This is mandated by the Fedora packaging guidelines because it is a security
vulnerability otherwise in suid scripts. It's a very good idea generally,
because it prevents the users local python environment interfering from system
packaged scripts.
Signed-off-by: Andrew Cooper <andrew.coop...@citrix.com>
---
CC: Wei Liu <w...@xen.org>
CC: Anthony PERARD <anthony.per...@citrix.com>
CC: Marek Marczykowski-Górecki <marma...@invisiblethingslab.com>
CC: Bernhard Kaindl <bernhard.kai...@citrix.com>
---
tools/Rules.mk | 2 +-
tools/pygrub/Makefile | 2 +-
tools/python/Makefile | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/Rules.mk b/tools/Rules.mk
index 6e135387bd7e..18cf83f5be83 100644
--- a/tools/Rules.mk
+++ b/tools/Rules.mk
@@ -179,7 +179,7 @@ CFLAGS += $(CFLAGS-y)
CFLAGS += $(EXTRA_CFLAGS_XEN_TOOLS)
INSTALL_PYTHON_PROG = \
- $(XEN_ROOT)/tools/python/install-wrap "$(PYTHON_PATH)" $(INSTALL_PROG)
+ $(XEN_ROOT)/tools/python/install-wrap "$(PYTHON_PATH) -s"
$(INSTALL_PROG)
%.opic: %.c
$(CC) $(CPPFLAGS) -DPIC $(CFLAGS) $(CFLAGS_$*.opic) -fPIC -c -o $@ $<
$(APPEND_CFLAGS)
diff --git a/tools/pygrub/Makefile b/tools/pygrub/Makefile
index 29ad0513212f..04b3995cc0f6 100644
--- a/tools/pygrub/Makefile
+++ b/tools/pygrub/Makefile
@@ -7,7 +7,7 @@ PY_LDFLAGS = $(SHLIB_LDFLAGS) $(APPEND_LDFLAGS)
INSTALL_LOG = build/installed_files.txt
setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)"
LDFLAGS="$(PY_LDFLAGS)" \
- $(PYTHON) setup.py
+ $(PYTHON) setup.py --executable="$(PYTHON_PATH) -s"
.PHONY: all
all: build
diff --git a/tools/python/Makefile b/tools/python/Makefile
index cc764236478a..511e7deae409 100644
--- a/tools/python/Makefile
+++ b/tools/python/Makefile
@@ -12,7 +12,7 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)"
LDFLAGS="$(PY_LDFLA
SHLIB_libxenctrl="$(SHLIB_libxenctrl)" \
SHLIB_libxenguest="$(SHLIB_libxenguest)" \
SHLIB_libxenstore="$(SHLIB_libxenstore)" \
- $(PYTHON) setup.py
+ $(PYTHON) setup.py --executable="$(PYTHON_PATH) -s"
.PHONY: build
build:
--
2.30.2
