMENTS-fix-formatting.patch Patch0946: 0940-meson-sort-includes.patch #Patch0947: 0941-docs-DESKTOP_ENVIRONMENT-clarify-RANDOM-usage.patch @@ -1251,6 +1251,7 @@ Patch1279: 1273-test-add-test-case-for-issue-36031.patch Patch1280: 1274-core-escape-UTF-8-in-mount-unit-Where-field-before-s.patch Patch1281: 1275-test-escape-from-uname-r-before-using-in-regex-via.patch Patch1282: 1276-hwdb-update-to-v257-stable-2025-06-25.patch +Patch1283: systemd-255-seccomp-util-allow-openat2-with-suppress-fb73687.patch Patch3000: use-bfq-scheduler.patch -- Gitee