public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

treewide: Fix unsafe concatenation of $LD_LIBRARY_PATH

Browse Source 
Naive concatenation of $LD_LIBRARY_PATH can result in an empty
colon-delimited segment; this tells glibc to load libraries from the
current directory, which is definitely wrong, and may be a security
vulnerability if the current directory is untrusted.  (See #67234, for
example.)  Fix this throughout the tree.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
This commit is contained in:
Anders Kaseorg
2020-01-15 09:47:03 +01:00
committed by Frederik Rietdijk
parent 2e5051e223
commit 3cd8ce3bce
48 changed files with 55 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/development/compilers/halide/default.nix
+1 -1
View File
@@ -29,7 +29,7 @@ in llvmPackages.stdenv.mkDerivation {
# To handle the lack of 'local' RPATH; required, as they call one of
# their built binaries requiring their libs, in the build process.
preBuild = ''
export LD_LIBRARY_PATH="$(pwd)/lib:$LD_LIBRARY_PATH"
export LD_LIBRARY_PATH="$(pwd)/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
'';
enableParallelBuilding = true;
pkgs/development/compilers/llvm/4/llvm.nix
+1 -1
View File
@@ -143,7 +143,7 @@ stdenv.mkDerivation ({
'';
preCheck = ''
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
'';
postInstall = stdenv.lib.optionalString enableSharedLibraries ''
pkgs/development/compilers/llvm/5/llvm.nix
+1 -1
View File
@@ -119,7 +119,7 @@ stdenv.mkDerivation ({
'';
preCheck = ''
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
'';
postInstall = ''
pkgs/development/compilers/llvm/6/llvm.nix
+1 -1
View File
@@ -120,7 +120,7 @@ stdenv.mkDerivation ({
'';
preCheck = ''
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
'';
postInstall = ''
pkgs/development/compilers/llvm/7/llvm.nix
+1 -1
View File
@@ -141,7 +141,7 @@ in stdenv.mkDerivation ({
'';
preCheck = ''
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
'';
postInstall = ''
pkgs/development/compilers/llvm/8/llvm.nix
+1 -1
View File
@@ -117,7 +117,7 @@ in stdenv.mkDerivation ({
'';
preCheck = ''
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
'';
postInstall = ''
pkgs/development/compilers/llvm/9/llvm.nix
+1 -1
View File
@@ -134,7 +134,7 @@ in stdenv.mkDerivation (rec {
'';
preCheck = ''
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
'';
postInstall = ''
pkgs/development/compilers/mlton/20130715.nix
+1 -1
View File
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
chmod u+x $(pwd)/../${usr_prefix}/bin/mlton
# So the builder runs the binary compiler with gmp.
export LD_LIBRARY_PATH=${gmp.out}/lib:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=${gmp.out}/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
'' + stdenv.lib.optionalString stdenv.isLinux ''
# Patch ELF interpreter.
pkgs/development/compilers/solc/default.nix
+1 -1
View File
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
checkPhase = ''
while IFS= read -r -d ''' dir
do
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(pwd)/$dir
LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/$dir
export LD_LIBRARY_PATH
done < <(find . -type d -print0)