lxc: 2.0.4 -> 2.0.6 (security) #20766
Conversation
|
@avnik, thanks for your PR! By analyzing the history of the files in this pull request, we identified @7c6f434c, @wkennington and @peti to be potential reviewers. |
pSub
added
1.severity: security
| @@ -57,6 +57,7 @@ stdenv.mkDerivation rec { | |||
| installFlags = [ | |||
| "localstatedir=\${TMPDIR}" | |||
| "sysconfdir=\${out}/etc" | |||
| "bashcompdir=\${out}/etc/bash_completion.d" | |||
There was a problem hiding this comment.
Bash completion files should no longer go to etc since these are no configuration files. Instead, $out/share/bash-completion/completions/lxc would be the proper place.
There was a problem hiding this comment.
For future security PRs, please make the minimum change necessary to get it fixed, then a separate PR (or commit) of the improvements
avnik
force-pushed
the
update/lxc
branch
2 times, most recently
from
0055bd9 to
dc2b1b7
Compare
|
Well, I am finally swapped them |
|
@avnik, well, I am on IRC, but apparently I did not see your question. |
| @@ -58,6 +58,7 @@ stdenv.mkDerivation rec { | |||
| "localstatedir=\${TMPDIR}" | |||
| "sysconfdir=\${out}/etc" | |||
| "sysconfigdir=\${out}/etc/default" | |||
| "bashcompdir=\${out}/etc/bash_completion.d" | |||
There was a problem hiding this comment.
Please put bash completion files into $out/share/bash-completion/completions, not into $out/etc/bash_completion.d.
|
@peti Fixed again, it strike back as rebase artifact |
| @@ -58,6 +58,7 @@ stdenv.mkDerivation rec { | |||
| "localstatedir=\${TMPDIR}" | |||
| "sysconfdir=\${out}/etc" | |||
| "sysconfigdir=\${out}/etc/default" | |||
| "bashcompdir=\${out}/share/bash-completion/completions/lxc" | |||
There was a problem hiding this comment.
The directory is $out/share/bash-completion/completions, not $out/share/bash-completion/completions/lxc.
Package attempt to write /etc/bash_completion.d, I directed it to
"${out}/etc/bash_completion.d" as it was suggested.
|
@peti |
|
@avnik, that path referred to the completion file that lxc would install. |
Motivation for this change
Update to fix CVE-2016-8649
Things done
(nix.useSandbox on NixOS,
or option
build-use-sandboxinnix.confon non-NixOS)
nix-shell -p nox --run "nox-review wip"./result/bin/)https://security-tracker.debian.org/tracker/CVE-2016-8649
Also fix chrooted build (attempt write to /etc/bash_completion.d)