[PATCH 5/7] tools: Use -s for python shebangs

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

This is mandated by the Fedora packaging guidelines because it is a security
vulnerability otherwise in suid scripts.  It's a very good idea generally,
because it prevents the users local python environment interfering from system
packaged scripts.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Wei Liu <wl@xxxxxxx>
CC: Anthony PERARD <anthony.perard@xxxxxxxxxx>
CC: Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>
CC: Bernhard Kaindl <bernhard.kaindl@xxxxxxxxxx>
---
 tools/Rules.mk        | 2 +-
 tools/pygrub/Makefile | 2 +-
 tools/python/Makefile | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/Rules.mk b/tools/Rules.mk
index 6e135387bd7e..18cf83f5be83 100644
--- a/tools/Rules.mk
+++ b/tools/Rules.mk
@@ -179,7 +179,7 @@ CFLAGS += $(CFLAGS-y)
 CFLAGS += $(EXTRA_CFLAGS_XEN_TOOLS)
 
 INSTALL_PYTHON_PROG = \
-       $(XEN_ROOT)/tools/python/install-wrap "$(PYTHON_PATH)" $(INSTALL_PROG)
+       $(XEN_ROOT)/tools/python/install-wrap "$(PYTHON_PATH) -s" 
$(INSTALL_PROG)
 
 %.opic: %.c
        $(CC) $(CPPFLAGS) -DPIC $(CFLAGS) $(CFLAGS_$*.opic) -fPIC -c -o $@ $< 
$(APPEND_CFLAGS)
diff --git a/tools/pygrub/Makefile b/tools/pygrub/Makefile
index 29ad0513212f..04b3995cc0f6 100644
--- a/tools/pygrub/Makefile
+++ b/tools/pygrub/Makefile
@@ -7,7 +7,7 @@ PY_LDFLAGS = $(SHLIB_LDFLAGS) $(APPEND_LDFLAGS)
 INSTALL_LOG = build/installed_files.txt
 
 setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)" 
LDFLAGS="$(PY_LDFLAGS)" \
-           $(PYTHON) setup.py
+           $(PYTHON) setup.py --executable="$(PYTHON_PATH) -s"
 
 .PHONY: all
 all: build
diff --git a/tools/python/Makefile b/tools/python/Makefile
index cc764236478a..511e7deae409 100644
--- a/tools/python/Makefile
+++ b/tools/python/Makefile
@@ -12,7 +12,7 @@ setup.py = CC="$(CC)" CFLAGS="$(PY_CFLAGS)" LDSHARED="$(CC)" 
LDFLAGS="$(PY_LDFLA
            SHLIB_libxenctrl="$(SHLIB_libxenctrl)" \
            SHLIB_libxenguest="$(SHLIB_libxenguest)" \
            SHLIB_libxenstore="$(SHLIB_libxenstore)" \
-           $(PYTHON) setup.py
+           $(PYTHON) setup.py --executable="$(PYTHON_PATH) -s"
 
 .PHONY: build
 build:
-- 
2.30.2