Re: Bug#1142348: ITP: proftpd-mod-procfs -- ProFTPD module mod_procfs

Bastien Roucaries <[email protected]> Sat, 18 Jul 2026 11:15:56 +0200

Newsgroups	gmane.linux.debian.devel.general
Message-ID	<2897288.MsWZr2WtbB@debian-ei>

Le samedi 18 juillet 2026, 11:11:07 heure d’été d’Europe centrale Hilmar Preusse a écrit :
> Package: wnpp
> Severity: wishlist
> Owner: Hilmar Preuße <[email protected]>
> X-Debbugs-Cc: [email protected]
> 
> * Package name    : proftpd-mod-procfs
>   Version         : 0.1
>   Upstream Contact: TJ Saunders
> * URL             : https://github.com/Castaglia/proftpd-mod_procfs
> * License         : GPL-2+
>   Programming Lang: C
>   Description     : ProFTPD module mod_procfs
> 
> The mod_procfs module for ProFTPD affects the visibility and use of the
> /proc filesystem directory that is commonly available.
> The idea is to mitigate CVE-2026-35025 by limiting access to procfs.
> 
> Upstream refuses to solve CVE-2026-35025 by doing code changes. Instead
> it is suggested to deny access to the /proc file system. This is exactly,
> what is done by that module.

Why does we could not use systemd restriction ?

rouca
> 
> I'm a part of the ProFTP team and I intend to maintain the package in
> the team.
>

signature.asc (application/pgp-signature, 833 B)