pyrox.dev
Merge pull request #138514 from onny/firejail
firejail: Remove symlink check patch
authored by Michael Raskin and committed by GitHub 401cd35e ca679942
+3
pkgs/os-specific/linux/firejail/default.nix
+3
pkgs/os-specific/linux/firejail/default.nix
···
20
20
# By default fbuilder hardcodes the firejail binary to the install path.
21
21
# On NixOS the firejail binary is a setuid wrapper available in $PATH.
22
22
./fbuilder-call-firejail-on-path.patch
23
+
# Disable symlink check on /etc/hosts, see
24
+
# https://github.com/netblue30/firejail/issues/2758#issuecomment-805174951
25
+
./remove-link-check.patch
23
26
];
24
27
25
28
prePatch = ''
+48
pkgs/os-specific/linux/firejail/remove-link-check.patch
+48
pkgs/os-specific/linux/firejail/remove-link-check.patch
···
1
+
From ccc726f8ec877d8cda720daa2498e43629b6dd48 Mon Sep 17 00:00:00 2001
2
+
From: Jonas Heinrich <onny@project-insanity.org>
3
+
Date: Sun, 19 Sep 2021 11:48:06 +0200
4
+
Subject: [PATCH 1/2] remove hosts file link check
5
+
6
+
---
7
+
src/firejail/fs_hostname.c | 4 ----
8
+
1 file changed, 4 deletions(-)
9
+
10
+
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
11
+
index 42255070c4..97ce70f9c1 100644
12
+
--- a/src/firejail/fs_hostname.c
13
+
+++ b/src/firejail/fs_hostname.c
14
+
@@ -132,10 +132,6 @@ char *fs_check_hosts_file(const char *fname) {
15
+
invalid_filename(fname);
16
+
char *rv = expand_home(fname, cfg.homedir);
17
+
18
+
- // no a link
19
+
- if (is_link(rv))
20
+
- goto errexit;
21
+
-
22
+
// the user has read access to the file
23
+
if (access(rv, R_OK))
24
+
goto errexit;
25
+
26
+
From c2c51e7ca56075e7388b4f50922b148615d1b125 Mon Sep 17 00:00:00 2001
27
+
From: Jonas Heinrich <onny@project-insanity.org>
28
+
Date: Sun, 19 Sep 2021 11:49:08 +0200
29
+
Subject: [PATCH 2/2] remove hosts file link check
30
+
31
+
---
32
+
src/firejail/fs_hostname.c | 3 ---
33
+
1 file changed, 3 deletions(-)
34
+
35
+
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
36
+
index 97ce70f9c1..b228707131 100644
37
+
--- a/src/firejail/fs_hostname.c
38
+
+++ b/src/firejail/fs_hostname.c
39
+
@@ -154,9 +154,6 @@ void fs_mount_hosts_file(void) {
40
+
struct stat s;
41
+
if (stat("/etc/hosts", &s) == -1)
42
+
goto errexit;
43
+
- // not a link
44
+
- if (is_link("/etc/hosts"))
45
+
- goto errexit;
46
+
// owned by root
47
+
if (s.st_uid != 0)
48
+
goto errexit;