From 1d2c4ceb88cf713ce024cc741f8d9d03bf85f0d8 Mon Sep 17 00:00:00 2001
From: Linus Heckemann <git@sphalerite.org>
Date: Mon, 16 May 2022 15:09:14 +0200
Subject: [PATCH] podman: add patch for CVE-2022-27649

"default inheritable capabilities for linux container not empty"
https://github.com/advisories/GHSA-qvf8-p83w-v58j

Fixes: CVE-2022-27649
---
 pkgs/applications/virtualization/podman/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 235578b965c2..2f33d28e8927 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -13,6 +13,7 @@
 , systemd
 , go-md2man
 , nixosTests
+, fetchpatch
 }:
 
 buildGoModule rec {
@@ -26,6 +27,15 @@ buildGoModule rec {
     sha256 = "sha256-SZHonZdUTJisFMjvUBst1HErvKWEcYZYhK++G+S4sEg=";
   };
 
+  patches = [
+    # Fix for capabilities bug: https://github.com/advisories/GHSA-qvf8-p83w-v58j
+    (fetchpatch {
+      name = "CVE-2022-27649.patch";
+      url = "https://github.com/containers/podman/commit/aafa80918a245edcbdaceb1191d749570f1872d0.patch";
+      sha256 = "sha256-d/5PGQ8yjLaE+6Sqo8p0yHe+mbrENFsbsaDXOF7cMsU=";
+    })
+  ];
+
   vendorSha256 = null;
 
   doCheck = false;