From bd5b620021493ff245b79144420ceddc93e149c8 Mon Sep 17 00:00:00 2001 From: Aster Boese Date: Sun, 11 Jan 2026 18:32:44 -0500 Subject: [PATCH] main/postmarketos-base: drop busybox-suid Busybox su and login are not aware of PAM, so on a system with linux-pam installed, they entirely ignore any rules. These issues can be mitigated by removing the suid binary that the symlinks point to and require, which is installed by busybox-suid. Because busybox-suid handles more than su and login, this commit replaces all the tools we use that would be called through it. Note that this does not remove Busybox su and login, as they are in Busybox itself. This commit instead only removes the suid interface that they would normally be called from. See https://gitlab.alpinelinux.org/alpine/aports/-/issues/11730 for more information. Signed-off-by: Aster Boese Part-of: --- main/postmarketos-base/APKBUILD | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/main/postmarketos-base/APKBUILD b/main/postmarketos-base/APKBUILD index b8ed29c8b..15a2534ba 100644 --- a/main/postmarketos-base/APKBUILD +++ b/main/postmarketos-base/APKBUILD @@ -2,7 +2,7 @@ maintainer="Clayton Craft " pkgname=postmarketos-base pkgver=51 -pkgrel=1 +pkgrel=2 pkgdesc="Meta package for minimal postmarketOS base" url="https://postmarketos.org" arch="noarch" @@ -14,16 +14,18 @@ makedepends="postmarketos-initramfs" depends=" apk-tools busybox - busybox-suid devicepkg-utils>=0.2.0 eudev merge-usr + mount musl-utils openssh-server-pam postmarketos-keys postmarketos-mvcfg postmarketos-ramdisk sudo-virt + umount + util-linux-login zram-init " _pmb_recommends="