[rpms/proftpd] epel8: Add mod_procfs, enabled by default

[rpms/proftpd] epel8: Add mod_procfs, enabled by default

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : epel8
            Commit : 674260ab30b6104ec43538c73e248889e8fceee1
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-27T17:00:10+01:00
            Stats  : +17/-3 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/674260ab30b6104ec43538c73e248889e8fceee1?branch=epel8

            Log:
            Add mod_procfs, enabled by default

This addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix);
the mod_procfs module disallows file accesses via procfs filesystems.

---
diff --git a/.gitignore b/.gitignore
index 6a03569..de347a8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,6 @@
 /v0.9.4.tar.gz
 /v0.2.tar.gz
 # epel8
-# note: the v0.9.5.tar.gz is mod_vroot
 /proftpd-1.3.6e.tar.gz
 /v0.9.5.tar.gz
+/v0.2.tar.gz

diff --git a/modules.conf b/modules.conf
index 3e343ae..c84fab2 100644
--- a/modules.conf
+++ b/modules.conf
@@ -97,6 +97,10 @@ LoadModule mod_ctrls_admin.c
 # (http://www.proftpd.org/docs/contrib/mod_load.html)
 #   LoadModule mod_load.c
 #
+# Restrict the visibility and usage of the /proc filesystem directory
+# (https://htmlpreview.github.io/?https://github.com/Castaglia/proftpd-mod_procfs/blob/main/mod_procfs.html)
+LoadModule mod_procfs.c
+#
 # Limit downloads to a multiple of upload volume (see README.ratio)
 #   LoadModule mod_ratio.c
 #

diff --git a/proftpd.spec b/proftpd.spec
index 6b462e3..1f9d960 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -67,6 +67,7 @@
 
 #global prever rc3
 %global baserelease 11
+%global mod_procfs_version 0.2
 %global mod_vroot_version 0.9.5
 
 Summary:		Flexible, stable and highly-configurable FTP server
@@ -86,6 +87,7 @@ Source6:		anonftp.conf
 Source8:		proftpd-welcome.msg
 Source9:		proftpd.sysconfig
 Source10:		http://github.com/Castaglia/proftpd-mod_vroot/archive/v%{mod_vroot_version}.tar.gz
+Source12:		http://github.com/Castaglia/proftpd-mod_procfs/archive/v%{mod_procfs_version}.tar.gz
 
 Patch1:			proftpd-1.3.6c-shellbang.patch
 Patch2:			proftpd.conf-no-memcached.patch
@@ -278,10 +280,13 @@ ProFTPD server:
 %prep
 %setup -q -n %{name}-%{version}%{?prever}
 
-# Extract mod_vroot source into contrib/
+# Extract mod_procfs and mod_vroot source into contrib/
 # Directory must be named mod_vroot for configure script to find it
+# The mod_procfs module is a single C file that just needs to be copied into contrib/
 cd contrib
 tar xfz %{SOURCE10}
+tar xfz %{SOURCE12}
+cp proftpd-mod_procfs-%{mod_procfs_version}/mod_procfs.c .
 mv proftpd-mod_vroot-%{mod_vroot_version} mod_vroot
 cd -
 
@@ -427,7 +432,7 @@ SMOD3=mod_ldap:mod_ban%{?libwrap_support::mod_wrap}:mod_ctrls_admin:mod_facl:mod
 SMOD4=mod_radius:mod_ratio:mod_rewrite:mod_site_misc:mod_exec:mod_shaper%{?geoip_support::mod_geoip}
 SMOD5=mod_wrap2:mod_wrap2_file:mod_wrap2_sql:mod_copy:mod_deflate:mod_ifversion:mod_qos
 SMOD6=mod_sftp:mod_sftp_pam:mod_sftp_sql:mod_tls_shmcache%{?have_libmemcached::mod_tls_memcache}
-SMOD7=mod_unique_id
+SMOD7=mod_procfs:mod_unique_id
 
 %configure \
 			--libexecdir="%{_libexecdir}/proftpd" \
@@ -620,6 +625,7 @@ fi
 %{_libexecdir}/proftpd/mod_ifsession.so
 %{_libexecdir}/proftpd/mod_ifversion.so
 %{_libexecdir}/proftpd/mod_load.so
+%{_libexecdir}/proftpd/mod_procfs.so
 %{_libexecdir}/proftpd/mod_qos.so
 %{_libexecdir}/proftpd/mod_quotatab.so
 %{_libexecdir}/proftpd/mod_quotatab_file.so
@@ -692,6 +698,9 @@ fi
   as it could possibly overflow our size type (CVE-2026-63091)
 - Authenticated SFTP sessions could overflow the SFTP packet buffer
   (CVE-2026-63090, https://github.com/proftpd/proftpd/issues/2190)
+- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
+  /proc/self/root path prefix); this module disallows file accesses via procfs
+  filesystems
 
 * Mon May 11 2026 Paul Howarth <paul@city-fan.org> - 1.3.6e-10
 - Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname

diff --git a/sources b/sources
index ca3a2b6..10a8ee3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
 SHA512 (proftpd-1.3.6e.tar.gz) = 6652cca8d2e0efe069fe2f6b342c2afb8f9f85ef2365fc9958240f35b396c103dea766ce8a6676c087c1e95376aaf38705725bd645682d6d52900046788af38f
 SHA512 (v0.9.5.tar.gz) = 10e4de29d84c2f2f5e88502fcd62768e2b0797b05a95fc22b59605e3c7377bfe3609c99e2f6fc2a17f9c3a267ff815c651ae39be8b6cb133565a4590f767353d
+SHA512 (v0.2.tar.gz) = 0e4da18e2eda0762a2b0772a5ac96355560dbcbb92cb64b50b58160c60d3c34df09c40706dabd15cbc19d59e11de140ff90fc73a588b4a843a03f672e55f93bb