fix(cve): UT-2026-0115 - su runs in its own pseudo-terminal by default

debian/changelog

@@ -1,3 +1,15 @@
+util-linux (2.40.4-3deepin13) unstable; urgency=medium
+
+  * fix UT-2026-0115: su runs in its own pseudo-terminal by default
+    for interactive sessions, avoiding TIOCSTI/TIOCLINUX ioctl
+    command injection via the shared controlling terminal. runuser
+    is not affected; use -T/--no-pty to opt out.
+  * tests: misc/pipesz skips when not running as root (F_SETPIPE_SZ
+    growth requires CAP_SYS_RESOURCE, the test fails for unprivileged
+    builds).
+
+ -- xinpeng.wang <wangxinpeng@uniontech.com>  Fri, 21 Aug 2026 12:48:31 +0800
+
 util-linux (2.40.4-3deepin12) unstable; urgency=medium
 
   * fix(cve): CVE-2026-13595

debian/patches/UT-2026-0115-su-tiocsti.patch

@@ -0,0 +1,38 @@
+Description: UT-2026-0115 - 安全修复
+ Interactively started su (stdin is a tty) now allocates its own
+ pseudo-terminal by default, so the target session does not share the
+ controlling terminal with the caller session. This prevents
+ TIOCSTI/TIOCLINUX ioctl command injection by a process in the
+ unprivileged session (kernel < 6.2 or dev.tty.legacy_tiocsti=1).
+ The pty slave and proxy stdin handling is unchanged (upstream
+ lib/pty-session.c already keeps the slave cooked and makes the
+ proxy stdin raw), so line editing and tab completion keep working.
+ Use -T/--no-pty to opt out. runuser keeps its historical behavior.
+Origin: internal, UT-2026-0115; mechanism per upstream su(1) --pty
+ (https://github.com/util-linux/util-linux/pull/2685
+  https://github.com/util-linux/util-linux/commit/2863ed62d77bb2bae5aecc2297236d440ad21c4d)
+Bug: https://security-tracker.debian.org/tracker/CVE-2016-2779
+Last-Update: 2026-08-21
+---
+
+Index: deepin-util-linux/login-utils/su-common.c
+===================================================================
+--- deepin-util-linux.orig/login-utils/su-common.c
++++ deepin-util-linux/login-utils/su-common.c
+@@ -1240,6 +1240,16 @@ int su_main(int argc, char **argv, int m
+ 	if (request_same_session || !command || !su->pwd->pw_uid)
+ 		su->same_session = 1;
+
++	/* UT-2026-0115: interactively started su runs in its own
++	 * pseudo-terminal so that the target session does not share the
++	 * controlling terminal with the caller session. This prevents
++	 * TIOCSTI/TIOCLINUX ioctl command injection by a process running
++	 * in the unprivileged session (kernel < 6.2 without
++	 * dev.tty.legacy_tiocsti, see su(1) --pty); use -T/--no-pty to
++	 * opt out. runuser keeps its historical behavior. */
++	if (!su->runuser && su->isterm)
++		su->force_pty = 1;
++
+ 	/* initialize shell variable only if "-u <user>" not specified */
+ 	if (su->runuser_uopt) {
+ 		shell = NULL;

debian/patches/pipesz-test-skip-nonroot.patch

@@ -0,0 +1,23 @@
+Description: misc/pipesz test: skip when running without root privileges
+ Growing the pipe buffer size (F_SETPIPE_SZ) beyond the default capacity
+ requires CAP_SYS_RESOURCE, so the pipe-max-size subtest fails when the
+ test suite is executed by an unprivileged user (e.g. debuild as a
+ regular user). Skip the whole test as non-root, like blkid/topology
+ and ipcs/limits already do.
+Origin: internal
+Upstream-Status: Not-Forwarded
+---
+
+Index: deepin-util-linux/tests/ts/misc/pipesz
+===================================================================
+--- deepin-util-linux.orig/tests/ts/misc/pipesz
++++ deepin-util-linux/tests/ts/misc/pipesz
+@@ -18,6 +18,8 @@ TS_DESC="pipesz"
+ . "$TS_TOPDIR"/functions.sh
+ ts_init "$*"
+
++ts_skip_nonroot
++
+ ts_check_test_command "$TS_CMD_PIPESZ"
+ ts_check_test_command "$TS_HELPER_SYSINFO"
+

debian/patches/series

@@ -33,3 +33,5 @@ CVE-2025-14104-2.patch
 CVE-2026-27456.patch
 CVE-2026-3184.patch
 CVE-2026-13595.patch
+UT-2026-0115-su-tiocsti.patch
+pipesz-test-skip-nonroot.patch