diff options
| author | Franz Pletz <fpletz@fnordicwalking.de> | 2016-03-08 00:39:07 +0100 |
|---|---|---|
| committer | Franz Pletz <fpletz@fnordicwalking.de> | 2016-03-08 00:39:07 +0100 |
| commit | fedf31660dd637aa9a4374c0afc2f7c620bf232a (patch) | |
| tree | 340754d3f44abaa6c801d2ca2a0db86592f99a3e /pkgs/servers/http | |
| parent | e9fc4e7db63e91f3e787d9d3bfd91c798e8bd8bd (diff) | |
| download | nixlib-fedf31660dd637aa9a4374c0afc2f7c620bf232a.tar nixlib-fedf31660dd637aa9a4374c0afc2f7c620bf232a.tar.gz nixlib-fedf31660dd637aa9a4374c0afc2f7c620bf232a.tar.bz2 nixlib-fedf31660dd637aa9a4374c0afc2f7c620bf232a.tar.lz nixlib-fedf31660dd637aa9a4374c0afc2f7c620bf232a.tar.xz nixlib-fedf31660dd637aa9a4374c0afc2f7c620bf232a.tar.zst nixlib-fedf31660dd637aa9a4374c0afc2f7c620bf232a.zip | |
nginx: Rmove custom hardening, now enabled by default
Diffstat (limited to 'pkgs/servers/http')
| -rw-r--r-- | pkgs/servers/http/nginx/default.nix | 9 | ||||
| -rw-r--r-- | pkgs/servers/http/nginx/unstable.nix | 11 |
2 files changed, 4 insertions, 16 deletions
diff --git a/pkgs/servers/http/nginx/default.nix b/pkgs/servers/http/nginx/default.nix index 1aaa24127023..22ce5e754458 100644 --- a/pkgs/servers/http/nginx/default.nix +++ b/pkgs/servers/http/nginx/default.nix @@ -54,14 +54,7 @@ stdenv.mkDerivation rec { NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations -Wno-error=conditional-uninitialized"; - preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules) - + optionalString (hardening && (stdenv.cc.cc.isGNU or false)) '' - configureFlagsArray=( - --with-cc-opt="-fPIE -fstack-protector-all --param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2" - --with-ld-opt="-pie -Wl,-z,relro,-z,now" - ) - '' - ; + preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules); hardeningEnable = [ "pie" ]; diff --git a/pkgs/servers/http/nginx/unstable.nix b/pkgs/servers/http/nginx/unstable.nix index e85fb96d2edb..5adfb55cb2fd 100644 --- a/pkgs/servers/http/nginx/unstable.nix +++ b/pkgs/servers/http/nginx/unstable.nix @@ -52,14 +52,9 @@ stdenv.mkDerivation rec { NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations"; - preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules) - + optionalString (hardening && (stdenv.cc.cc.isGNU or false)) '' - configureFlagsArray=( - --with-cc-opt="-fPIE -fstack-protector-all --param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2" - --with-ld-opt="-pie -Wl,-z,relro,-z,now" - ) - '' - ; + preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules); + + hardeningEnable = [ "pie" ]; postInstall = '' mv $out/sbin $out/bin |