6 files changed, 53 insertions, 6 deletions
diff --git a/pkgs/tools/filesystems/fusesmb/default.nix b/pkgs/tools/filesystems/fusesmb/default.nix
index 4ddab385a427..5a3451810a12 100644
--- a/pkgs/tools/filesystems/fusesmb/default.nix
+++ b/pkgs/tools/filesystems/fusesmb/default.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
       ln -fs ${samba}/lib/libsmbclient.so $out/lib/libsmbclient.so.0
     '';
 
+  hardeningDisable = [ "format" ];
+
   meta = {
     description = "Samba mounted via FUSE";
     homepage = http://www.ricardis.tudelft.nl/~vincent/fusesmb/;
diff --git a/pkgs/tools/filesystems/jfsutils/default.nix b/pkgs/tools/filesystems/jfsutils/default.nix
index 46ded088c696..16d95bd19336 100644
--- a/pkgs/tools/filesystems/jfsutils/default.nix
+++ b/pkgs/tools/filesystems/jfsutils/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha1 = "291e8bd9d615cf3d27e4000117c81a3602484a50";
   };
 
-  patches = [ ./types.patch ];
+  patches = [ ./types.patch ./hardening-format.patch ];
 
   buildInputs = [ libuuid ];
 
diff --git a/pkgs/tools/filesystems/jfsutils/hardening-format.patch b/pkgs/tools/filesystems/jfsutils/hardening-format.patch
new file mode 100644
index 000000000000..dd2a93a81ec6
--- /dev/null
+++ b/pkgs/tools/filesystems/jfsutils/hardening-format.patch
@@ -0,0 +1,37 @@
+--- a/fscklog/fscklog.c	2016-01-29 04:59:54.102223291 +0000
++++ b/fscklog/fscklog.c	2016-01-29 05:00:10.707552565 +0000
+@@ -252,8 +252,8 @@
+ 
+ 	sprintf(debug_detail, " [%s:%d]\n", basename(file_name), line_number);
+ 
+-	printf(msg_string);
+-	printf(debug_detail);
++	printf("%s", msg_string);
++	printf("%s", debug_detail);
+ 
+ 	return 0;
+ }
+--- a/fscklog/display.c	2016-01-29 05:05:42.582133444 +0000
++++ b/fscklog/display.c	2016-01-29 05:05:47.541231780 +0000
+@@ -182,7 +182,7 @@
+ 				} else {
+ 					/* the record looks ok */
+ 					msg_txt = &log_entry[log_entry_pos];
+-					printf(msg_txt);
++					printf("%s", msg_txt);
+ 					/*
+ 					 * set up for the next record
+ 					 */
+--- a/logdump/helpers.c	2016-01-29 05:06:26.081996021 +0000
++++ b/logdump/helpers.c	2016-01-29 05:06:43.097333425 +0000
+@@ -95,8 +95,8 @@
+ 
+ 	sprintf(debug_detail, " [%s:%d]\n", file_name, line_number);
+ 
+-	printf(msg_string);
+-	printf(debug_detail);
++	printf("%s", msg_string);
++	printf("%s", debug_detail);
+ 
+ 	return 0;
+ }
diff --git a/pkgs/tools/filesystems/reiser4progs/default.nix b/pkgs/tools/filesystems/reiser4progs/default.nix
index cd32025e5b66..681fc1c80ef0 100644
--- a/pkgs/tools/filesystems/reiser4progs/default.nix
+++ b/pkgs/tools/filesystems/reiser4progs/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [libaal];
 
+  hardeningDisable = [ "format" ];
+
   preConfigure = ''
     substituteInPlace configure --replace " -static" ""
   '';
diff --git a/pkgs/tools/filesystems/udftools/default.nix b/pkgs/tools/filesystems/udftools/default.nix
index 7cb924c6cf13..b912bab68260 100644
--- a/pkgs/tools/filesystems/udftools/default.nix
+++ b/pkgs/tools/filesystems/udftools/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses readline ];
 
+  hardeningDisable = [ "fortify" ];
+
   NIX_CFLAGS_COMPILE = "-std=gnu90";
 
   preConfigure = ''
diff --git a/pkgs/tools/filesystems/xtreemfs/default.nix b/pkgs/tools/filesystems/xtreemfs/default.nix
index adee80d9c5d0..2a85adb60b56 100644
--- a/pkgs/tools/filesystems/xtreemfs/default.nix
+++ b/pkgs/tools/filesystems/xtreemfs/default.nix
@@ -42,15 +42,19 @@ stdenv.mkDerivation rec {
     substituteInPlace etc/init.d/generate_initd_scripts.sh \
       --replace "/bin/bash" "${stdenv.shell}"
 
+    substituteInPlace cpp/thirdparty/gtest-1.7.0/configure \
+      --replace "/usr/bin/file" "${file}/bin/file"
+
+    substituteInPlace cpp/thirdparty/protobuf-2.5.0/configure \
+      --replace "/usr/bin/file" "${file}/bin/file"
+
+    substituteInPlace cpp/thirdparty/protobuf-2.5.0/gtest/configure \
+      --replace "/usr/bin/file" "${file}/bin/file"
+
     # do not put cmake into buildInputs
     export PATH="$PATH:${cmake}/bin"
   '';
 
-  preBuild = ''
-    substituteInPlace configure \
-    --replace "/usr/bin/file" "${file}/bin/file"
-  '';
-
   doCheck = false;
 
   postInstall = ''