diff --git a/doc/stdenv.xml b/doc/stdenv.xml index f8d9acb2fb0..0c2bb033957 100644 --- a/doc/stdenv.xml +++ b/doc/stdenv.xml @@ -1317,6 +1317,33 @@ in the default system locations. +
Hardening in Nixpkgs + +By default some flags to harden packages at compile or link-time are set: + + + + + hardening_format + Adds the compiler options. At present, + this warns about calls to printf and scanf functions where the + format string is not a string literal and there are no format + arguments, as in printf(foo);. This may be + a security hole if the format string came from untrusted input + and contains %n. + + This needs to be turned off or fixed for errors similar to: + + +/tmp/nix-build-zynaddsubfx-2.5.2.drv-0/zynaddsubfx-2.5.2/src/UI/guimain.cpp:571:28: error: format not a string literal and no format arguments [-Werror=format-security] + printf(help_message); + ^ +cc1plus: some warnings being treated as errors + + + +