diff options
author | Matthew Bauer <mjbauer95@gmail.com> | 2018-04-10 19:07:27 -0500 |
---|---|---|
committer | Matthew Bauer <mjbauer95@gmail.com> | 2018-04-10 19:07:27 -0500 |
commit | 6c064e6b1f34a8416f990db0cc617a7195f71588 (patch) | |
tree | 4c2a16462fab6bcfb64f7b657e40c56226b2456c /pkgs/build-support/cc-wrapper | |
parent | 0dbc0067604eb9629d1458fcf2b226a88e728f14 (diff) | |
download | nixlib-6c064e6b1f34a8416f990db0cc617a7195f71588.tar nixlib-6c064e6b1f34a8416f990db0cc617a7195f71588.tar.gz nixlib-6c064e6b1f34a8416f990db0cc617a7195f71588.tar.bz2 nixlib-6c064e6b1f34a8416f990db0cc617a7195f71588.tar.lz nixlib-6c064e6b1f34a8416f990db0cc617a7195f71588.tar.xz nixlib-6c064e6b1f34a8416f990db0cc617a7195f71588.tar.zst nixlib-6c064e6b1f34a8416f990db0cc617a7195f71588.zip |
Revert "Merge pull request #28029 from cstrahan/hardening-fix"
This reverts commit 0dbc0067604eb9629d1458fcf2b226a88e728f14, reversing changes made to cb7f7742652acdf3086b3d132163b5ea2c2328eb. Should go into staging.
Diffstat (limited to 'pkgs/build-support/cc-wrapper')
-rw-r--r-- | pkgs/build-support/cc-wrapper/add-flags.sh | 4 | ||||
-rw-r--r-- | pkgs/build-support/cc-wrapper/add-hardening.sh | 115 | ||||
-rw-r--r-- | pkgs/build-support/cc-wrapper/cc-wrapper.sh | 4 | ||||
-rw-r--r-- | pkgs/build-support/cc-wrapper/setup-hook.sh | 4 |
4 files changed, 59 insertions, 68 deletions
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh index e384d30ecbb6..604aaf6b6cf0 100644 --- a/pkgs/build-support/cc-wrapper/add-flags.sh +++ b/pkgs/build-support/cc-wrapper/add-flags.sh @@ -30,10 +30,10 @@ fi # We need to mangle names for hygiene, but also take parameters/overrides # from the environment. for var in "${var_templates_list[@]}"; do - mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"} + mangleVarList "$var" "${role_infixes[@]}" done for var in "${var_templates_bool[@]}"; do - mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"} + mangleVarBool "$var" "${role_infixes[@]}" done # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld. diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh index 026e48671447..a35ff3cb4260 100644 --- a/pkgs/build-support/cc-wrapper/add-hardening.sh +++ b/pkgs/build-support/cc-wrapper/add-hardening.sh @@ -1,72 +1,67 @@ -declare -a hardeningCFlags=() - -declare -A hardeningEnableMap=() +hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow) +# Intentionally word-split in case 'hardeningEnable' is defined in +# Nix. Also, our bootstrap tools version of bash is old enough that +# undefined arrays trip `set -u`. +if [[ -v hardeningEnable[@] ]]; then + hardeningFlags+=(${hardeningEnable[@]}) +fi +hardeningCFlags=() -# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The -# array expansion also prevents undefined variables from causing trouble with -# `set -u`. -for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do - hardeningEnableMap["$flag"]=1 -done +declare -A hardeningDisableMap -# Remove unsupported flags. -for flag in @hardening_unsupported_flags@; do - unset -v hardeningEnableMap["$flag"] +# Intentionally word-split in case 'hardeningDisable' is defined in Nix. +for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@ +do + hardeningDisableMap[$flag]=1 done if (( "${NIX_DEBUG:-0}" >= 1 )); then - declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format) - declare -A hardeningDisableMap=() - - # Determine which flags were effectively disabled so we can report below. - for flag in "${allHardeningFlags[@]}"; do - if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then - hardeningDisableMap["$flag"]=1 - fi - done - printf 'HARDENING: disabled flags:' >&2 (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2 echo >&2 +fi - if (( "${#hardeningEnableMap[@]}" )); then +if [[ -z "${hardeningDisableMap[all]:-}" ]]; then + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2; fi + for flag in "${hardeningFlags[@]}" + do + if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then + case $flag in + fortify) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi + hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2') + ;; + stackprotector) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi + hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4') + ;; + pie) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi + hardeningCFlags+=('-fPIE') + if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi + hardeningCFlags+=('-pie') + fi + ;; + pic) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi + hardeningCFlags+=('-fPIC') + ;; + strictoverflow) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi + hardeningCFlags+=('-fno-strict-overflow') + ;; + format) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi + hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security') + ;; + *) + # Ignore unsupported. Checked in Nix that at least *some* + # tool supports each flag. + ;; + esac + fi + done fi - -for flag in "${!hardeningEnableMap[@]}"; do - case $flag in - fortify) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi - hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2') - ;; - stackprotector) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi - hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4') - ;; - pie) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi - hardeningCFlags+=('-fPIE') - if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi - hardeningCFlags+=('-pie') - fi - ;; - pic) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi - hardeningCFlags+=('-fPIC') - ;; - strictoverflow) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi - hardeningCFlags+=('-fno-strict-overflow') - ;; - format) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi - hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security') - ;; - *) - # Ignore unsupported. Checked in Nix that at least *some* - # tool supports each flag. - ;; - esac -done diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh index 8a3cfb694b4f..c2e6c1406358 100644 --- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh +++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh @@ -134,8 +134,8 @@ fi source @out@/nix-support/add-hardening.sh # Add the flags for the C compiler proper. -extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE) -extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"}) +extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE "${hardeningCFlags[@]}") +extraBefore=() if [ "$dontLink" != 1 ]; then diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh index 15b84dca2794..29a7306b9b7e 100644 --- a/pkgs/build-support/cc-wrapper/setup-hook.sh +++ b/pkgs/build-support/cc-wrapper/setup-hook.sh @@ -147,10 +147,6 @@ export ${role_pre}CXX=@named_cxx@ export CC${role_post}=@named_cc@ export CXX${role_post}=@named_cxx@ -# If unset, assume the default hardening flags. -: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"} -export NIX_HARDENING_ENABLE - # No local scope in sourced file unset -v role_pre role_post set +u |