From 179936d75c7b8aa34cdf40b49c959b0b156e5ee1 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 13:34:21 -0500 Subject: [PATCH 01/11] mailman: Fix attempts to chmod g+s during installation --- pkgs/servers/mail/mailman/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix index b18ab016c44..3c028b1ac17 100644 --- a/pkgs/servers/mail/mailman/default.nix +++ b/pkgs/servers/mail/mailman/default.nix @@ -16,6 +16,8 @@ stdenv.mkDerivation rec { installTargets = "doinstall"; # Leave out the 'update' target that's implied by 'install'. + makeFlags = [ "DIRSETGID=:" ]; + meta = { homepage = "http://www.gnu.org/software/mailman/"; description = "Free software for managing electronic mail discussion and e-newsletter lists"; From d339dc762c73564cfbd20ab6c9be803e9c12e1e0 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 13:44:31 -0500 Subject: [PATCH 02/11] mailutils: Fix attempts to set unsupported ownership and perms --- pkgs/tools/networking/mailutils/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix index 0ae993db332..f83ea004db6 100644 --- a/pkgs/tools/networking/mailutils/default.nix +++ b/pkgs/tools/networking/mailutils/default.nix @@ -14,6 +14,12 @@ stdenv.mkDerivation rec { patches = [ ./path-to-cat.patch ./no-gets.patch ./scm_c_string.patch ]; + postPatch = '' + sed -i -e '/chown root:mail/d' \ + -e 's/chmod [24]755/chmod 0755/' \ + */Makefile{,.in,.am} + ''; + configureFlags = [ "--with-gsasl" "--with-gssapi=${gss}" From 7492873014f64ab52bb945f8335364830530dc8b Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:12:23 -0500 Subject: [PATCH 03/11] mcron: Fix attempt to set +s during install --- pkgs/tools/system/mcron/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/tools/system/mcron/default.nix b/pkgs/tools/system/mcron/default.nix index a90d6afdc61..5863504c704 100644 --- a/pkgs/tools/system/mcron/default.nix +++ b/pkgs/tools/system/mcron/default.nix @@ -10,6 +10,11 @@ stdenv.mkDerivation rec { patches = [ ./install-vixie-programs.patch ]; + # don't attempt to chmod +s files in the nix store + postPatch = '' + substituteInPlace makefile.in --replace "rwxs" "rwx" + ''; + buildInputs = [ guile which ed ]; doCheck = true; From 59bf263a593748bf5bb0510c5c638ef9c7c91045 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:14:57 -0500 Subject: [PATCH 04/11] netselect: Fix attempt to use unsupported permissions on files in store --- pkgs/tools/networking/netselect/default.nix | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/pkgs/tools/networking/netselect/default.nix b/pkgs/tools/networking/netselect/default.nix index f326059d9d7..6015ff9fbc7 100644 --- a/pkgs/tools/networking/netselect/default.nix +++ b/pkgs/tools/networking/netselect/default.nix @@ -8,10 +8,13 @@ stdenv.mkDerivation { sha256 = "0y69z59vylj9x9nk5jqn6ihx7dkzg09gpv2w1q1rs8fmi4jr90gy"; }; - preBuild = " + preBuild = '' makeFlagsArray=(PREFIX=$out) - substituteInPlace Makefile --replace '-o root' '' --replace '-g root' '' - "; + substituteInPlace Makefile \ + --replace "-o root" "" \ + --replace "-g root" "" \ + --replace "4755" "0755" + ''; meta = { homepage = http://alumnit.ca/~apenwarr/netselect/; From 15253a8dde07bfaaeb9980bdbd9b7cc65913b08e Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:18:23 -0500 Subject: [PATCH 05/11] wcslib: fix attempts to use unsupported permissions during install --- pkgs/development/libraries/wcslib/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/development/libraries/wcslib/default.nix b/pkgs/development/libraries/wcslib/default.nix index 6bbc7705671..64c5293fac7 100644 --- a/pkgs/development/libraries/wcslib/default.nix +++ b/pkgs/development/libraries/wcslib/default.nix @@ -11,6 +11,11 @@ stdenv.mkDerivation rec { sha256 ="1s2nig327g4bimd9xshlk11ww09a7mrjmsbpdcd8smsmn2kl1glb"; }; + prePatch = '' + substituteInPlace GNUmakefile --replace 2775 0775 + substituteInPlace C/GNUmakefile --replace 2775 0775 + ''; + enableParallelBuilding = true; meta = { From 09d85c49c47c10f200ad377fa9940e613e016292 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:21:29 -0500 Subject: [PATCH 06/11] kbdlight: Fix installation permissions Looks like NixOS creates a security wrapper for this already, FWIW. --- pkgs/os-specific/linux/kbdlight/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/kbdlight/default.nix b/pkgs/os-specific/linux/kbdlight/default.nix index 1bc07f357a8..44a63c9f1ec 100644 --- a/pkgs/os-specific/linux/kbdlight/default.nix +++ b/pkgs/os-specific/linux/kbdlight/default.nix @@ -13,7 +13,8 @@ stdenv.mkDerivation rec { preConfigure = '' substituteInPlace Makefile \ - --replace /usr/local $out + --replace /usr/local $out \ + --replace 4755 0755 ''; meta = with stdenv.lib; { From 0d871bd108b4c10ddfa9a6ab845d0088c3bbde3d Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:23:57 -0500 Subject: [PATCH 07/11] libutempter: Fixup unsupported permissions here as well --- pkgs/development/libraries/libutempter/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/development/libraries/libutempter/default.nix b/pkgs/development/libraries/libutempter/default.nix index 8481f857b2c..d54c82ae7f2 100644 --- a/pkgs/development/libraries/libutempter/default.nix +++ b/pkgs/development/libraries/libutempter/default.nix @@ -13,6 +13,10 @@ stdenv.mkDerivation rec { buildInputs = [ glib ]; + prePatch = '' + substituteInPlace Makefile --replace 2711 0711 + ''; + installFlags = [ "libdir=\${out}/lib" "libexecdir=\${out}/lib" From ed0ac2fece5baf028d44281f3f24a2815d47e6ac Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:26:24 -0500 Subject: [PATCH 08/11] leafnode: patch around setting special bits --- pkgs/servers/news/leafnode/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/servers/news/leafnode/default.nix b/pkgs/servers/news/leafnode/default.nix index a3579aa8309..9a8a0a80e52 100644 --- a/pkgs/servers/news/leafnode/default.nix +++ b/pkgs/servers/news/leafnode/default.nix @@ -10,6 +10,10 @@ stdenv.mkDerivation rec { configureFlags = "--enable-runas-user=nobody"; + prePatch = '' + substituteInPlace Makefile.in --replace 02770 0770 + ''; + preConfigure = '' # configure uses id to check environment; we don't want this check sed -re 's/^ID[=].*/ID="echo whatever"/' -i configure From 707145a955ad0e771154cc45479038282c87dc41 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:29:17 -0500 Subject: [PATCH 09/11] firejail: don't try to set setuid bit --- pkgs/os-specific/linux/firejail/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix index cf7fe8fc841..1bbe8dbb160 100644 --- a/pkgs/os-specific/linux/firejail/default.nix +++ b/pkgs/os-specific/linux/firejail/default.nix @@ -27,7 +27,7 @@ stdenv.mkDerivation { ''; preBuild = '' - sed -e "s@/etc/@$out/etc/@g" -i Makefile + sed -e "s@/etc/@$out/etc/@g" -e "/chmod u+s/d" -i Makefile ''; meta = { From 8e5759e7d255f30253d7097c11da2f7e8e800fc7 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:37:34 -0500 Subject: [PATCH 10/11] irods: Don't ask cmake to grant setuid permissions --- pkgs/tools/filesystems/irods/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix index 72118cada9f..db69fa64c84 100644 --- a/pkgs/tools/filesystems/irods/default.nix +++ b/pkgs/tools/filesystems/irods/default.nix @@ -40,6 +40,8 @@ in rec { -DCMAKE_MODULE_LINKER_FLAGS=-Wl,-rpath,$out/lib -DCMAKE_SHARED_LINKER_FLAGS=-Wl,-rpath,$out/lib " + + substituteInPlace cmake/server.cmake --replace SETUID "" ''; meta = common.meta // { From bcaceabc3c5076b36ab451e6f23a9d9c1df940c1 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 28 Jun 2017 14:41:32 -0500 Subject: [PATCH 11/11] ddccontrol: Don't try to set special perms on ddcpci --- pkgs/tools/misc/ddccontrol/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/misc/ddccontrol/default.nix b/pkgs/tools/misc/ddccontrol/default.nix index ddf9c38ec93..b3aca778cd9 100644 --- a/pkgs/tools/misc/ddccontrol/default.nix +++ b/pkgs/tools/misc/ddccontrol/default.nix @@ -28,6 +28,8 @@ stdenv.mkDerivation { oldPath+="{datadir}\/ddccontrol-db" sed "s/$oldPath/$newPath/" configure.ac rm configure.ac.old + + sed -e "s/chmod 4711/chmod 0711/" -i src/ddcpci/Makefile* ''; meta = with stdenv.lib; {