alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

dash: add patch to prevent code execution when noexec is set

Browse source 
Dashs noexec flag `-n` did not work as documented, which could result in
code being inadvertently executed.
This commit is contained in:
Martin Weinelt 2020-11-23 15:42:27 +01:00 committed by Jonathan Ringer
parent 97597f09c0
commit 9ac42658f9
1 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
pkgs/shells/dash/default.nix
View file

@ -1,17 +1,25 @@
{ stdenv, buildPackages, autoreconfHook, fetchurl }: { stdenv, buildPackages, autoreconfHook, fetchurl }:
stdenv.mkDerivation rec { stdenv.mkDerivation rec {
name = "dash-0.5.11.2"; pname = "dash";
version = "0.5.11.2";
src = fetchurl { src = fetchurl {
url = "http://gondor.apana.org.au/~herbert/dash/files/${name}.tar.gz"; url = "http://gondor.apana.org.au/~herbert/dash/files/${pname}-${version}.tar.gz";
sha256 = "0pvdpm1cgfbc25ramn4305a0158yq031q1ain4dc972rnxl7vyq0"; sha256 = "0pvdpm1cgfbc25ramn4305a0158yq031q1ain4dc972rnxl7vyq0";
}; };
hardeningDisable = [ "format" ]; hardeningDisable = [ "format" ];
# Temporary fix until a proper one is accepted upstream # Temporary fix until a proper one is accepted upstream
patches = stdenv.lib.optional stdenv.isDarwin ./0001-fix-dirent64-et-al-on-darwin.patch; patches = [
(fetchurl {
# Dash executes code when noexec ("-n") is specified
# https://www.openwall.com/lists/oss-security/2020/11/11/3
url = "https://git.kernel.org/pub/scm/utils/dash/dash.git/patch/?id=29d6f2148f10213de4e904d515e792d2cf8c968e";
sha256 = "08q90bx36ixwlcj331dh7420qyj8i0qh1cc1gljrhd83fhl9w0y5";
})
] ++ stdenv.lib.optional stdenv.isDarwin ./0001-fix-dirent64-et-al-on-darwin.patch;
depsBuildBuild = [ buildPackages.stdenv.cc ]; depsBuildBuild = [ buildPackages.stdenv.cc ];
nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin autoreconfHook; nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin autoreconfHook;