mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-11-01 15:11:25 +00:00
mkDerivation: add support for fortify3 hardening flag
This commit is contained in:
parent
a9a713c9ac
commit
3d453e2aee
@ -178,21 +178,29 @@ let
|
||||
++ buildInputs ++ propagatedBuildInputs
|
||||
++ depsTargetTarget ++ depsTargetTargetPropagated) == 0;
|
||||
dontAddHostSuffix = attrs ? outputHash && !noNonNativeDeps || !stdenv.hasCC;
|
||||
supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
|
||||
|
||||
hardeningDisable' = if lib.any (x: x == "fortify") hardeningDisable
|
||||
# disabling fortify implies fortify3 should also be disabled
|
||||
then lib.unique (hardeningDisable ++ [ "fortify3" ])
|
||||
else hardeningDisable;
|
||||
supportedHardeningFlags = [ "fortify" "fortify3" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
|
||||
# Musl-based platforms will keep "pie", other platforms will not.
|
||||
# If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
|
||||
# in the nixpkgs manual to inform users about the defaults.
|
||||
defaultHardeningFlags = if stdenv.hostPlatform.isMusl &&
|
||||
# Except when:
|
||||
# - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
|
||||
# - static armv7l, where compilation fails.
|
||||
!(stdenv.hostPlatform.isAarch && stdenv.hostPlatform.isStatic)
|
||||
then supportedHardeningFlags
|
||||
else lib.remove "pie" supportedHardeningFlags;
|
||||
defaultHardeningFlags = let
|
||||
# not ready for this by default
|
||||
supportedHardeningFlags' = lib.remove "fortify3" supportedHardeningFlags;
|
||||
in if stdenv.hostPlatform.isMusl &&
|
||||
# Except when:
|
||||
# - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
|
||||
# - static armv7l, where compilation fails.
|
||||
!(stdenv.hostPlatform.isAarch && stdenv.hostPlatform.isStatic)
|
||||
then supportedHardeningFlags'
|
||||
else lib.remove "pie" supportedHardeningFlags';
|
||||
enabledHardeningOptions =
|
||||
if builtins.elem "all" hardeningDisable
|
||||
if builtins.elem "all" hardeningDisable'
|
||||
then []
|
||||
else lib.subtractLists hardeningDisable (defaultHardeningFlags ++ hardeningEnable);
|
||||
else lib.subtractLists hardeningDisable' (defaultHardeningFlags ++ hardeningEnable);
|
||||
# hardeningDisable additionally supports "all".
|
||||
erroneousHardeningFlags = lib.subtractLists supportedHardeningFlags (hardeningEnable ++ lib.remove "all" hardeningDisable);
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user