diff options
Diffstat (limited to 'nixpkgs/pkgs/stdenv/generic')
| -rw-r--r-- | nixpkgs/pkgs/stdenv/generic/default.nix | 2 | ||||
| -rw-r--r-- | nixpkgs/pkgs/stdenv/generic/make-derivation.nix | 30 | ||||
| -rw-r--r-- | nixpkgs/pkgs/stdenv/generic/setup.sh | 6 |
3 files changed, 23 insertions, 15 deletions
diff --git a/nixpkgs/pkgs/stdenv/generic/default.nix b/nixpkgs/pkgs/stdenv/generic/default.nix index cf194be92bd7..e764571869db 100644 --- a/nixpkgs/pkgs/stdenv/generic/default.nix +++ b/nixpkgs/pkgs/stdenv/generic/default.nix @@ -109,7 +109,7 @@ let # there (yet?) so it goes here until then. preHook = preHook + lib.optionalString buildPlatform.isDarwin '' export NIX_DONT_SET_RPATH_FOR_BUILD=1 - '' + lib.optionalString (hostPlatform.isDarwin || (hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.elf && hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.macho)) '' + '' + lib.optionalString (hostPlatform.isDarwin || (!hostPlatform.isElf && !hostPlatform.isMacho)) '' export NIX_DONT_SET_RPATH=1 export NIX_NO_SELF_RPATH=1 '' + lib.optionalString (hostPlatform.isDarwin && hostPlatform.isMacOS) '' diff --git a/nixpkgs/pkgs/stdenv/generic/make-derivation.nix b/nixpkgs/pkgs/stdenv/generic/make-derivation.nix index faa83507893f..cb1607c5e63a 100644 --- a/nixpkgs/pkgs/stdenv/generic/make-derivation.nix +++ b/nixpkgs/pkgs/stdenv/generic/make-derivation.nix @@ -239,23 +239,27 @@ let # disabling fortify implies fortify3 should also be disabled then unique (hardeningDisable ++ [ "fortify3" ]) else hardeningDisable; - supportedHardeningFlags = [ "fortify" "fortify3" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ]; - # Musl-based platforms will keep "pie", other platforms will not. - # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}` - # in the nixpkgs manual to inform users about the defaults. - defaultHardeningFlags = if stdenv.hostPlatform.isMusl && - # Except when: - # - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries. - # - static armv7l, where compilation fails. - !(stdenv.hostPlatform.isAarch && stdenv.hostPlatform.isStatic) - then supportedHardeningFlags - else remove "pie" supportedHardeningFlags; + knownHardeningFlags = [ + "bindnow" + "format" + "fortify" + "fortify3" + "pic" + "pie" + "relro" + "stackprotector" + "strictoverflow" + ]; + defaultHardeningFlags = + (if stdenv.hasCC then stdenv.cc else {}).defaultHardeningFlags or + # fallback safe-ish set of flags + (remove "pie" knownHardeningFlags); enabledHardeningOptions = if builtins.elem "all" hardeningDisable' then [] else subtractLists hardeningDisable' (defaultHardeningFlags ++ hardeningEnable); # hardeningDisable additionally supports "all". - erroneousHardeningFlags = subtractLists supportedHardeningFlags (hardeningEnable ++ remove "all" hardeningDisable); + erroneousHardeningFlags = subtractLists knownHardeningFlags (hardeningEnable ++ remove "all" hardeningDisable); checkDependencyList = checkDependencyList' []; checkDependencyList' = positions: name: deps: flip imap1 deps (index: dep: @@ -264,7 +268,7 @@ let else throw "Dependency is not of a valid type: ${concatMapStrings (ix: "element ${toString ix} of ") ([index] ++ positions)}${name} for ${attrs.name or attrs.pname}"); in if builtins.length erroneousHardeningFlags != 0 then abort ("mkDerivation was called with unsupported hardening flags: " + lib.generators.toPretty {} { - inherit erroneousHardeningFlags hardeningDisable hardeningEnable supportedHardeningFlags; + inherit erroneousHardeningFlags hardeningDisable hardeningEnable knownHardeningFlags; }) else let doCheck = doCheck'; diff --git a/nixpkgs/pkgs/stdenv/generic/setup.sh b/nixpkgs/pkgs/stdenv/generic/setup.sh index 081024781eef..ec8df76f2c79 100644 --- a/nixpkgs/pkgs/stdenv/generic/setup.sh +++ b/nixpkgs/pkgs/stdenv/generic/setup.sh @@ -1044,7 +1044,11 @@ _defaultUnpack() { case "$fn" in *.tar.xz | *.tar.lzma | *.txz) # Don't rely on tar knowing about .xz. - xz -d < "$fn" | tar xf - --warning=no-timestamp + # Additionally, we have multiple different xz binaries with different feature sets in different + # stages. The XZ_OPT env var is only used by the full "XZ utils" implementation, which supports + # the --threads (-T) flag. This allows us to enable multithreaded decompression exclusively on + # that implementation, without the use of complex bash conditionals and checks. + XZ_OPT="--threads=$NIX_BUILD_CORES" xz -d < "$fn" | tar xf - --warning=no-timestamp ;; *.tar | *.tar.* | *.tgz | *.tbz2 | *.tbz) # GNU tar can automatically select the decompression method |