Skip to content

fix: drop the internal UT-2026-0115 su pseudo-terminal patch - #27

Merged
deepin-ci-robot merged 1 commit into
deepin-community:masterfrom
Zeno-sole:drop-ut-2026-0115-patch
Oct 21, 2026
Merged

deepin-ci-robot merged 1 commit into
deepin-community:masterfrom
Zeno-sole:drop-ut-2026-0115-patch

Conversation

@Zeno-sole

@Zeno-sole Zeno-sole commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor

Remove the internal UT-2026-0115-su-tiocsti.patch that was added by #22 (2.40.4-3deepin13) and bump the package to 2.40.4-3deepin17.

What changes

With the patch gone, su is back to the upstream util-linux behavior: an interactive su shares the caller's controlling terminal unless -P/--pty is given explicitly. runuser was never affected. -P/--pty remains available for callers that want the private pseudo-terminal.

Impact

  • The TIOCSTI/TIOCLINUX shared-terminal hardening is no longer default-on for su. On kernels >= 6.2 TIOCSTI is disabled by the kernel itself (dev.tty.legacy_tiocsti is the only way to re-enable it); on older kernels or with the legacy knob enabled, the shared-terminal injection window returns for su users who do not pass -P/--pty.
  • No other patch in the series depends on this file; the remaining 36 patches still apply cleanly (quilt push -a, no fuzz/offset on files touched by this patch).

Verification

  • quilt push -a on a clean git archive of master with the modified series: all patches applied, no failures.
  • Diff is limited to debian/changelog, debian/patches/series, and the deleted patch file.

Fixes: refs #22

Summary by Sourcery

Restore upstream su terminal behavior by dropping the internal TIOCSTI hardening patch and update the package revision.

Bug Fixes:

  • Remove the internal su pseudo-terminal hardening patch so su returns to upstream shared-terminal behavior unless --pty is explicitly requested.

Chores:

  • Bump the package revision to 2.40.4-3deepin17 while retaining the remaining patch series unchanged.

The patch forced interactively started su to allocate its own
pseudo-terminal by default. That is not upstream behavior: upstream
util-linux only creates a private pty when -P/--pty is given
explicitly, and runuser keeps its historical behavior.

Remove the patch and its series entry so su returns to the upstream
default. -P/--pty is still available for callers that want the private
pseudo-terminal, and kernels >= 6.2 keep TIOCSTI disabled by default.
No other patches depend on this one; the remaining series still applies
cleanly.

Log: Removed the internal UT-2026-0115 su patch, restoring upstream su terminal behavior

Influence:
1. Verify su works interactively without a private pty by default
2. Verify su -P/--pty still creates a private pseudo-terminal
3. Verify runuser behavior is unchanged
4. Verify the package builds with the reduced patch series

fix: 移除内部 UT-2026-0115 su 伪终端补丁

该补丁让交互式启动的 su 默认分配自己的伪终端。这不是上游行为:
上游 util-linux 只在显式指定 -P/--pty 时才创建私有 pty,
runuser 保持原有行为。

移除该补丁及 series 条目,使 su 回到上游默认行为。
需要私有伪终端的调用方仍可使用 -P/--pty,
且 6.2 及以上内核默认禁用 TIOCSTI。
没有其他补丁依赖此补丁,剩余 series 仍可干净应用。

Log: 移除内部 UT-2026-0115 su 补丁,恢复上游 su 终端行为

Influence:
1. 验证 su 交互式登录默认不再使用私有 pty
2. 验证 su -P/--pty 仍能创建私有伪终端
3. 验证 runuser 行为未发生变化
4. 验证裁剪补丁后的包可以正常构建

repo: util-linux #master
@sourcery-ai

sourcery-ai Bot commented Oct 21, 2026 •

Copy link
Copy Markdown
Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

The package revision is bumped to 2.40.4-3deepin17 while removing the internal su TIOCSTI/TIOCLINUX pseudo-terminal patch, restoring upstream shared-terminal behavior unless su is invoked with --pty; the remaining patch stack is unchanged and verified to apply cleanly.

File-Level Changes

Change Details Files
Remove the internal su pseudo-terminal hardening patch and its quilt-series registration.
  • Delete the TIOCSTI/TIOCLINUX su patch.
  • Remove the patch from the Debian patch series while retaining the other patches.
debian/patches/UT-2026-0115-su-tiocsti.patch
debian/patches/series
Bump the Debian package revision and document the patch removal.
  • Add the new 2.40.4-3deepin17 changelog entry.
  • Record the return to upstream su terminal behavior and associated security impact.
debian/changelog

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@github-actions

Copy link
Copy Markdown

TAG Bot

TAG: 2.40.4-3deepin17
EXISTED: no
DISTRIBUTION: unstable

@Zeno-sole

Copy link
Copy Markdown
Contributor Author

/approve

@deepin-ci-robot

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Zeno-sole

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@Zeno-sole

Copy link
Copy Markdown
Contributor Author

/lgtm

@deepin-ci-robot

Copy link
Copy Markdown
Contributor

@Zeno-sole: you cannot LGTM your own PR.

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨

@deepin-ci-robot
deepin-ci-robot merged commit 3b29e0b into deepin-community:master Oct 21, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants