diff options
| author | Alyssa Ross <hi@alyssa.is> | 2021-10-19 14:40:23 +0000 |
|---|---|---|
| committer | Alyssa Ross <hi@alyssa.is> | 2022-01-07 10:22:32 +0000 |
| commit | cc62bcb55359ba8c5e0fe3a48e778444c89060d8 (patch) | |
| tree | ca0e21d44eaf8837b687395e614445f7761d7bbd /nixpkgs/pkgs/build-support/cc-wrapper | |
| parent | d6625e8d25efd829c3cfa227d025ca4e606ae4b7 (diff) | |
| parent | a323570a264da96a0b0bcc1c9aa017794acdc752 (diff) | |
| download | nixlib-cc62bcb55359ba8c5e0fe3a48e778444c89060d8.tar nixlib-cc62bcb55359ba8c5e0fe3a48e778444c89060d8.tar.gz nixlib-cc62bcb55359ba8c5e0fe3a48e778444c89060d8.tar.bz2 nixlib-cc62bcb55359ba8c5e0fe3a48e778444c89060d8.tar.lz nixlib-cc62bcb55359ba8c5e0fe3a48e778444c89060d8.tar.xz nixlib-cc62bcb55359ba8c5e0fe3a48e778444c89060d8.tar.zst nixlib-cc62bcb55359ba8c5e0fe3a48e778444c89060d8.zip | |
Merge commit 'a323570a264da96a0b0bcc1c9aa017794acdc752'
Diffstat (limited to 'nixpkgs/pkgs/build-support/cc-wrapper')
| -rw-r--r-- | nixpkgs/pkgs/build-support/cc-wrapper/add-hardening.sh | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/nixpkgs/pkgs/build-support/cc-wrapper/add-hardening.sh b/nixpkgs/pkgs/build-support/cc-wrapper/add-hardening.sh index 8e2fe6c407ea..e5d296f6c9c5 100644 --- a/nixpkgs/pkgs/build-support/cc-wrapper/add-hardening.sh +++ b/nixpkgs/pkgs/build-support/cc-wrapper/add-hardening.sh @@ -45,11 +45,12 @@ for flag in "${!hardeningEnableMap[@]}"; do hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4') ;; pie) + # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi - hardeningCFlags+=('-fPIE') - if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then + hardeningCFlags=('-fPIE' "${hardeningCFlags[@]}") + if [[ ! (" $* " =~ " -shared " || " $* " =~ " -static ") ]]; then if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi - hardeningCFlags+=('-pie') + hardeningCFlags=('-pie' "${hardeningCFlags[@]}") fi ;; pic) |