From ab0558d53293a2f20ff1d20c9e6634a4f940b6c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Fri, 27 Jun 2025 00:04:06 +0000
Subject: [PATCH] ceph: Add patch to fix CVE-2025-52555

See https://github.com/ceph/ceph/security/advisories/GHSA-89hm-qq33-2fjm
---
 pkgs/tools/filesystems/ceph/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 88c636048ab4..be9009f6c051 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -392,6 +392,14 @@ rec {
       # * <https://aur.archlinux.org/cgit/aur.git/commit/?h=ceph&id=8c5cc7d8deec002f7596b6d0860859a0a718f12b>
       # * <https://github.com/ceph/ceph/pull/60999>
       ./boost-1.86-PyModule.patch
+
+      # TODO: Remove with Ceph >= 19.2.3
+      (fetchpatch2 {
+        name = "ceph-squid-client-disallow-unprivileged-users-to-escalate-root-privileges.patch";
+        url = "https://github.com/ceph/ceph/commit/380da5049e8ea7c35f34022fba24d3e2d4db6dd8.patch?full_index=1";
+        hash = "sha256-hVJ1v/n2YCJLusw+DEyK12MG73sJ/ccwbSc+2pLRxvw=";
+      })
+
     ];
 
     nativeBuildInputs = [