@@ -241,12 +241,16 @@ (define* (wrap #:key inputs outputs #:allow-other-keys)
(define %sh (delay (search-input-file inputs "bin/bash")))
(define (sh) (force %sh))
- (let* ((var `("GUIX_PYTHONPATH" prefix
- ,(search-path-as-string->list
- (or (getenv "GUIX_PYTHONPATH") "")))))
+ (let* ((var-pythonpath `("GUIX_PYTHONPATH" prefix
+ ,(search-path-as-string->list
+ (or (getenv "GUIX_PYTHONPATH") ""))))
+ ;; Harden applications by preventing Python from automatically
+ ;; picking up libraries in user site directory.
+ (var-usersite '("PYTHONNOUSERSITE" = ("GUIX_WRAPPER"))))
(for-each (lambda (dir)
(let ((files (list-of-files dir)))
- (for-each (cut wrap-program <> #:sh (sh) var)
+ (for-each (cut wrap-program <> #:sh (sh)
+ var-pythonpath var-usersite)
files)))
bindirs)))