grsecurity: Add paxctl, paxmark and stdenv.needsPax to stdenv

This commit is contained in:
Ricardo M. Correia 2014-02-17 19:29:43 +01:00
parent 4be7e939a0
commit 8d5ce245a2
3 changed files with 21 additions and 2 deletions

View file

@ -10,6 +10,8 @@ let lib = import ../../../lib; in lib.makeOverridable (
, setupScript ? ./setup.sh
, extraBuildInputs ? []
, skipPaxMarking ? false
}:
let
@ -157,6 +159,9 @@ let
|| system == "armv6l-linux"
|| system == "armv7l-linux";
# Whether we should run paxctl to pax-mark binaries
needsPax = isLinux && !skipPaxMarking;
# For convenience, bring in the library functions in lib/ so
# packages don't have to do that themselves.
inherit lib;

View file

@ -93,6 +93,7 @@ PATH=
for i in $NIX_GCC @initialPath@; do
if [ "$i" = / ]; then i=; fi
addToSearchPath PATH $i/bin
addToSearchPath PATH $i/sbin
done
if [ "$NIX_DEBUG" = 1 ]; then
@ -293,6 +294,18 @@ stripDirs() {
fi
}
# PaX-mark binaries
paxmark() {
local flags="$1"
shift
if [ -z "@needsPax@" ]; then
return
fi
paxctl -c "$@"
paxctl -zex -${flags} "$@"
}
######################################################################
# Textual substitution functions.

View file

@ -210,6 +210,7 @@ rec {
extraAttrs = {
glibc = stdenvLinuxGlibc; # Required by gcc47 build
};
extraPath = [ stdenvLinuxBoot1Pkgs.paxctl ];
inherit fetchurl;
};
@ -268,7 +269,7 @@ rec {
initialPath =
((import ../common-path.nix) {pkgs = stdenvLinuxBoot4Pkgs;})
++ [stdenvLinuxBoot4Pkgs.patchelf];
++ [stdenvLinuxBoot4Pkgs.patchelf stdenvLinuxBoot4Pkgs.paxctl ];
gcc = wrapGCC rec {
inherit (stdenvLinuxBoot4Pkgs) binutils coreutils;
@ -295,7 +296,7 @@ rec {
inherit (stdenvLinuxBoot4Pkgs)
gzip bzip2 xz bash coreutils diffutils findutils gawk
gnumake gnused gnutar gnugrep gnupatch patchelf
attr acl;
attr acl paxctl;
};
};