security
/
fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

nix: remove absolute Exec paths
test / test (push) Successful in 26s Details 

Absolute paths set for Exec causes the program to be launched as the privileged user.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This commit is contained in:
Ophestra Umiker 2024-11-08 02:05:47 +09:00
parent 3962705126
commit 431aa32291
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
nixos.nix
View File

@ -402,7 +402,7 @@ in
shares: name: launcher: shares: name: launcher:
let let
pkg = if launcher.share != null then launcher.share else pkgs.${name}; pkg = if launcher.share != null then launcher.share else pkgs.${name};
link = source: "[ -d '${source}' ] && ln -sv '${source}' $out/share || true"; copy = source: "[ -d '${source}' ] && cp -Lrv '${source}' $out/share || true";
in in
shares shares
++ ++
@ -410,9 +410,13 @@ in
( (
pkgs.runCommand "${name}-share" { } '' pkgs.runCommand "${name}-share" { } ''
mkdir -p $out/share mkdir -p $out/share
${link "${pkg}/share/applications"} ${copy "${pkg}/share/applications"}
${link "${pkg}/share/icons"} ${copy "${pkg}/share/icons"}
${link "${pkg}/share/man"} ${copy "${pkg}/share/man"}
substituteInPlace $out/share/applications/* \
--replace-warn '${pkg}/bin/' "" \
--replace-warn '${pkg}/libexec/' ""
'' ''
) )
) (wrap user target.launchers) target.launchers) ) (wrap user target.launchers) target.launchers)