[Deepin Integration]~[v25-Release] fix(acl): CVE-2026-54369, CVE-2026-54370 symlink traversal and TOCTOU by Zeno-sole@deepin-community/acl by deepin-community-ci-bot[bot]

[deepin-bot]

Package information | 软件包信息

包名	版本
acl	2.3.2-2deepin2

Package repository address | 软件包仓库地址

deb [trusted=yes] https://ci.deepin.com/repo/obs/deepin:/CI:/TestingIntegration:/test-integration-pr-4422/testing/ ./

Changelog | 更新信息

acl (2.3.2-2deepin2) unstable; urgency=medium

• Fix CVE-2026-54369: symlink traversal in libacl pathname-based functions
  (acl_get_file, acl_set_file, acl_extended_file, acl_delete_def_file)

  • Add walk_tree helper using directory file descriptors
  • Add openat2 syscall wrapper for RESOLVE_NO_SYMLINKS
  • Add xattrat/fchmodat syscall backwards compatibility code
  • Add libacl _at function variants (acl_get_file_at, acl_set_file_at,
    acl_extended_file_at, acl_delete_def_file_at)

• Fix CVE-2026-54370: TOCTOU race condition in getfacl, setfacl, chacl

  • Harden getfacl: switch to symlink-safe functions (fstatat, acl_get_file_at)
  • Harden setfacl: switch to symlink-safe functions (fstatat, fchmodat,
    acl_set_file_at)
  • Harden setfacl --restore: use openat2(RESOLVE_NO_SYMLINKS)
  • Harden chacl: use directory file descriptors and AT_SYMLINK_NOFOLLOW

• Fix compiler warnings for CVE-2026-54369 and CVE-2026-54370

[deepin-bot]

Integration Test Info

Test suggestion | 测试建议

Influence | 影响范围

ADDITIONAL INFORMATION | 额外补充

[deepin-bot]

IntegrationProjector Notify the author
@zeno: Integrated issue updated

[deepin-bot]

IntegrationProjector Bot
Deepin Testing Integration Project Manager Info
Link to deepin-community/Repository-Integration#4422