commit f43ca6cfcb2b2b6fa8865b35aada3fac6478ccab
author Brian Silverman <bsilver16384@gmail.com> Sat Sep 15 16:22:59 2018 -0700
committer Brian Silverman <bsilver16384@gmail.com> Sat Sep 15 16:23:29 2018 -0700
tree 846fb4ee0cb9e6d7c875f75514f3ea35b2144324
parent 2aaada9f8768fd5a95c899fe158550493b14d076

Prevent pandoc from escaping the sandbox

It now works on a stock Debian 9 installation.

Change-Id: Idcda9f8feebae5572292c6ddf774e37eda1bf45e

debian/pandoc.BUILD

diff --git a/debian/pandoc.BUILD b/debian/pandoc.BUILD
index 238c786..0dfbd9f 100644
--- a/debian/pandoc.BUILD
+++ b/debian/pandoc.BUILD
@@ -5,7 +5,7 @@
         "cat > $@ <<END",
         "#!/bin/bash",
         "export LD_LIBRARY_PATH=external/pandoc/usr/lib/x86_64-linux-gnu:external/pandoc/lib/x86_64-linux-gnu",
-        "exec external/pandoc/usr/bin/pandoc \"\\$$@\"",
+        "exec external/pandoc/usr/bin/pandoc --data-dir=external/pandoc/usr/share/pandoc/data \"\\$$@\"",
         "END",
     ]),
     executable = True,