hardening: fix #18995

1 files changed, 22 insertions, 15 deletions

diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index a35ff3cb4260..f0da0a855169 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -1,33 +1,41 @@
-hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
-# Intentionally word-split in case 'hardeningEnable' is defined in
-# Nix. Also, our bootstrap tools version of bash is old enough that
-# undefined arrays trip `set -u`.
-if [[ -v hardeningEnable[@] ]]; then
-  hardeningFlags+=(${hardeningEnable[@]})
-fi
+allHardeningFlags=(fortify stackprotector pie pic strictoverflow format relro bindnow)
 hardeningCFlags=()
 
 declare -A hardeningDisableMap
+declare -A hardeningEnableMap
 
-# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
-for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
-do
+# Create table of unsupported flags for this toolchain.
+for flag in @hardening_unsupported_flags@; do
   hardeningDisableMap[$flag]=1
 done
 
+# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
+# array expansion also prevents undefined variables from causing trouble with
+# `set -u`.
+for flag in ${NIX_HARDENING_ENABLE+}; do
+  if [[ -n "${hardeningDisableMap[$flag]}" ]]; then
+    hardeningEnableMap[$flag]=1
+  fi
+done
+
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
+  # Determine which flags were effectively disabled so we can report below.
+  for flag in ${allHardeningFlags[@]}; do
+    if [[ -z "${hardeningEnableMap[$flag]}" ]]; then
+      hardeningDisableMap[$flag]=1
+    fi
+  done
+
   printf 'HARDENING: disabled flags:' >&2
   (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
   echo >&2
 fi
 
-if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
+if (( "${#hardeningEnableMap[@]}" )); then
   if (( "${NIX_DEBUG:-0}" >= 1 )); then
     echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
   fi
-  for flag in "${hardeningFlags[@]}"
-  do
-    if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
+  for flag in "${!hardeningEnableMap[@]}"; do
       case $flag in
         fortify)
           if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
@@ -62,6 +70,5 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           # tool supports each flag.
           ;;
       esac
-    fi
   done
 fi