nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-04-28 07:20:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

hardening: Reindent

Browse Source
This commit is contained in:
John Ericson 2018-04-10 15:44:55 -04:00 committed by Charles Strahan
parent 21818ae592
commit ac4d74b6d9
2 changed files with 54 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
pkgs/build-support/bintools-wrapper/add-hardening.sh
View File

@ -35,24 +35,24 @@ if (( "${NIX_DEBUG:-0}" >= 1 )); then
fi fi
for flag in "${!hardeningEnableMap[@]}"; do for flag in "${!hardeningEnableMap[@]}"; do
case $flag in case $flag in
pie) pie)
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
hardeningLDFlags+=('-pie') hardeningLDFlags+=('-pie')
fi fi
;; ;;
relro) relro)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
hardeningLDFlags+=('-z' 'relro') hardeningLDFlags+=('-z' 'relro')
;; ;;
bindnow) bindnow)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi
hardeningLDFlags+=('-z' 'now') hardeningLDFlags+=('-z' 'now')
;; ;;
*) *)
# Ignore unsupported. Checked in Nix that at least *some* # Ignore unsupported. Checked in Nix that at least *some*
# tool supports each flag. # tool supports each flag.
;; ;;
esac esac
done done

68
pkgs/build-support/cc-wrapper/add-hardening.sh
View File

@ -35,38 +35,38 @@ if (( "${NIX_DEBUG:-0}" >= 1 )); then
fi fi
for flag in "${!hardeningEnableMap[@]}"; do for flag in "${!hardeningEnableMap[@]}"; do
case $flag in case $flag in
fortify) fortify)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2') hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
;; ;;
stackprotector) stackprotector)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4') hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
;; ;;
pie) pie)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
hardeningCFlags+=('-fPIE') hardeningCFlags+=('-fPIE')
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
hardeningCFlags+=('-pie') hardeningCFlags+=('-pie')
fi fi
;; ;;
pic) pic)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
hardeningCFlags+=('-fPIC') hardeningCFlags+=('-fPIC')
;; ;;
strictoverflow) strictoverflow)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
hardeningCFlags+=('-fno-strict-overflow') hardeningCFlags+=('-fno-strict-overflow')
;; ;;
format) format)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security') hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
;; ;;
*) *)
# Ignore unsupported. Checked in Nix that at least *some* # Ignore unsupported. Checked in Nix that at least *some*
# tool supports each flag. # tool supports each flag.
;; ;;
esac esac
done done