Merge pull request #26939 from dtzWill/fix/perms-fallout-misc-2

Fixup various setuid/setgid permission problems, part 2

pkgs/development/libraries/libutempter/default.nix

@@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ glib ];
 
+  prePatch = ''
+    substituteInPlace Makefile --replace 2711 0711
+  '';
+
   installFlags = [
     "libdir=\${out}/lib"
     "libexecdir=\${out}/lib"

pkgs/development/libraries/wcslib/default.nix

@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 ="1s2nig327g4bimd9xshlk11ww09a7mrjmsbpdcd8smsmn2kl1glb";
   };
 
+  prePatch = ''
+    substituteInPlace GNUmakefile --replace 2775 0775
+    substituteInPlace C/GNUmakefile --replace 2775 0775
+  '';
+
   enableParallelBuilding = true;
 
   meta = {

pkgs/os-specific/linux/firejail/default.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   '';
 
   preBuild = ''
-    sed -e "s@/etc/@$out/etc/@g" -i Makefile
+    sed -e "s@/etc/@$out/etc/@g" -e "/chmod u+s/d" -i Makefile
   '';
 
   meta = {

pkgs/os-specific/linux/kbdlight/default.nix

@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     substituteInPlace Makefile \
-      --replace /usr/local $out
+      --replace /usr/local $out \
+      --replace 4755 0755
   '';
 
   meta = with stdenv.lib; {

pkgs/servers/mail/mailman/default.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
 
   installTargets = "doinstall";         # Leave out the 'update' target that's implied by 'install'.
 
+  makeFlags = [ "DIRSETGID=:" ];
+
   meta = {
     homepage = "http://www.gnu.org/software/mailman/";
     description = "Free software for managing electronic mail discussion and e-newsletter lists";

pkgs/servers/news/leafnode/default.nix

@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--enable-runas-user=nobody";
 
+  prePatch = ''
+    substituteInPlace Makefile.in --replace 02770 0770
+  '';
+
   preConfigure = ''
     # configure uses id to check environment; we don't want this check
     sed -re 's/^ID[=].*/ID="echo whatever"/' -i configure

pkgs/tools/filesystems/irods/default.nix

@@ -40,6 +40,8 @@ in rec {
         -DCMAKE_MODULE_LINKER_FLAGS=-Wl,-rpath,$out/lib
         -DCMAKE_SHARED_LINKER_FLAGS=-Wl,-rpath,$out/lib
         "
+
+      substituteInPlace cmake/server.cmake --replace SETUID ""
     '';
 
     meta = common.meta // {

pkgs/tools/misc/ddccontrol/default.nix

@@ -28,6 +28,8 @@ stdenv.mkDerivation {
       oldPath+="{datadir}\/ddccontrol-db"
       sed "s/$oldPath/$newPath/" <configure.ac.old >configure.ac
       rm configure.ac.old
+
+      sed -e "s/chmod 4711/chmod 0711/" -i src/ddcpci/Makefile*
   '';
 
   meta = with stdenv.lib; {

pkgs/tools/networking/mailutils/default.nix

@@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
 
   patches = [ ./path-to-cat.patch ./no-gets.patch ./scm_c_string.patch ];
 
+  postPatch = ''
+    sed -i -e '/chown root:mail/d' \
+           -e 's/chmod [24]755/chmod 0755/' \
+      */Makefile{,.in,.am}
+  '';
+
   configureFlags = [
     "--with-gsasl"
     "--with-gssapi=${gss}"

pkgs/tools/networking/netselect/default.nix

@@ -8,10 +8,13 @@ stdenv.mkDerivation {
     sha256 = "0y69z59vylj9x9nk5jqn6ihx7dkzg09gpv2w1q1rs8fmi4jr90gy";
   };
 
-  preBuild = "
+  preBuild = ''
     makeFlagsArray=(PREFIX=$out)
-    substituteInPlace Makefile --replace '-o root' '' --replace '-g root' ''
-  ";
+    substituteInPlace Makefile \
+      --replace "-o root" "" \
+      --replace "-g root" "" \
+      --replace "4755"    "0755"
+  '';
   
   meta = {
     homepage = http://alumnit.ca/~apenwarr/netselect/;

pkgs/tools/system/mcron/default.nix

@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./install-vixie-programs.patch ];
 
+  # don't attempt to chmod +s files in the nix store
+  postPatch = ''
+    substituteInPlace makefile.in --replace "rwxs" "rwx"
+  '';
+
   buildInputs = [ guile which ed ];
 
   doCheck = true;