fix: Use reduce setgid to fix CVE-2024-28085, compile and

     install write, utmpdump, mesg

pms: 299927

Author: xinpeng wang

debian/bsdextrautils.install

@@ -6,10 +6,12 @@ usr/bin/column
 usr/bin/hexdump
 usr/bin/look
 usr/bin/ul
+usr/bin/write
 <!nodoc> usr/share/man/man1/col.1
 <!nodoc> usr/share/man/man1/colcrt.1
 <!nodoc> usr/share/man/man1/colrm.1
 <!nodoc> usr/share/man/man1/column.1
 <!nodoc> usr/share/man/man1/hexdump.1
 <!nodoc> usr/share/man/man1/look.1
 <!nodoc> usr/share/man/man1/ul.1
+<!nodoc> usr/share/man/man1/write.1

debian/changelog

@@ -1,3 +1,10 @@
+util-linux (2.40.4-3deepin3) unstable; urgency=medium
+
+  * Use reduce setgid to fix CVE-2024-28085, compile and 
+  *     install write, utmpdump, mesg.
+
+ -- xinpeng.wang <wangxinpeng@uniontech.com>  Thu, 13 Feb 2025 14:10:34 +0800
+
 util-linux (2.40.4-3deepin2) unstable; urgency=medium
 
   * Port the code about umac to V25 of UOS.

debian/rules

@@ -27,8 +27,10 @@ endif
 endif
 
 # As a result of CVE-2024-28085, we no longer install mesg/write.
-CONFOPTS += --disable-mesg
-CONFOPTS += --disable-write
+#CONFOPTS += --disable-mesg
+#CONFOPTS += --disable-write
+
+CONFOPTS += --enable-write
 
 # build static versions of programs used in fdisk-udeb and util-linux-udeb
 CONFOPTS += --enable-static-programs=fdisk,sfdisk,blkid
@@ -45,11 +47,15 @@ CONFOPTS += --disable-chfn-chsh
 # => bsdmainutils
 CONFOPTS += --disable-cal
 # => wtmpdb
-CONFOPTS += --disable-last --disable-utmpdump
+#CONFOPTS += --disable-last --disable-utmpdump
+CONFOPTS += --disable-last
 
 # Keep hwclock as GPLv2 (and others)
 CONFOPTS += --disable-hwclock-gplv3
 
+# Reduce setgid programs (cf. CVE-2024-28085)
+CONFOPTS += --disable-use-tty-group
+
 ifeq ($(DEB_HOST_ARCH),hurd-i386)
 # hurd porters plan to drop 32bit before 2038
 	CONFOPTS += --disable-year2038

debian/util-linux-locales.install

@@ -9,6 +9,7 @@ usr/share/locale/*/*/util-linux.mo
 <!nodoc> debian/tmp/usr/share/man/*/man1/hexdump.1
 <!nodoc> debian/tmp/usr/share/man/*/man1/look.1
 <!nodoc> debian/tmp/usr/share/man/*/man1/ul.1
+<!nodoc> debian/tmp/usr/share/man/*/man1/write.1
 
 # bsdutils
 <!nodoc> debian/tmp/usr/share/man/*/man1/logger.1

debian/util-linux.install

@@ -34,6 +34,7 @@ usr/bin/ipcs
 usr/bin/isosize usr/sbin/
 [linux-any] usr/bin/lsns
 usr/bin/mcookie
+usr/bin/mesg
 [mips mipsel] usr/bin/mips
 [mips mipsel] usr/bin/mips32
 [mips mipsel] usr/bin/mips64
@@ -46,6 +47,7 @@ usr/bin/rev
 [s390x] usr/bin/s390x
 [linux-any] usr/bin/setpriv
 usr/bin/setsid
+usr/bin/utmpdump
 usr/bin/whereis
 [amd64] usr/bin/x86_64
 [linux-any] bin/dmesg usr/bin/
@@ -97,6 +99,7 @@ usr/bin/lslogins
 <!nodoc> usr/share/man/man1/lslogins.1
 [linux-any] <!nodoc> usr/share/man/man1/lsmem.1
 <!nodoc> usr/share/man/man1/mcookie.1
+<!nodoc> usr/share/man/man1/mesg.1
 [linux-any] <!nodoc> usr/share/man/man1/more.1
 <!nodoc> usr/share/man/man1/mountpoint.1
 <!nodoc> usr/share/man/man1/namei.1
@@ -112,6 +115,7 @@ usr/bin/lslogins
 [linux-any] <!nodoc> usr/share/man/man1/taskset.1
 [linux-any] <!nodoc> usr/share/man/man1/uclampset.1
 [linux-any] <!nodoc> usr/share/man/man1/unshare.1
+<!nodoc> usr/share/man/man1/utmpdump.1
 <!nodoc> usr/share/man/man1/whereis.1
 <!nodoc> usr/share/man/man5/adjtime_config.5
 <!nodoc> usr/share/man/man5/terminal-colors.d.5