diff options
| author | Niklas Hambüchen <mail@nh2.me> | 2021-07-04 22:28:36 +0000 |
|---|---|---|
| committer | Niklas Hambüchen <mail@nh2.me> | 2021-07-05 16:32:55 +0200 |
| commit | ac36a0f9eb9954281bb7904e61549a0661644ab7 (patch) | |
| tree | 99eb0e937b63dd163488f32f19ed17686d2f4dd5 /pkgs/stdenv | |
| parent | 621168bf03bdecd6c91a96e2438fe65d9b3b5256 (diff) | |
| download | nixlib-ac36a0f9eb9954281bb7904e61549a0661644ab7.tar nixlib-ac36a0f9eb9954281bb7904e61549a0661644ab7.tar.gz nixlib-ac36a0f9eb9954281bb7904e61549a0661644ab7.tar.bz2 nixlib-ac36a0f9eb9954281bb7904e61549a0661644ab7.tar.lz nixlib-ac36a0f9eb9954281bb7904e61549a0661644ab7.tar.xz nixlib-ac36a0f9eb9954281bb7904e61549a0661644ab7.tar.zst nixlib-ac36a0f9eb9954281bb7904e61549a0661644ab7.zip | |
manual: hardening: Fix disabled flags prose being in previous section
This confused the hell out of me, as I didn't spot the > The following flags are disabled by default ... when reading about `pie`, because that sentence was hidden in the previous hardening flag's section. Also explain that `pie` hardening is on by default on musl.
Diffstat (limited to 'pkgs/stdenv')
| -rw-r--r-- | pkgs/stdenv/generic/make-derivation.nix | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix index 4536024c5118..d6704d59111a 100644 --- a/pkgs/stdenv/generic/make-derivation.nix +++ b/pkgs/stdenv/generic/make-derivation.nix @@ -110,7 +110,9 @@ in rec { ++ depsTargetTarget ++ depsTargetTargetPropagated) == 0; dontAddHostSuffix = attrs ? outputHash && !noNonNativeDeps || !stdenv.hasCC; supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ]; - # Musl-based platforms will keep "pie", other platforms will not. + # Musl-based platforms will keep "pie", other platforms will not. + # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}` + # in the nixpkgs manual to inform users about the defaults. defaultHardeningFlags = if stdenv.hostPlatform.isMusl && # Except when: # - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries. |