17 files changed, 17 insertions, 20 deletions
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 6e7c6daca56d..a06d3d0729a1 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -20,7 +20,7 @@ let
     };
 
     # FIXME needs gcc 4.9 in bootstrap tools
-    hardening_stackprotector = false;
+    hardeningDisable = [ "stackprotector" ];
 
     patches = optional stdenv.isCygwin ./coreutils-8.23-4.cygwin.patch;
 
diff --git a/pkgs/tools/misc/ddccontrol/default.nix b/pkgs/tools/misc/ddccontrol/default.nix
index d537c0f506fc..132707106af0 100644
--- a/pkgs/tools/misc/ddccontrol/default.nix
+++ b/pkgs/tools/misc/ddccontrol/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
       ddccontrol-db
     ];
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   prePatch = ''
       newPath=$(echo "${ddccontrol-db}/share/ddccontrol-db" | sed "s/\\//\\\\\\//g")
diff --git a/pkgs/tools/misc/detox/default.nix b/pkgs/tools/misc/detox/default.nix
index 4475010f3b85..7d17dee8b53c 100644
--- a/pkgs/tools/misc/detox/default.nix
+++ b/pkgs/tools/misc/detox/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   buildInputs = [flex];
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   meta = with stdenv.lib; {
     homepage = http://detox.sourceforge.net/;
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index f99b83a2a0a5..80fb3c6a694c 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ tcl ];
   nativeBuildInputs = [ makeWrapper ];
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   patchPhase = ''
     sed -i "s,/bin/stty,$(type -p stty),g" configure
diff --git a/pkgs/tools/misc/gbdfed/default.nix b/pkgs/tools/misc/gbdfed/default.nix
index d3b62149bdf3..1ba4bceb7876 100644
--- a/pkgs/tools/misc/gbdfed/default.nix
+++ b/pkgs/tools/misc/gbdfed/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./Makefile.patch ];
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   meta = {
     description = "Bitmap Font Editor";
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index f3c09ef686a9..d56f9b3ce0f0 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     ++ optional doCheck qemu
     ++ optional zfsSupport zfs;
 
-  hardening_all = false;
+  hardeningDisable = [ "all" ];
 
   preConfigure =
     '' for i in "tests/util/"*.in
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index c0579b918164..a690ef2084b2 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
   # autoreconfHook required for the splashimage patch.
   buildInputs = [ autoreconfHook texinfo ];
 
-  hardening_stackprotector = false;
+  hardeningDisable = [ "stackprotector" ];
 
   prePatch = ''
     unpackFile $gentooPatches
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 39c1ce9c0c11..fc8784decc5f 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -47,8 +47,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses libusb freetype gettext devicemapper ]
     ++ optional doCheck qemu;
 
-  hardening_stackprotector = false;
-  hardening_pic = false;
+  hardeningDisable = [ "stackprotector" "pic" ];
 
   preConfigure =
     '' for i in "tests/util/"*.in
diff --git a/pkgs/tools/misc/gummiboot/default.nix b/pkgs/tools/misc/gummiboot/default.nix
index b73d83201e0e..7946a3b062fc 100644
--- a/pkgs/tools/misc/gummiboot/default.nix
+++ b/pkgs/tools/misc/gummiboot/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gnu-efi pkgconfig libxslt utillinux ];
 
-  hardening_stackprotector = false;
+  hardeningDisable = [ "stackprotector" ];
 
   # Sigh, gummiboot should be able to find this in buildInputs
   configureFlags = [
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index 0830eb51b3ca..78f49588e8c3 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -19,8 +19,7 @@ stdenv.mkDerivation {
   preConfigure = "cd src";
 
   # not possible due to assembler code
-  hardening_pic = false;
-  hardening_stackprotector = false;
+  hardeningDisable = [ "pic" "stackprotector" ];
 
   makeFlags =
     [ "ECHO_E_BIN_ECHO=echo" "ECHO_E_BIN_ECHO_E=echo" # No /bin/echo here.
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index 097c26071fcf..62d490ea4f9e 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -22,8 +22,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-I. -std=gnu90";
 
-  hardening_pic = false;
-  hardening_stackprotector = false;
+  hardeningDisable = [ "stackprotector" "pic" ];
 
   buildFlags = "memtest.bin";
 
diff --git a/pkgs/tools/misc/pal/default.nix b/pkgs/tools/misc/pal/default.nix
index a65bd1fe8ec1..f92069e7b9f5 100644
--- a/pkgs/tools/misc/pal/default.nix
+++ b/pkgs/tools/misc/pal/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ glib gettext readline pkgconfig ];
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   meta = {
     homepage = http://palcal.sourceforge.net/;
diff --git a/pkgs/tools/misc/sutils/default.nix b/pkgs/tools/misc/sutils/default.nix
index 48c47cc3d8db..8d4f00ee8478 100644
--- a/pkgs/tools/misc/sutils/default.nix
+++ b/pkgs/tools/misc/sutils/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
      sha256 = "0xqk42vl82chy458d64fj68a4md4bxaip8n3xw9skxz0a1sgvks8";
    };
 
-   hardening_format = false;
+   hardeningDisable = [ "format" ];
 
    prePatch = ''sed -i "s@/usr/local@$out@" Makefile'';
 
diff --git a/pkgs/tools/misc/uucp/default.nix b/pkgs/tools/misc/uucp/default.nix
index cba343863bef..4ef050b409e5 100644
--- a/pkgs/tools/misc/uucp/default.nix
+++ b/pkgs/tools/misc/uucp/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0b5nhl9vvif1w3wdipjsk8ckw49jj1w85xw1mmqi3zbcpazia306";
   };
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   meta = {
     description = "Unix-unix cp over serial line, also includes cu program";
diff --git a/pkgs/tools/misc/vorbisgain/default.nix b/pkgs/tools/misc/vorbisgain/default.nix
index 292023a1b582..567783f63138 100644
--- a/pkgs/tools/misc/vorbisgain/default.nix
+++ b/pkgs/tools/misc/vorbisgain/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1v1h6mhnckmvvn7345hzi9abn5z282g4lyyl4nnbqwnrr98v0vfx";
   };
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   buildInputs = [ unzip libogg libvorbis ];
 
diff --git a/pkgs/tools/misc/wv/default.nix b/pkgs/tools/misc/wv/default.nix
index 3d828a55121e..debc2c239ad6 100644
--- a/pkgs/tools/misc/wv/default.nix
+++ b/pkgs/tools/misc/wv/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ zlib imagemagick libpng glib pkgconfig libgsf libxml2 bzip2 ];
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   meta = {
     description = "Converter from Microsoft Word formats to human-editable ones";
diff --git a/pkgs/tools/misc/xfstests/default.nix b/pkgs/tools/misc/xfstests/default.nix
index cef5fee9cf93..31b6e74917e8 100644
--- a/pkgs/tools/misc/xfstests/default.nix
+++ b/pkgs/tools/misc/xfstests/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ acl autoreconfHook attr gawk libaio libuuid libxfs openssl perl ];
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   patchPhase = ''
     # Patch the destination directory