* SECURITY UPDATE: TOCTOU symlink traversal in getfacl, setfacl and chacl - debian/patches/CVE-2026-54370.patch: walk trees through directory file descriptors and act on the final pathname component with symlink-safe calls in tools/getfacl.c, tools/setfacl.c, tools/do_set.c and tools/chacl.c - the *at() ACL operations the hardened tools need are private helpers in tools/acl_at.c, so libacl's public ABI and installed headers are unchanged - setfacl --restore is symlink-safe only when invoked with -P: without it the backup's pathnames are still resolved by name, so stat, chown, chmod and the ACL write still follow symlinks; upstream's warning about that is built out with --disable-unsafe-restore-warnings, so --restore output is unchanged for scripts that parse stderr - getfacl -P and setfacl -P now fail with ELOOP on a symlink argument instead of silently ignoring it - in the recursive default mode a toplevel symlink-to-directory argument is now descended into, where 2.2.53 applied to the toplevel entry only; 'setfacl -R ' therefore writes to the whole subtree (upstream 2.4.0 walk_tree semantics) - chacl on a symlink given on the command line now fails with "Operation not supported" instead of acting on the symlink's target - getfacl no longer strips a leading './' from pathnames, so 'getfacl -R ./dir' prints '# file: ./dir' for the toplevel entry - the symlink-safe paths need /proc mounted: without it getfacl and setfacl warn and then fail with EACCES ("Permission denied"), instead of falling back to the ACL derived from the file mode, which would drop every named entry and still exit successfully - debian/rules: configure with --disable-unsafe-restore-warnings, and skip test/root/permissions.test and test/root/setfacl.test on build hosts whose build tree is not reachable by unprivileged users, where they fail regardless of this patch - CVE-2026-54370