[rpms/proftpd] epel9: Add mod_procfs, enabled by default

[rpms/proftpd] epel9: Add mod_procfs, enabled by default

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel9
            Commit : c6de05f4f686a0c47eea73e9d5b8eede7086ba3f
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-27T16:23:34+01:00
            Stats  : +26/-7 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/c6de05f4f686a0c47eea73e9d5b8eede7086ba3f?branch=epel9

            Log:
            Add mod_procfs, enabled by default

This addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix);
the mod_procfs module disallows file accesses via procfs filesystems.

---
diff --git a/.gitignore b/.gitignore
index 697a1ba..3af5635 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,13 +1,13 @@
-# rawhide/f44/f43/f42/epel10
-# note: the v0.9.5.tar.gz is mod_proxy
-/proftpd-1.3.9a.tar.gz
+# rawhide/f44/f43/epel10
+/proftpd-1.3.9c.tar.gz
 /v0.9.12.tar.gz
-/v0.9.5.tar.gz
+/v0.9.7.tar.gz
+/v0.2.tar.gz
 # epel9
 /proftpd-1.3.8d.tar.gz
 /v0.9.11.tar.gz
 /v0.9.4.tar.gz
+/v0.2.tar.gz
 # epel8
-# note: the v0.9.5.tar.gz is mod_vroot
 /proftpd-1.3.6e.tar.gz
 /v0.9.5.tar.gz

diff --git a/modules.conf b/modules.conf
index 1a1ae45..b7c2a6d 100644
--- a/modules.conf
+++ b/modules.conf
@@ -92,6 +92,15 @@ LoadModule mod_ctrls_admin.c
 # (http://www.proftpd.org/docs/contrib/mod_load.html)
 #   LoadModule mod_load.c
 #
+# Restrict the visibility and usage of the /proc filesystem directory
+# (https://htmlpreview.github.io/?https://github.com/Castaglia/proftpd-mod_procfs/blob/main/mod_procfs.html)
+LoadModule mod_procfs.c
+#
+# Proxy FTP/FTPS connections, supporting both forward and reverse proxy
+# configurations
+# (https://htmlpreview.github.io/?https://github.com/Castaglia/proftpd-mod_proxy/blob/master/mod_proxy.html)
+#   LoadModule mod_proxy.c
+#
 # Limit downloads to a multiple of upload volume (see README.ratio)
 #   LoadModule mod_ratio.c
 #

diff --git a/proftpd.spec b/proftpd.spec
index 94f437a..06d507e 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -39,6 +39,7 @@
 
 #global prever rc4
 %global baserelease 4
+%global mod_procfs_version 0.2
 %global mod_proxy_version 0.9.4
 %global mod_vroot_version 0.9.11
 
@@ -60,6 +61,7 @@ Source8:		proftpd-welcome.msg
 Source9:		proftpd.sysconfig
 Source10:		http://github.com/Castaglia/proftpd-mod_vroot/archive/v%{mod_vroot_version}.tar.gz
 Source11:		http://github.com/Castaglia/proftpd-mod_proxy/archive/v%{mod_proxy_version}.tar.gz
+Source12:		http://github.com/Castaglia/proftpd-mod_procfs/archive/v%{mod_procfs_version}.tar.gz
 
 Patch1:			proftpd-1.3.8-shellbang.patch
 Patch3:			proftpd-1.3.4rc1-mod_vroot-test.patch
@@ -247,11 +249,14 @@ ProFTPD server:
 %prep
 %setup -q -n %{name}-%{version}%{?prever}
 
-# Extract mod_proxy and mod_vroot source into contrib/
+# Extract mod_procfs, mod_proxy and mod_vroot source into contrib/
 # Directories must be named mod_{proxy,vroot} for configure script to find them
+# The mod_procfs module is a single C file that just needs to be copied into contrib/
 cd contrib
 tar xfz %{SOURCE10}
 tar xfz %{SOURCE11}
+tar xfz %{SOURCE12}
+cp proftpd-mod_procfs-%{mod_procfs_version}/mod_procfs.c .
 mv proftpd-mod_proxy-%{mod_proxy_version} mod_proxy
 mv proftpd-mod_vroot-%{mod_vroot_version} mod_vroot
 cd -
@@ -350,7 +355,7 @@ SMOD3=mod_ldap:mod_ban%{?libwrap_support::mod_wrap}:mod_ctrls_admin:mod_facl:mod
 SMOD4=mod_radius:mod_ratio:mod_rewrite:mod_site_misc:mod_exec:mod_shaper
 SMOD5=mod_wrap2:mod_wrap2_file:mod_wrap2_sql:mod_copy:mod_deflate:mod_ifversion:mod_qos
 SMOD6=mod_sftp:mod_sftp_pam:mod_sftp_sql:mod_tls_shmcache:mod_tls_memcache
-SMOD7=%{?mod_proxy_support}mod_unique_id
+SMOD7=mod_procfs:%{?mod_proxy_support}mod_unique_id
 
 %configure \
 			--libexecdir="%{_libexecdir}/proftpd" \
@@ -500,6 +505,7 @@ fi
 %{_libexecdir}/proftpd/mod_ifsession.so
 %{_libexecdir}/proftpd/mod_ifversion.so
 %{_libexecdir}/proftpd/mod_load.so
+%{_libexecdir}/proftpd/mod_procfs.so
 %{_libexecdir}/proftpd/mod_qos.so
 %{_libexecdir}/proftpd/mod_quotatab.so
 %{_libexecdir}/proftpd/mod_quotatab_file.so
@@ -580,6 +586,9 @@ fi
   as it could possibly overflow our size type (CVE-2026-63091)
 - Authenticated SFTP sessions could overflow the SFTP packet buffer
   (CVE-2026-63090, https://github.com/proftpd/proftpd/issues/2190)
+- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
+  /proc/self/root path prefix); this module disallows file accesses via procfs
+  filesystems
 
 * Mon May 11 2026 Paul Howarth <paul@city-fan.org> - 1.3.8d-3
 - Additional escaping for avoidance of SQL injection issues with %%{note:...}

diff --git a/sources b/sources
index 46fccff..c69d337 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,4 @@
 SHA512 (proftpd-1.3.8d.tar.gz) = 476ab9fdff66fc577fea4931778f09a73b6dc8cd09723e582c051790629dd33759849f94f8387f066e0fb4c896293da78c074d017e28e8476076e8c8c2cde9af
 SHA512 (v0.9.11.tar.gz) = b0f212d00111260c73f4a587ca993cdae05b94e57fb6cab2e67c2f675be50af1c5ffe7f17edcf93d229a7a9f1a960436f928e3df2b43d5de975cdc97bd618601
 SHA512 (v0.9.4.tar.gz) = b264b60f99e6606d2c70c4487b7d135a50db8709c7e0f74d39fe28780f18168b6f836073e0e4a7d482dfbe7aec88f2db55828d5bc256920f7a6cf9dc22e83740
+SHA512 (v0.2.tar.gz) = 0e4da18e2eda0762a2b0772a5ac96355560dbcbb92cb64b50b58160c60d3c34df09c40706dabd15cbc19d59e11de140ff90fc73a588b4a843a03f672e55f93bb