mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-01-23 21:33:49 +00:00
e0d2053b87
When a response file is in use, "$*" contains the response file and not
the parameters; both the linker and compiler wrappers are updated to use
the response-expanded params.
The compiler driver likes to pass parameters to the linker via a
response file, including -shared.
LLD rejects the combination of (-shared -pie), whereas other linkers
silently ignore the contradiction:
```
ld.lld: error: -shared and -pie may not be used together
```
This breaks certain configurations using LLD as a linker.
Changing `add-hardening.sh` results in a full rebuild. To avoid the
rebuild, here is a quick test case which shows the new hardening script
allows the link to succeed:
```
{ pkgs ? import <nixpkgs> {} }:
let
# gcc silently accepts -shared -pie together, lld does not.
linker = pkgs.wrapBintoolsWith { bintools = pkgs.llvmPackages.lld; };
patchWrapper = prev: prev.overrideAttrs (final: prev: let
prevScript = builtins.match (".*(/nix/store/[a-z0-9]+-add-hardening.sh).*") prev.postFixup;
in {
postFixup = (builtins.replaceStrings prevScript ["${./new-add-hardening.sh}"] prev.postFixup);
});
in
pkgs.stdenv.mkDerivation {
name = "nixpkgs-hardening-bug";
src = pkgs.writeText "src.c" "int main(int argc, char* argv[]) { return 0; }";
NIX_HARDENING_ENABLE = "pie";
unpackPhase = ":";
buildPhase = ''
$CC -c -o src.o $src
bash -x ${patchWrapper linker}/bin/ld.lld -o $out @${pkgs.writeText "responsefile" "-shared"} src.o
'';
}
```
Fixes: #178162
Signed-off-by: Peter Waller <p@pwaller.net>
|
||
|---|---|---|
| .. | ||
| add-opengl-runpath | ||
| agda | ||
| alternatives | ||
| appimage | ||
| binary-cache | ||
| bintools-wrapper | ||
| build-bazel-package | ||
| build-fhsenv-bubblewrap | ||
| build-fhsenv-chroot | ||
| build-graalvm-native-image | ||
| build-setupcfg | ||
| buildenv | ||
| cc-wrapper | ||
| coq | ||
| dart | ||
| deterministic-uname | ||
| dhall | ||
| docker | ||
| dotnet | ||
| emacs | ||
| expand-response-params | ||
| fake-nss | ||
| fetchbitbucket | ||
| fetchbower | ||
| fetchbzr | ||
| fetchcvs | ||
| fetchdarcs | ||
| fetchdocker | ||
| fetchfirefoxaddon | ||
| fetchfossil | ||
| fetchgit | ||
| fetchgitea | ||
| fetchgithub | ||
| fetchgitiles | ||
| fetchgitlab | ||
| fetchgitlocal | ||
| fetchgx | ||
| fetchhg | ||
| fetchipfs | ||
| fetchmavenartifact | ||
| fetchmtn | ||
| fetchnextcloudapp | ||
| fetchpatch | ||
| fetchpypi | ||
| fetchrepoorcz | ||
| fetchrepoproject | ||
| fetchs3 | ||
| fetchsavannah | ||
| fetchsourcehut | ||
| fetchsvn | ||
| fetchsvnrevision | ||
| fetchsvnssh | ||
| fetchurl | ||
| fetchzip | ||
| flutter | ||
| go | ||
| icon-conv-tools | ||
| install-shell-files | ||
| java | ||
| kernel | ||
| libredirect | ||
| make-darwin-bundle | ||
| make-desktopitem | ||
| make-hardcode-gsettings-patch | ||
| make-pkgconfigitem | ||
| make-startupitem | ||
| mkshell | ||
| mono-dll-fixer | ||
| nix-gitignore | ||
| node | ||
| nuke-references | ||
| ocaml | ||
| oci-tools | ||
| pkg-config-wrapper | ||
| portable-service | ||
| prefer-remote-fetch | ||
| references-by-popularity | ||
| release | ||
| remove-references-to | ||
| replace-secret | ||
| rust | ||
| setup-hooks | ||
| singularity-tools | ||
| snap | ||
| src-only | ||
| substitute | ||
| substitute-files | ||
| templaterpm | ||
| testers | ||
| trivial-builders | ||
| vm | ||
| wrapper-common | ||
| writers | ||
| build-maven.nix | ||
| build-pecl.nix | ||
| closure-info.nix | ||
| make-impure-test.nix | ||
| plugins.nix | ||
| replace-dependency.nix | ||
| setup-systemd-units.nix | ||
| source-from-head-fun.nix | ||