From 337cd5cc8a3d5ce1721c5a8b990b489e473591c6 Mon Sep 17 00:00:00 2001 From: Lancelot SIX Date: Sun, 8 Dec 2019 18:13:40 +0100 Subject: [PATCH] vmTools.fillDiskWithRPMs: fix cpio use When updating to cpio-2.13 in fe758f5fa368ebcdc03419c54412dd9abfd76b35, a patch from SUSE was dropped. This patch was intended to resolve CVE-2015-1197, and introduced the '--extract-over-symlink' option to disable its own effects. The CVE-2015-1197 was fixed in cpio-2.13 release[1] by other means, making this patch useless. Given that this patch is no longer used, we do not need to disable its effects anymore with the `--extract-over-symlink` argument switch. This Commit fixes #74984 [1] https://lists.gnu.org/archive/html/info-gnu/2019-11/msg00002.html --- pkgs/build-support/vm/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix index 335cab7c45e..a7050f52e52 100644 --- a/pkgs/build-support/vm/default.nix +++ b/pkgs/build-support/vm/default.nix @@ -430,7 +430,7 @@ rec { set +o pipefail for i in $rpms; do echo "$i..." - ${rpm}/bin/rpm2cpio "$i" | chroot /mnt ${cpio}/bin/cpio -i --make-directories --unconditional --extract-over-symlinks + ${rpm}/bin/rpm2cpio "$i" | chroot /mnt ${cpio}/bin/cpio -i --make-directories --unconditional done eval "$preInstall"