Maximilian Bosch aaeeef5b6c stdenv: fix custom hardening settings when using __structuredAttrs = true; ... Replaces / Closes #353131 A while ago `postgresql` switched to using structured attrs[1]. In the PR it was reported that this made postgresql notably slower when importing SQL dumps[2]. After a bit of debugging it turned out that the hardening was entirely missing and the following combination of settings was the culprit: hardeningEnable = [ "pie" ]; __structuredAttrs = true; I.e. the combination of custom hardening settings and structured attrs. What happened here is that internally the default and enabled hardening flags get written into `NIX_HARDENING_ENABLE`. However, the value is a list and the setting is not in the `env` section. This means that in the structured-attrs case we get something like declare -ax NIX_HARDENING_ENABLE=([0]="bindnow" [1]="format" [2]="fortify" [3]="fortify3" [4]="pic" [5]="relro" [6]="stackprotector" [7]="strictoverflow" [8]="zerocallusedregs" [9]="pie") i.e. an actual array rather than a string with all hardening flags being space-separated which is what the hardening code of the cc-wrapper expects[3]. This only happens if `hardeningEnable` or `hardeningDisable` are explicitly set by a derivation: if none of those are set, `NIX_HARDENING_ENABLE` won't be set by `stdenv.mkDerivation` and the default hardening flags are configured by the setup hook of the cc-wrapper[4]. In other words, this _only_ applies to derivations that have both custom hardening settings _and_ `__structuredAttrs = true;`. All values of `NIX_HARDENING_ENABLE` are well-known, so we don't have to worry about escaping issues. Just forcing it to a string by concatenating the list everytime solves the issue without additional issues like eval errors when inheriting `env` from a structuredAttrs derivation[5]. The price we're paying is a full rebuild. [1] https://github.com/NixOS/nixpkgs/pull/294504 [2] https://github.com/NixOS/nixpkgs/pull/294504#issuecomment-2451482522 [3] cf3e5d3744/pkgs/build-support/cc-wrapper/add-hardening.sh (L9) [4] cf3e5d3744/pkgs/build-support/cc-wrapper/setup-hook.sh (L114) [5] 1e84a7fb95		2024-11-02 22:30:01 +01:00
..
atomics.cc	tests.cc-wrapper: add atomics test	2023-11-16 00:23:56 +02:00
cc-main.c
cflags-main.c
core-foundation-main.c
cxx-main.cc
default.nix	Merge staging-next into staging	2024-10-31 18:04:59 +00:00
foo.c
fortify1-example.c	cc-wrapper, binutils-wrapper: add tests hardening-flags-handling	2023-09-02 15:01:54 +01:00
fortify2-example.c	cc-wrapper, binutils-wrapper: add tests hardening-flags-handling	2023-09-02 15:01:54 +01:00
fortify3-example.c	cc-wrapper, binutils-wrapper: add tests hardening-flags-handling	2023-09-02 15:01:54 +01:00
hardening.nix	stdenv: fix custom hardening settings when using __structuredAttrs = true;	2024-11-02 22:30:01 +01:00
include-cxxabi.cc	tests.cc-wrapper.supported: add test for cxxabi header	2023-09-18 06:43:36 +05:30
ldflags-main.c
multilib.nix
nostdinc-main.c
sanitizers.c
stdio.h