mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-12-16 18:03:22 +00:00
3cd8ce3bce
Naive concatenation of $LD_LIBRARY_PATH can result in an empty colon-delimited segment; this tells glibc to load libraries from the current directory, which is definitely wrong, and may be a security vulnerability if the current directory is untrusted. (See #67234, for example.) Fix this throughout the tree. Signed-off-by: Anders Kaseorg <andersk@mit.edu>
35 lines
1.2 KiB
Nix
35 lines
1.2 KiB
Nix
# For a 64bit + 32bit system the LD_LIBRARY_PATH must contain both the 32bit and 64bit primus
|
|
# libraries. Providing a different primusrun for each architecture will not work as expected. EG:
|
|
# Using steam under wine can involve both 32bit and 64bit process. All of which inherit the
|
|
# same LD_LIBRARY_PATH.
|
|
# Other distributions do the same.
|
|
{ stdenv
|
|
, stdenv_i686
|
|
, lib
|
|
, primusLib
|
|
, writeScriptBin
|
|
, runtimeShell
|
|
, primusLib_i686 ? null
|
|
, useNvidia ? true
|
|
}:
|
|
|
|
let
|
|
# We override stdenv in case we need different ABI for libGL
|
|
primusLib_ = primusLib.override { inherit stdenv; };
|
|
primusLib_i686_ = primusLib_i686.override { stdenv = stdenv_i686; };
|
|
|
|
primus = if useNvidia then primusLib_ else primusLib_.override { nvidia_x11 = null; };
|
|
primus_i686 = if useNvidia then primusLib_i686_ else primusLib_i686_.override { nvidia_x11 = null; };
|
|
ldPath = lib.makeLibraryPath (lib.filter (x: x != null) (
|
|
[ primus primus.glvnd ]
|
|
++ lib.optionals (primusLib_i686 != null) [ primus_i686 primus_i686.glvnd ]
|
|
));
|
|
|
|
in writeScriptBin "primusrun" ''
|
|
#!${runtimeShell}
|
|
export LD_LIBRARY_PATH=${ldPath}''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
|
|
# https://bugs.launchpad.net/ubuntu/+source/bumblebee/+bug/1758243
|
|
export __GLVND_DISALLOW_PATCHING=1
|
|
exec "$@"
|
|
''
|