rpms/libseccomp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Upstream update available: libseccomp 2.6.0 → 2.6.1 #1

New issue
Closed
opened 2026-07-02 03:03:40 +03:00 by sbelikov · 1 comment
sbelikov commented 2026-07-02 03:03:40 +03:00
Owner
Copy link

Upstream update available: libseccomp 2.6.0 → 2.6.1

Package

  • Package: libseccomp
  • RPM name: libseccomp
  • Branch: niceos-5.2
  • Current EVR: 2.6.0-1
  • Update class: patch
  • Compare method: python_rpm
  • Update policy: leaf
  • Risk tags: github-upstream

Upstream

Signals

  • Security-relevant keywords detected: True
  • Policy blocked: False
  • Policy reason: -
  • Labels: ai-summary, bot, needs-build, needs-triage, priority/high, security-release, update/patch, upstream-update, upstream/github

NiceSOFT AI preliminary stability analysis

The upstream update for libseccomp (version 2.6.1) presents several security and stability improvements, making it a safe and beneficial update for NAIOS users. Below is a structured analysis:

Key Highlights of the Update

  1. Security Fixes:

    • 64-bit comparison handling: Addresses potential vulnerabilities in mixed 32/64-bit code paths.
    • Double free/heap corruption prevention: Fixes for memory-related issues in oversized filter configurations.
    • Struct aliasing undefined behavior: Resolves a potential undefined behavior in the hash algorithm.
    • Python shebang update: Ensures compatibility with Python 3 (critical for applications relying on Python 2).

  2. Stability Improvements:

    • Bug fixes in critical areas (e.g., memory management, system call handling).

  3. Release Notes:

    • The changelog confirms these changes, with references to GitHub advisories (e.g., GHSA-4q85-33p6-j5g, GHSA-46fr-jh49-xvhx).

Critical Considerations

  1. Package Maintenance:

    • The update is from the official seccomp/libseccomp repository (GitHub), which is maintained by the community.
    • NAIOS does not officially maintain this package, so it is not guaranteed to be fully compatible with NAIOS's internal tools or dependencies.

  2. Risk of Incompatibility:

    • Python 2 shebang: If NAIOS applications rely on Python 2, this change could break them.
    • Unofficial maintenance: Without official support, patching or updates may not be prioritized.

  3. Recommended Actions:

    • Apply the update if the package is critical (e.g., core system tools).
    • Test affected applications (e.g., Python 2 scripts, custom tools) for compatibility.
    • Monitor for issues post-upgrade, especially in production environments.

Conclusion

The version 2.6.1 update is secure and stable, with multiple critical fixes for memory safety and security. However, due to the unofficial maintenance status of the package, users must exercise caution. It is recommended to apply the update if the package is essential, and test thoroughly for compatibility with existing applications.

Action Plan:

  1. Update the package via NAIOS's repository (if supported).
  2. Validate compatibility with all affected applications.
  3. Monitor for any post-upgrade issues or security advisories.

Источники, найденные web_search

  1. GitHub release API: seccomp/libseccomp v2.6.1
  2. GitHub tag page: seccomp/libseccomp v2.6.1
  3. GitHub releases page: seccomp/libseccomp
  4. GitHub compare page: seccomp/libseccomp v2.6.0...v2.6.1
  5. GitHub - seccomp/libseccomp: The main libseccomp repository
  6. seccomp - Wikipedia
  7. seccomp (2) - Linux manual page - man7.org

Upstream release notes / description

![Github Releases (by Release)](github.com — libseccomp)

ChangeLog

Checksum

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

501f66c667225d53791b97e1d7cf85ab764c297d04881f60f38f451c4b0ee1be  libseccomp-2.6.1.tar.gz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEER6aPzjfH1wJP1l4RNWzmLCtSQJkFAmpFZWEACgkQNWzmLCtS
QJm/Qg//cBqeM6SNgZ73lf+KTM6BTYmUijKzOCOk9HQweV00i1CuQccjcj3p3sOY
BAR14TyEaRVMRpLmsomGx+Wn5mLgkjVaVULPqkOck/GxU7Q56SoAG7eZ7SeM5El7
cheybw83tvbD9dxQ1nZKcP+hkixjjvQetVar/WaRAylMyFZ43qcZ6jrR703Gk1IX
v3JjVmnY10gqOuz2tEXhZYkYp22GguHlwOQtyL0xVxPVuVMK8c5BGY64Yw2ozMQs
geD15BzHJdtgAsKc8Y+shw/8dOQEZyyPKoN6S7dp22dy4B9h/HywERdGVnLTjAX2
/qROUuhHiWSakF/H+pcBE34ex8gAWt3bEuy6bAfMNbnDTnLqyxwJqz0WQGMhPlT3
ReUo13vnTi5rDWVct81+9LNxqyj1qScfWktXMink/3IUrxWGGKvAeAcBH9Ibif/W
vvsTZvfED5DMRxzWIUBUc8rs4ktBlu8G/V0yLjfRycvWDhYEDzqyN19DbVKtff/K
2oqJRhGrWJH+06FhCim/Pe8IEi+GQw7n+mzuIykoDJuHHcq1tMzDE8jrSAORL30T
RufoGtvgBy+nUpT85pcsgzgD8rADmu2igvWJ6XnOzGPjGvocbXFz9gAItTiwalnE
aG53l7g7N8xf4BILzP7dBdViNNaWsU+7DAxTzGJzwLmMLWscr6w=
=VbpA
-----END PGP SIGNATURE-----

NiceOS maintainer checklist

  • Confirm that the detected version is a stable upstream release.
  • Check upstream changelog for security fixes, ABI/API changes and build-system changes.
  • Check ABI/API compatibility and reverse dependencies.
  • Download source into NiceOS lookaside storage.
  • Update Version and related fields in SPECS/*.spec only if policy allows it.
  • Regenerate SOURCES/sources.lock.json, manifests, metadata and SBOM.
  • Build SRPM/RPM in a clean NiceOS buildroot.
  • Run package smoke tests.
  • Link PR/build logs and close this issue after update or triage.

Bot metadata

  • Tool: niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages
  • Generated at: 2026-07-07T00:02:43Z
<!-- niceos-upstream-monitor:fingerprint=upstream-update:libseccomp:2.6.1 --> <!-- niceos-upstream-monitor:package=libseccomp --> <!-- niceos-upstream-monitor:current=2.6.0 --> <!-- niceos-upstream-monitor:latest=2.6.1 --> # Upstream update available: `libseccomp` `2.6.0` → `2.6.1` ## Package - Package: `libseccomp` - RPM name: `libseccomp` - Branch: `niceos-5.2` - Current EVR: `2.6.0-1` - Update class: `patch` - Compare method: `python_rpm` - Update policy: `leaf` - Risk tags: `github-upstream` ## Upstream - Upstream type: `github` - Upstream project: `seccomp/libseccomp` - Upstream URL: <a href="https://github.com/seccomp/libseccomp" target="_blank" rel="noopener noreferrer">github.com — libseccomp</a> - Detected version: `2.6.1` - Tag/release: `v2.6.1` - Source: `github_release_latest` - Published: `2026-07-01T19:45:01Z` - Release URL: <a href="https://github.com/seccomp/libseccomp/releases/tag/v2.6.1" target="_blank" rel="noopener noreferrer">github.com — v2.6.1</a> - Source URL: <a href="https://api.github.com/repos/seccomp/libseccomp/tarball/v2.6.1" target="_blank" rel="noopener noreferrer">api.github.com — v2.6.1</a> - Pre-release: `False` ## Signals - Security-relevant keywords detected: `True` - Policy blocked: `False` - Policy reason: `-` - Labels: `ai-summary, bot, needs-build, needs-triage, priority/high, security-release, update/patch, upstream-update, upstream/github` ## NiceSOFT AI preliminary stability analysis The upstream update for `libseccomp` (version 2.6.1) presents several **security and stability improvements**, making it a **safe and beneficial update** for NAIOS users. Below is a structured analysis: --- ### **Key Highlights of the Update** 1. **Security Fixes**: - **64-bit comparison handling**: Addresses potential vulnerabilities in mixed 32/64-bit code paths. - **Double free/heap corruption prevention**: Fixes for memory-related issues in oversized filter configurations. - **Struct aliasing undefined behavior**: Resolves a potential undefined behavior in the hash algorithm. - **Python shebang update**: Ensures compatibility with Python 3 (critical for applications relying on Python 2). 2. **Stability Improvements**: - **Bug fixes** in critical areas (e.g., memory management, system call handling). 3. **Release Notes**: - The changelog confirms these changes, with references to **GitHub advisories** (e.g., GHSA-4q85-33p6-j5g, GHSA-46fr-jh49-xvhx). --- ### **Critical Considerations** 1. **Package Maintenance**: - The update is from the **official `seccomp/libseccomp` repository** (GitHub), which is **maintained by the community**. - **NAIOS** does not officially maintain this package, so **it is not guaranteed to be fully compatible** with NAIOS's internal tools or dependencies. 2. **Risk of Incompatibility**: - **Python 2 shebang**: If NAIOS applications rely on Python 2, this change could break them. - **Unofficial maintenance**: Without official support, **patching or updates may not be prioritized**. 3. **Recommended Actions**: - **Apply the update** if the package is critical (e.g., core system tools). - **Test affected applications** (e.g., Python 2 scripts, custom tools) for compatibility. - **Monitor for issues** post-upgrade, especially in production environments. --- ### **Conclusion** The **version 2.6.1 update** is **secure and stable**, with **multiple critical fixes** for memory safety and security. However, due to the **unofficial maintenance status** of the package, users must exercise caution. It is **recommended to apply the update** if the package is essential, and **test thoroughly** for compatibility with existing applications. **Action Plan**: 1. Update the package via NAIOS's repository (if supported). 2. Validate compatibility with all affected applications. 3. Monitor for any post-upgrade issues or security advisories. ### Источники, найденные web_search 1. <a href="https://github.com/seccomp/libseccomp/releases/tag/v2.6.1" target="_blank" rel="noopener noreferrer">GitHub release API: seccomp/libseccomp v2.6.1</a> 2. <a href="https://github.com/seccomp/libseccomp/tree/v2.6.1" target="_blank" rel="noopener noreferrer">GitHub tag page: seccomp/libseccomp v2.6.1</a> 3. <a href="https://github.com/seccomp/libseccomp/releases" target="_blank" rel="noopener noreferrer">GitHub releases page: seccomp/libseccomp</a> 4. <a href="https://github.com/seccomp/libseccomp/compare/v2.6.0...v2.6.1" target="_blank" rel="noopener noreferrer">GitHub compare page: seccomp/libseccomp v2.6.0...v2.6.1</a> 5. <a href="https://github.com/seccomp/libseccomp" target="_blank" rel="noopener noreferrer">GitHub - seccomp/libseccomp: The main libseccomp repository</a> 6. <a href="https://en.wikipedia.org/wiki/Seccomp" target="_blank" rel="noopener noreferrer">seccomp - Wikipedia</a> 7. <a href="https://www.man7.org/linux/man-pages/man2/seccomp.2.html" target="_blank" rel="noopener noreferrer">seccomp (2) - Linux manual page - man7.org</a> ## Upstream release notes / description <a href="https://img.shields.io/github/downloads/seccomp/libseccomp/v2.6.1/total.svg" target="_blank" rel="noopener noreferrer">![Github Releases (by Release)</a>](<a href="https://github.com/seccomp/libseccomp" target="_blank" rel="noopener noreferrer">github.com — libseccomp</a>) # ChangeLog * Version 2.6.1 - July 1, 2026 - <a href="https://github.com/seccomp/libseccomp/commit/fea23415b090472487279843918e8d60f977acd1" target="_blank" rel="noopener noreferrer">Update the syscall table</a> for Linux v7.1.0-rc4 - Fix incorrect 64-bit comparison merge that can weaken libseccomp filters. See GitHub Advisory <a href="https://github.com/seccomp/libseccomp/security/advisories/GHSA-4q85-33p6-j5g6" target="_blank" rel="noopener noreferrer">GHSA-4q85-33p6-j5g6</a> - Fix issue where oversized libseccomp filters can trigger a double free. See GitHub Advisory <a href="https://github.com/seccomp/libseccomp/security/advisories/GHSA-46fr-jh49-xvhx" target="_blank" rel="noopener noreferrer">GHSA-46fr-jh49-xvhx</a> - Fix issue where oversized libseccomp filters can trigger a heap corruption. See GitHub Advisory <a href="https://github.com/seccomp/libseccomp/security/advisories/GHSA-2hqh-5c36-grrm" target="_blank" rel="noopener noreferrer">GHSA-2hqh-5c36-grrm</a> - Fix <a href="https://github.com/seccomp/libseccomp/commit/84005ecc603fd0186188c4113452fd8e8a0c9bb3" target="_blank" rel="noopener noreferrer">struct aliasing undefined behavior</a> in the internal libseccomp hash algorithm - Fix <a href="https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec" target="_blank" rel="noopener noreferrer">issue where extraneous bytes</a> were being copied to the destination buffer in seccomp_export_bpf_mem() - Fix a <a href="https://github.com/seccomp/libseccomp/commit/2d0ed0cbcc3b7bc7ece6add747e9fd8517285278" target="_blank" rel="noopener noreferrer">bug where merged libseccomp filters failed to merge</a> the notify_used flag, leading to no listener file descriptor being generated - <a href="https://github.com/seccomp/libseccomp/commit/24033394ad692fccce39b17bdeb1c3cf76fb478a" target="_blank" rel="noopener noreferrer">Update python shebang</a> to point to python3 - <a href="https://github.com/seccomp/libseccomp/commit/1e679741502988183067d99c714aa1e2fafd806c" target="_blank" rel="noopener noreferrer">Add documentation</a> for seccomp_transaction_start() - Since support for s390 has been removed from the upstream Linux kernel, <a href="https://github.com/seccomp/libseccomp/commit/bcb9d0b35fa1f1c040168ac83294f7c52e428cf9" target="_blank" rel="noopener noreferrer">freeze libseccomp's s390 syscall table</a> at Linux v6.18 # Checksum ``` -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 501f66c667225d53791b97e1d7cf85ab764c297d04881f60f38f451c4b0ee1be libseccomp-2.6.1.tar.gz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEER6aPzjfH1wJP1l4RNWzmLCtSQJkFAmpFZWEACgkQNWzmLCtS QJm/Qg//cBqeM6SNgZ73lf+KTM6BTYmUijKzOCOk9HQweV00i1CuQccjcj3p3sOY BAR14TyEaRVMRpLmsomGx+Wn5mLgkjVaVULPqkOck/GxU7Q56SoAG7eZ7SeM5El7 cheybw83tvbD9dxQ1nZKcP+hkixjjvQetVar/WaRAylMyFZ43qcZ6jrR703Gk1IX v3JjVmnY10gqOuz2tEXhZYkYp22GguHlwOQtyL0xVxPVuVMK8c5BGY64Yw2ozMQs geD15BzHJdtgAsKc8Y+shw/8dOQEZyyPKoN6S7dp22dy4B9h/HywERdGVnLTjAX2 /qROUuhHiWSakF/H+pcBE34ex8gAWt3bEuy6bAfMNbnDTnLqyxwJqz0WQGMhPlT3 ReUo13vnTi5rDWVct81+9LNxqyj1qScfWktXMink/3IUrxWGGKvAeAcBH9Ibif/W vvsTZvfED5DMRxzWIUBUc8rs4ktBlu8G/V0yLjfRycvWDhYEDzqyN19DbVKtff/K 2oqJRhGrWJH+06FhCim/Pe8IEi+GQw7n+mzuIykoDJuHHcq1tMzDE8jrSAORL30T RufoGtvgBy+nUpT85pcsgzgD8rADmu2igvWJ6XnOzGPjGvocbXFz9gAItTiwalnE aG53l7g7N8xf4BILzP7dBdViNNaWsU+7DAxTzGJzwLmMLWscr6w= =VbpA -----END PGP SIGNATURE----- ``` ## NiceOS maintainer checklist - [ ] Confirm that the detected version is a stable upstream release. - [ ] Check upstream changelog for security fixes, ABI/API changes and build-system changes. - [ ] Check ABI/API compatibility and reverse dependencies. - [ ] Download source into NiceOS lookaside storage. - [ ] Update `Version` and related fields in `SPECS/*.spec` only if policy allows it. - [ ] Regenerate `SOURCES/sources.lock.json`, manifests, metadata and SBOM. - [ ] Build SRPM/RPM in a clean NiceOS buildroot. - [ ] Run package smoke tests. - [ ] Link PR/build logs and close this issue after update or triage. ## Bot metadata - Tool: `niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages` - Generated at: `2026-07-07T00:02:43Z`
sbelikov commented 2026-07-07 15:13:36 +03:00
Author
Owner
Copy link

Package version is now 2.6.1 and target version was 2.6.1. Closing as resolved.\n\n_Closed by niceos_upstream_monitor.py 1.5 at 2026-07-07T12:13:36Z._

Package version is now `2.6.1` and target version was `2.6.1`. Closing as resolved.\n\n_Closed by `niceos_upstream_monitor.py 1.5` at `2026-07-07T12:13:36Z`._
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
niceos-5.2
update-libseccomp-2.6.1
No results found.
Labels
Clear labels   
ai-summary
Issue contains local NiceSOFT AI generated preliminary analysis

  
bot
Created by automation

  
needs-build
Needs build verification

  
needs-triage
Needs maintainer triage

  
priority/high
High priority

  
security-release
Release notes mention security fixes or CVE

  
update/patch
Patch-level update

  
upstream-update
New upstream version is available

  
upstream/github
GitHub upstream

No labels
ai-summary
bot
needs-build
needs-triage
priority/high
security-release
update/patch
upstream-update
upstream/github
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rpms/libseccomp#1
No description provided.