From 03aae1016e762e4c25bb5b158d3bebbb90a56d7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Santos=20Reis?= Date: Tue, 23 Jun 2026 15:05:12 +0100 Subject: [PATCH 1/2] busybox: backport tar symlink bug fix --- pkgs/os-specific/linux/busybox/default.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix index d155c1064676..bfb3f424aa45 100644 --- a/pkgs/os-specific/linux/busybox/default.nix +++ b/pkgs/os-specific/linux/busybox/default.nix @@ -99,6 +99,13 @@ stdenv.mkDerivation (finalAttrs: { excludes = [ "networking/httpd_ratelimit_cgi.c" ]; # New since release. hash = "sha256-Msm9sDZrVx7ofunnvnTS73SPKUUpR3Tv5xZ/wBd+rts="; }) + # tar: only strip unsafe components from hardlinks, not symlinks + # fix issue introduced by the previous patch (CVE-2026-26157_CVE-2026-26158.patch) + (fetchpatch { + name = "CVE-2026-26157_CVE-2026-26158-2.patch"; + url = "https://github.com/vda-linux/busybox_mirror/commit/599f5dd8fac390c18b79cba4c14c334957605dae.patch"; + hash = "sha256-go/KHSsuMSm21nC0yvKEtAQs8Jnjjqdcs5i8RWBGwT4="; + }) # syslogd: fix writing to local log file # https://lists.busybox.net/pipermail/busybox/2024-October/090969.html (fetchpatch { From dccad3b9c424fe87bde2248fcc1cf2239eb7e7e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Santos=20Reis?= Date: Fri, 26 Jun 2026 10:40:11 +0100 Subject: [PATCH 2/2] busybox: re-enable tar tests --- pkgs/os-specific/linux/busybox/default.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix index bfb3f424aa45..20a76523092a 100644 --- a/pkgs/os-specific/linux/busybox/default.nix +++ b/pkgs/os-specific/linux/busybox/default.nix @@ -270,12 +270,6 @@ stdenv.mkDerivation (finalAttrs: { # Relies on suid/guid bits skip-testcase cpio.tests "cpio restores suid/sgid bits" - # Weird failures, looks related to our sandbox - skip-testcase tar.tests "tar does not extract into symlinks" - skip-testcase tar.tests "tar -k does not extract into symlinks" - skip-testcase tar.tests "tar Symlink attack: create symlink and then write through it" - skip-testcase tar.tests "tar Symlinks and hardlinks coexist" - popd ''; });