[rpms/proftpd] epel10: Add mod_procfs, enabled by default

[rpms/proftpd] epel10: Add mod_procfs, enabled by default

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel10
            Commit : e4415db90b9e0eb21e91c6bf428f41575fe5c833
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-21T17:56:58+01:00
            Stats  : +33/-6 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/e4415db90b9e0eb21e91c6bf428f41575fe5c833?branch=epel10

            Log:
            Add mod_procfs, enabled by default

This addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix);
the mod_procfs module disallows file accesses via procfs filesystems.

---
diff --git a/.gitignore b/.gitignore
index 2754037..d5b3a4d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 /proftpd-1.3.9c.tar.gz
 /v0.9.12.tar.gz
 /v0.9.7.tar.gz
+/v0.2.tar.gz
 # epel9
 /proftpd-1.3.8d.tar.gz
 /v0.9.11.tar.gz

diff --git a/modules.conf b/modules.conf
index 524604f..17e9c7f 100644
--- a/modules.conf
+++ b/modules.conf
@@ -92,6 +92,15 @@ LoadModule mod_ctrls_admin.c
 # (http://www.proftpd.org/docs/contrib/mod_load.html)
 #   LoadModule mod_load.c
 #
+# Restrict the visibility and usage of the /proc filesystem directory
+# (https://htmlpreview.github.io/?https://github.com/Castaglia/proftpd-mod_procfs/blob/main/mod_procfs.html)
+LoadModule mod_procfs.c
+#
+# Proxy FTP/FTPS connections, supporting both forward and reverse proxy
+# configurations
+# (https://htmlpreview.github.io/?https://github.com/Castaglia/proftpd-mod_proxy/blob/master/mod_proxy.html)
+#   LoadModule mod_proxy.c
+#
 # Limit downloads to a multiple of upload volume (see README.ratio)
 #   LoadModule mod_ratio.c
 #

diff --git a/proftpd.spec b/proftpd.spec
index a49cd47..4caa4fd 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -17,7 +17,8 @@
 %undefine _strict_symbol_defs_build
 
 #global prever rc4
-%global baserelease 1
+%global baserelease 3
+%global mod_procfs_version 0.2
 %global mod_proxy_version 0.9.7
 %global mod_vroot_version 0.9.12
 
@@ -39,6 +40,7 @@ Source8:		proftpd-welcome.msg
 Source9:		proftpd.sysconfig
 Source10:		http://github.com/Castaglia/proftpd-mod_vroot/archive/v%{mod_vroot_version}.tar.gz
 Source11:		http://github.com/Castaglia/proftpd-mod_proxy/archive/v%{mod_proxy_version}.tar.gz
+Source12:		http://github.com/Castaglia/proftpd-mod_procfs/archive/v%{mod_procfs_version}.tar.gz
 
 Patch1:			proftpd-1.3.8-shellbang.patch
 Patch2:			mod_proxy-certificate.patch
@@ -119,7 +121,7 @@ Summary:	ProFTPD - Tools and header files for developers
 Requires:	%{name} = %{version}-%{release}
 # devel package requires the same devel packages as were build-required
 # for the main package
-Requires:	gcc, libtool
+Requires:	gcc
 Requires:	libacl-devel
 Requires:	libcap-devel
 Requires:	%{libmemcached_pkg}-devel >= 0.41
@@ -195,11 +197,14 @@ ProFTPD server:
 %prep
 %setup -q -n %{name}-%{version}%{?prever}
 
-# Extract mod_proxy and mod_vroot source into contrib/
+# Extract mod_procfs, mod_proxy and mod_vroot source into contrib/
 # Directories must be named mod_{proxy,vroot} for configure script to find them
+# The mod_procfs module is a single C file that just needs to be copied into contrib/
 cd contrib
 tar xfz %{SOURCE10}
 tar xfz %{SOURCE11}
+tar xfz %{SOURCE12}
+cp proftpd-mod_procfs-%{mod_procfs_version}/mod_procfs.c .
 mv proftpd-mod_proxy-%{mod_proxy_version} mod_proxy
 mv proftpd-mod_vroot-%{mod_vroot_version} mod_vroot
 cd -
@@ -245,7 +250,7 @@ SMOD3=mod_ldap:mod_ban:mod_ctrls_admin:mod_facl:mod_load:mod_vroot
 SMOD4=mod_radius:mod_ratio:mod_rewrite:mod_site_misc:mod_exec:mod_shaper
 SMOD5=mod_wrap2:mod_wrap2_file:mod_wrap2_sql:mod_copy:mod_deflate:mod_ifversion:mod_qos
 SMOD6=mod_sftp:mod_sftp_pam:mod_sftp_sql:mod_tls_shmcache:mod_tls_memcache
-SMOD7=mod_proxy:mod_unique_id
+SMOD7=mod_procfs:mod_proxy:mod_unique_id
 
 %configure \
 			--libexecdir="%{_libexecdir}/proftpd" \
@@ -268,6 +273,7 @@ SMOD7=mod_proxy:mod_unique_id
 			--with-includes="%{_includedir}/mysql" \
 			--with-modules=mod_readme:mod_auth_pam:mod_tls \
 			--with-shared=${SMOD1}:${SMOD2}:${SMOD3}:${SMOD4}:${SMOD5}:${SMOD6}:${SMOD7}:mod_ifsession
+
 %{make_build}
 
 %install
@@ -393,6 +399,7 @@ fi
 %{_libexecdir}/proftpd/mod_ifsession.so
 %{_libexecdir}/proftpd/mod_ifversion.so
 %{_libexecdir}/proftpd/mod_load.so
+%{_libexecdir}/proftpd/mod_procfs.so
 %{_libexecdir}/proftpd/mod_qos.so
 %{_libexecdir}/proftpd/mod_quotatab.so
 %{_libexecdir}/proftpd/mod_quotatab_file.so
@@ -461,6 +468,11 @@ fi
 %{_mandir}/man1/ftpwho.1*
 
 %changelog
+* Tue Jul 21 2026 Paul Howarth <paul@city-fan.org> - 1.3.9c-3
+- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
+  /proc/self/root path prefix); this module disallows file accesses via procfs
+  filesystems
+
 * Wed Jul  8 2026 Paul Howarth <paul@city-fan.org> - 1.3.9c-1
 - Update to 1.3.9c
   - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
@@ -474,9 +486,12 @@ fi
     to reject illegal characters (GH#2173)
   - SQL group name lookup concatenates client-provided group names without
     escaping (GH#2188)
-  - Authenticated SFTP sessions can overflow the SFTP packet buffer (GH#2190)
+  - Authenticated SFTP sessions can overflow the SFTP packet buffer
+    (GH#2190, CVE-2026-63090)
   - Default Controls socket ACLs unintentionally allow all users access for
     sending Controls requests (GH#2210)
+  - Exercise caution when reading the client-provided file size for SCP
+    uploads, as it could possibly overflow our size type (CVE-2026-63091)
 
 * Mon Jun  8 2026 Paul Howarth <paul@city-fan.org> - 1.3.9b-1
 - Update to 1.3.9b
@@ -494,7 +509,8 @@ fi
     mod_sftp (GH#2106)
   - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
     mod_sftp (GH#2108)
-  - SFTP request payload length underflow calculation in mod_sftp (GH#2115)
+  - SFTP request payload length underflow calculation in mod_sftp
+    (GH#2115, CVE-2026-53994)
   - Several modules failed to build using OpenSSL 4.0 (GH#2120)
 - Update mod_proxy to 0.9.7
   - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)

diff --git a/sources b/sources
index e22e3a5..bd9bae4 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,4 @@
 SHA512 (proftpd-1.3.9c.tar.gz) = b5003a02af58281cbad73edd4de81848c27def76cec88b1d234c32f1d04a5c8aa54cf08958815d5a927280fb2c6973df6f04209731bc92eee0f8f635e5e3aa5b
 SHA512 (v0.9.12.tar.gz) = a84c14b9d05c4890abe50c86f832c91fa4d0971bc2b1866a3a34d73ff85acd1e902fc0cae739e22ea46e530c73230fb005ea9edeb68fd6cfb963e0c5ca9655ec
 SHA512 (v0.9.7.tar.gz) = 9979dc21ebebf5f219303769cebd73be9ab66ae7f50756fa12bdf37bcac1cdc9ac70feeb557ef16bb4bb3fcf8121aed4d16b6a0e5c0738bbcc53a0055410c3cd
+SHA512 (v0.2.tar.gz) = 0e4da18e2eda0762a2b0772a5ac96355560dbcbb92cb64b50b58160c60d3c34df09c40706dabd15cbc19d59e11de140ff90fc73a588b4a843a03f672e55f93bb