Upgrade acl to 2.4.0 for CVE-2026-54369, CVE-2026-54370, CVE-2026-54371

SPECS/acl/acl.signatures.json

@@ -1,5 +1,5 @@
 {
  "Signatures": {
-  "acl-2.3.1.tar.gz": "760c61c68901b37fdd5eefeeaf4c0c7a26bdfdd8ac747a1edff1ce0e243c11af"
+  "acl-2.4.0.tar.gz": "73c853c3d44e1f693e5a96a986f1bd19d3d0dac2c7d453e796177774bc4e5f6a"
  }
 }

SPECS/acl/acl.spec

@@ -1,7 +1,7 @@
 Summary:        Access control list utilities
 Name:           acl
-Version:        2.3.1
-Release:        2%{?dist}
+Version:        2.4.0
+Release:        1%{?dist}
 License:        GPLv2+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -59,10 +59,10 @@ chmod 0755 %{buildroot}%{_libdir}/libacl.so.*.*.*
 %check
 # Skip following four tests which fail due to lack of ACL support in tools like cp from coreutils
 # As noted in coreutils build log: "configure: WARNING: GNU coreutils will be built without ACL support."
-sed -e 's|test/cp.test||' -i test/Makemodule.am Makefile.in Makefile
-sed -e 's|test/root/permissions.test||' -i test/Makemodule.am Makefile.in Makefile
-sed -e 's|test/root/setfacl.test||' -i test/Makemodule.am Makefile.in Makefile
-sed -e 's|test/misc.test||' -i test/Makemodule.am Makefile.in Makefile
+sed -e 's|test/cp.run||' -i test/Makemodule.am Makefile.in Makefile
+sed -e 's|test/root/permissions.run||' -i test/Makemodule.am Makefile.in Makefile
+sed -e 's|test/root/setfacl.run||' -i test/Makemodule.am Makefile.in Makefile
+sed -e 's|test/missc.run||' -i test/Makemodule.am Makefile.in Makefile
 %make_build check
 
 %ldconfig_scriptlets -n libacl
@@ -78,18 +78,24 @@ sed -e 's|test/misc.test||' -i test/Makemodule.am Makefile.in Makefile
 %{_mandir}/man5/acl.5*
 
 %files -n libacl-devel
+%license doc/COPYING doc/COPYING.LGPL
 %{_libdir}/libacl.so
 %{_includedir}/acl
 %{_includedir}/sys/acl.h
 %{_mandir}/man3/acl_*
 %{_libdir}/libacl.a
+%exclude %{_docdir}/acl/COPYING
+%exclude %{_docdir}/acl/COPYING.LGPL
 %{_docdir}/acl/*
 %{_libdir}/pkgconfig/libacl.pc
 
 %files -n libacl
 %{_libdir}/libacl.so.*
 
 %changelog
+* Mon Jun 29 2026 Kanishk Bansal <kanbansal@microsoft.com> - 2.4.0-1
+- Upgrade to 2.4.0 for CVE-2026-54369, CVE-2026-54370, CVE-2026-54371
+
 * Wed Sep 20 2023 Jon Slobodzian <joslobo@microsoft.com> - 2.3.1-2
 - Recompile with stack-protection fixed gcc version (CVE-2023-4039)
 
@@ -102,7 +108,7 @@ sed -e 's|test/misc.test||' -i test/Makemodule.am Makefile.in Makefile
 * Tue Apr 14 2020 Henry Beberman <henry.beberman@microsoft.com> - 2.2.53-4
 - Update files to include license
 
-* Fri Mar 03 2020 Jon Slobodzian <joslobo@microsoft.com> - 2.2.53-3
+* Tue Mar 03 2020 Jon Slobodzian <joslobo@microsoft.com> - 2.2.53-3
 - Replaced dead link. Fixed Source URL. Verified license.
 
 * Tue Sep 03 2019 Mateusz Malisz <mamalisz@microsoft.com> - 2.2.53-2

cgmanifest.json

@@ -45,8 +45,8 @@
         "type": "other",
         "other": {
           "name": "acl",
-          "version": "2.3.1",
-          "downloadUrl": "https://download.savannah.nongnu.org/releases/acl/acl-2.3.1.tar.gz"
+          "version": "2.4.0",
+          "downloadUrl": "https://download.savannah.nongnu.org/releases/acl/acl-2.4.0.tar.gz"
         }
       }
     },

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -43,7 +43,7 @@ readline-8.2-2.azl3.aarch64.rpm
 readline-devel-8.2-2.azl3.aarch64.rpm
 libattr-2.6.0-1.azl3.aarch64.rpm
 attr-2.6.0-1.azl3.aarch64.rpm
-libacl-2.3.1-2.azl3.aarch64.rpm
+libacl-2.4.0-1.azl3.aarch64.rpm
 coreutils-9.4-6.azl3.aarch64.rpm
 coreutils-lang-9.4-6.azl3.aarch64.rpm
 bash-5.2.15-3.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -43,7 +43,7 @@ readline-8.2-2.azl3.x86_64.rpm
 readline-devel-8.2-2.azl3.x86_64.rpm
 libattr-2.6.0-1.azl3.x86_64.rpm
 attr-2.6.0-1.azl3.x86_64.rpm
-libacl-2.3.1-2.azl3.x86_64.rpm
+libacl-2.4.0-1.azl3.x86_64.rpm
 coreutils-9.4-6.azl3.x86_64.rpm
 coreutils-lang-9.4-6.azl3.x86_64.rpm
 bash-5.2.15-3.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -1,5 +1,5 @@
-acl-2.3.1-2.azl3.aarch64.rpm
-acl-debuginfo-2.3.1-2.azl3.aarch64.rpm
+acl-2.4.0-1.azl3.aarch64.rpm
+acl-debuginfo-2.4.0-1.azl3.aarch64.rpm
 asciidoc-10.2.0-3.azl3.noarch.rpm
 attr-2.6.0-1.azl3.aarch64.rpm
 attr-debuginfo-2.6.0-1.azl3.aarch64.rpm
@@ -166,8 +166,8 @@ krb5-1.21.3-5.azl3.aarch64.rpm
 krb5-debuginfo-1.21.3-5.azl3.aarch64.rpm
 krb5-devel-1.21.3-5.azl3.aarch64.rpm
 krb5-lang-1.21.3-5.azl3.aarch64.rpm
-libacl-2.3.1-2.azl3.aarch64.rpm
-libacl-devel-2.3.1-2.azl3.aarch64.rpm
+libacl-2.4.0-1.azl3.aarch64.rpm
+libacl-devel-2.4.0-1.azl3.aarch64.rpm
 libarchive-3.7.7-6.azl3.aarch64.rpm
 libarchive-debuginfo-3.7.7-6.azl3.aarch64.rpm
 libarchive-devel-3.7.7-6.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -1,5 +1,5 @@
-acl-2.3.1-2.azl3.x86_64.rpm
-acl-debuginfo-2.3.1-2.azl3.x86_64.rpm
+acl-2.4.0-1.azl3.x86_64.rpm
+acl-debuginfo-2.4.0-1.azl3.x86_64.rpm
 asciidoc-10.2.0-3.azl3.noarch.rpm
 attr-2.6.0-1.azl3.x86_64.rpm
 attr-debuginfo-2.6.0-1.azl3.x86_64.rpm
@@ -174,8 +174,8 @@ krb5-1.21.3-5.azl3.x86_64.rpm
 krb5-debuginfo-1.21.3-5.azl3.x86_64.rpm
 krb5-devel-1.21.3-5.azl3.x86_64.rpm
 krb5-lang-1.21.3-5.azl3.x86_64.rpm
-libacl-2.3.1-2.azl3.x86_64.rpm
-libacl-devel-2.3.1-2.azl3.x86_64.rpm
+libacl-2.4.0-1.azl3.x86_64.rpm
+libacl-devel-2.4.0-1.azl3.x86_64.rpm
 libarchive-3.7.7-6.azl3.x86_64.rpm
 libarchive-debuginfo-3.7.7-6.azl3.x86_64.rpm
 libarchive-devel-3.7.7-6.azl3.x86_64.rpm