From afffa89ec53b44f017bfb6a315e8b08a2ed85bac Mon Sep 17 00:00:00 2001 From: Klemens Nanni Date: Sun, 12 Jan 2025 14:47:30 +0300 Subject: [PATCH] ssh: Fix environment variable parsing (#177503) From systemctl(1)'s `show-environment`: [...] If no special characters or whitespace is present in the variable values, no escaping is performed, and the assignments have the form "VARIABLE=value". If whitespace or characters which have special meaning to the shell are present, dollar-single-quote escaping is used, and assignments have the form "VARIABLE=$'value'". [...] `DISPLAY` is unlikely to require such escaping, but is still broken and overly complicated. Just rely on the fact that systemctl outputs line that are safe to be interpreted by the shell. Filter for `DISPLAY` and `eval` the output instead of trying to parse just the value part and reassign it again. --- nixos/modules/programs/ssh.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix index 1ae2653ed3e9..aaaf97ab1347 100644 --- a/nixos/modules/programs/ssh.nix +++ b/nixos/modules/programs/ssh.nix @@ -13,9 +13,7 @@ let askPasswordWrapper = pkgs.writeScript "ssh-askpass-wrapper" '' #! ${pkgs.runtimeShell} -e - export DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^DISPLAY=\(.*\)/\1/; t; d')" - export XAUTHORITY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^XAUTHORITY=\(.*\)/\1/; t; d')" - export WAYLAND_DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^WAYLAND_DISPLAY=\(.*\)/\1/; t; d')" + eval export $(systemctl --user show-environment | ${pkgs.coreutils}/bin/grep -E '^(DISPLAY|WAYLAND_DISPLAY|XAUTHORITY)=') exec ${cfg.askPassword} "$@" '';