mirror of
https://https.git.savannah.gnu.org/git/guix.git/
synced 2025-07-14 11:00:36 +02:00
776334bfdb
Fixes CVE-2024-42472. Fixes <https://issues.guix.gnu.org/73059>. * gnu/packages/package-management.scm (flatpak): Update to 1.14.10. * gnu/packages/patches/flatpak-unset-gdk-pixbuf-for-sandbox.patch: Adjust it. Change-Id: Ia0bd866ee46e8b0cd24d37d14df61cdc22692d4e
19 lines
784 B
Diff
19 lines
784 B
Diff
Most Guix system setup with desktop evironment will install GDK_PIXBUF_MODULE_FILE
|
|
environment variable in the system profile, and it'll be leaked into the sandbox
|
|
environment of flatpak, so the applications in sandbox may fail to find correct
|
|
GdkPixbuf loaders.
|
|
|
|
This patch unset the GDK_PIXBUF_MODULE_FILE environment variable before running
|
|
the sandboxed applications, prevents it to load GdkPixbuf loaders from the path
|
|
of host system.
|
|
|
|
--- a/common/flatpak-run.c
|
|
+++ b/common/flatpak-run.c
|
|
@@ -1900,6 +1900,7 @@ static const ExportData default_exports[] = {
|
|
{"XKB_CONFIG_ROOT", NULL},
|
|
{"GIO_EXTRA_MODULES", NULL},
|
|
{"GDK_BACKEND", NULL},
|
|
+ {"GDK_PIXBUF_MODULE_FILE", NULL},
|
|
{"VK_ADD_DRIVER_FILES", NULL},
|
|
{"VK_ADD_LAYER_PATH", NULL},
|
|
{"VK_DRIVER_FILES", NULL},
|