nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-30 16:10:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/ccache: swap nix-ccache from perl script to writeCBin to avoid LPE

Browse Source
This commit is contained in:
Luna Nova
2026-10-02 05:58:35 -07:00
parent c8b515c68b
commit 32ed9a733d
1 changed files with 24 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
nixos/modules/programs/ccache.nix
View File

@@ -55,20 +55,31 @@ in
inherit (cfg) owner group;
setuid = false;
setgid = true;
source = pkgs.writeScript "nix-ccache.pl" ''
#!${pkgs.perl}/bin/perl
source = lib.getExe (
(pkgs.writeCBin "nix-ccache" ''
#include <err.h>
#include <regex.h>
#include <unistd.h>
%ENV=( CCACHE_DIR => '${cfg.cacheDir}' );
sub untaint {
my $v = shift;
return '-C' if $v eq '-C' || $v eq '--clear';
return '-V' if $v eq '-V' || $v eq '--version';
return '-s' if $v eq '-s' || $v eq '--show-stats';
return '-z' if $v eq '-z' || $v eq '--zero-stats';
exec('${pkgs.ccache}/bin/ccache', '-h');
}
exec('${pkgs.ccache}/bin/ccache', map { untaint $_ } @ARGV);
'';
#define CCACHE "${lib.getExe pkgs.ccache}"
int main(int argc, char *argv[]) {
regex_t allowed;
if (regcomp(&allowed, "^(-[CVsz]|--(clear|version|show-stats|zero-stats))$", REG_EXTENDED | REG_NOSUB))
err(1, "regcomp");
// if any arg isn't on the allowlist, run `ccache` w/o args
for (int i = 1; i < argc; i++)
if (regexec(&allowed, argv[i], 0, nullptr, 0))
argv[1] = nullptr;
argv[0] = CCACHE;
execve(CCACHE, argv, (char *[]){ "CCACHE_DIR=${cfg.cacheDir}", nullptr });
err(127, CCACHE);
}
'').overrideAttrs
{ env.NIX_CFLAGS_COMPILE = "-std=c23"; }
);
};
})