treewide: disable pie in more places

Some packages don’t work correctly with pie. Here I disable it for:

- busybox
- linux kernel
- kexectools

I also get rid of the Musl conditional for disabling pie in GCC and
Binutils. Some day we might want to enable PIE without Musl and it
will be useful to have the *just* work with our compiler and linkers.
This commit is contained in:
Matthew Bauer 2018-11-10 13:49:36 -06:00
parent 08d98b2e38
commit 76c956be5c
11 changed files with 12 additions and 11 deletions

View file

@ -177,7 +177,7 @@ stdenv.mkDerivation ({
inherit patches;
hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "format" "pie" ];
outputs = [ "out" "lib" "man" "info" ];
setOutputFlags = false;

View file

@ -185,7 +185,7 @@ stdenv.mkDerivation ({
inherit patches;
hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "format" "pie" ];
outputs = if langJava || langGo then ["out" "man" "info"]
else [ "out" "lib" "man" "info" ];

View file

@ -178,7 +178,7 @@ stdenv.mkDerivation ({
libc_dev = stdenv.cc.libc_dev;
hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "format" "pie" ];
# This should kill all the stdinc frameworks that gcc and friends like to
# insert into default search paths.

View file

@ -178,7 +178,7 @@ stdenv.mkDerivation ({
libc_dev = stdenv.cc.libc_dev;
hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "format" "pie" ];
# This should kill all the stdinc frameworks that gcc and friends like to
# insert into default search paths.

View file

@ -149,7 +149,7 @@ stdenv.mkDerivation ({
libc_dev = stdenv.cc.libc_dev;
hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "format" "pie" ];
# This should kill all the stdinc frameworks that gcc and friends like to
# insert into default search paths.

View file

@ -143,7 +143,7 @@ stdenv.mkDerivation ({
libc_dev = stdenv.cc.libc_dev;
hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "format" "pie" ];
# This should kill all the stdinc frameworks that gcc and friends like to
# insert into default search paths.

View file

@ -137,7 +137,7 @@ stdenv.mkDerivation ({
libc_dev = stdenv.cc.libc_dev;
hardeningDisable = [ "format" ];
hardeningDisable = [ "format" "pie" ];
postPatch =
if targetPlatform != hostPlatform || stdenv.cc.libc != null then

View file

@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
then "-Wno-string-plus-int -Wno-deprecated-declarations"
else "-static-libgcc";
hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "format" "pie" ];
# TODO(@Ericson2314): Always pass "--target" and always targetPrefix.
configurePlatforms = [ "build" "host" ] ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";

View file

@ -42,7 +42,8 @@ stdenv.mkDerivation rec {
sha256 = "1dzg45vgy2w1xcd3p6h8d76ykhabbvk1h0lf8yb24ikrwlv8cr4p";
};
hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
hardeningDisable = [ "format" "pie" ]
++ lib.optionals enableStatic [ "fortify" ];
patches = [
./busybox-in-store.patch

View file

@ -269,7 +269,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.platform kernelPatches
++ optionals stdenv.lib.inNixShell [ pkgconfig ncurses ]
;
hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" ];
hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
# Absolute paths for compilers avoid any PATH-clobbering issues.
makeFlags = commonMakeFlags ++ [

View file

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
sha256 = "1ac20jws8iys9w6dpn4q3hihyx73zkabdwv3gcb779cxfrmq2k2h";
};
hardeningDisable = [ "format" "pic" "relro" ];
hardeningDisable = [ "format" "pic" "relro" "pie" ];
configureFlags = [ "BUILD_CC=${buildPackages.stdenv.cc.targetPrefix}cc" ];
nativeBuildInputs = [ buildPackages.stdenv.cc ];