shadow: add runtime-shell.patch

This gets the right shell in the closure.

By default, shadow wants to pull in the bash we are building it with,
while we would prefer it used the runtime bash.

pkgs/os-specific/linux/shadow/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt
-, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison
+, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison, runtimeShell
 , pam ? null, glibcCross ? null
 }:
 
@@ -38,8 +38,11 @@ stdenv.mkDerivation rec {
       # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
       ./respect-xml-catalog-files-var.patch
       dots_in_usernames
+      ./runtime-shell.patch
     ];
 
+  RUNTIME_SHELL = runtimeShell;
+
   # The nix daemon often forbids even creating set[ug]id files.
   postPatch =
     ''sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
@@ -77,6 +80,8 @@ stdenv.mkDerivation rec {
       mv $out/bin/su $su/bin
     '';
 
+  disallowedReferences = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.shellPackage;
+
   meta = with lib; {
     homepage = "https://github.com/shadow-maint";
     description = "Suite containing authentication-related tools such as passwd and su";