nixpkgs-suyu/pkgs/os-specific/linux/util-linux/default.nix
Jörg Thalheim 4b9b1fa945
util-linux: remove seccomp sandbox for CVE-2016-2279
the patch for CVE-2016-2779 was reverted by upstream and was not adopted
by any other downstream distributions. Upstream waits for a better fix
in the kernel:
https://www.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-ReleaseNotes
2017-01-19 15:10:18 +01:00

74 lines
2.5 KiB
Nix

{ lib, stdenv, fetchurl, pkgconfig, zlib, fetchpatch
, ncurses ? null, perl ? null, pam, systemd, minimal ? false }:
stdenv.mkDerivation rec {
name = "util-linux-${version}";
version = lib.concatStringsSep "." ([ majorVersion ]
++ lib.optional (patchVersion != "") patchVersion);
majorVersion = "2.29";
patchVersion = "";
src = fetchurl {
url = "mirror://kernel/linux/utils/util-linux/v${majorVersion}/${name}.tar.xz";
sha256 = "1rzrmdrz51p9sy7vlw5qmj8pmqazm7hgcch5yq242mkvrikyln9c";
};
patches = [ ./rtcwake-search-PATH-for-shutdown.patch ];
outputs = [ "bin" "dev" "out" "man" ];
#FIXME: make it also work on non-nixos?
postPatch = ''
# Substituting store paths would create a circular dependency on systemd
substituteInPlace include/pathnames.h \
--replace "/bin/login" "/run/current-system/sw/bin/login" \
--replace "/sbin/shutdown" "/run/current-system/sw/bin/shutdown"
'';
crossAttrs = {
# Work around use of `AC_RUN_IFELSE'.
preConfigure = "export scanf_cv_type_modifier=ms";
};
# !!! It would be better to obtain the path to the mount helpers
# (/sbin/mount.*) through an environment variable, but that's
# somewhat risky because we have to consider that mount can setuid
# root...
configureFlags = ''
--enable-write
--enable-last
--enable-mesg
--disable-use-tty-group
--enable-fs-paths-default=/var/setuid-wrappers:/var/run/current-system/sw/bin:/sbin
${if ncurses == null then "--without-ncurses" else ""}
${if systemd == null then "" else ''
--with-systemd
--with-systemdsystemunitdir=$out/lib/systemd/system/
''}
'';
makeFlags = "usrbin_execdir=$(bin)/bin usrsbin_execdir=$(bin)/sbin";
nativeBuildInputs = [ pkgconfig ];
buildInputs =
[ zlib pam ]
++ lib.optional (ncurses != null) ncurses
++ lib.optional (systemd != null) systemd
++ lib.optional (perl != null) perl;
postInstall = ''
rm "$bin/bin/su" # su should be supplied by the su package (shadow)
'' + lib.optionalString minimal ''
rm -rf $out/share/{locale,doc,bash-completion}
'';
enableParallelBuilding = true;
meta = with lib; {
homepage = https://www.kernel.org/pub/linux/utils/util-linux/;
description = "A set of system utilities for Linux";
license = licenses.gpl2; # also contains parts under more permissive licenses
platforms = platforms.linux;
priority = 6; # lower priority than coreutils ("kill") and shadow ("login" etc.) packages
};
}