<andi-> Yet another ghostscript code execution when opening a PDF: https://www.openwall.com/lists/oss-security/2018/10/09/4
<andi-> I'll try to get that fixed /verified once I am out of the office..
<flokli> ghostscript /o\
<flokli> let's rebuild the world once again
<andi-> The good news is it didn't just execute code when opened in a (remote) VM with X..
<andi-> might have to start a proper DE and not just i3 + pick the tools from the mounted nix store..
{^_^} has quit [Ping timeout: 252 seconds]
<andi-> So the patches from ghostscript really fix the issues (surprise!). Problem is just that they depend on a lot of different changes and I do not speak postscript :/ The git history looks like a minefield.
<gchristensen> ouch
<andi-> time to make an overlay: self: super: { ghostscript = null; }
<gchristensen> sgtm
<andi-> Is anyone familiar with the `gnome-desktop sandbox`?
<andi-> that thing should exist - at least the way I read the mail... Would like to check if we have that enabled
<andi-> apparently that is called `bubblewrap`
<andi-> so that seems to be on and working since we have USER_NS=y
pie_ has joined #nixos-security
{^_^} has joined #nixos-security
{^_^} has quit [Ping timeout: 240 seconds]