hardening: fix careless bugs
I got a substitution backwards (used '+' instead of '-'). Also, this now works under `set -u` (had to fix a couple unbound variable references).
This commit is contained in:
parent
0937df463f
commit
9920923cde
|
@ -1,8 +1,8 @@
|
||||||
allHardeningFlags=(fortify stackprotector pie pic strictoverflow format relro bindnow)
|
allHardeningFlags=(fortify stackprotector pie pic strictoverflow format relro bindnow)
|
||||||
hardeningCFlags=()
|
hardeningCFlags=()
|
||||||
|
|
||||||
declare -A hardeningDisableMap
|
declare -A hardeningDisableMap=()
|
||||||
declare -A hardeningEnableMap
|
declare -A hardeningEnableMap=()
|
||||||
|
|
||||||
# Create table of unsupported flags for this toolchain.
|
# Create table of unsupported flags for this toolchain.
|
||||||
for flag in @hardening_unsupported_flags@; do
|
for flag in @hardening_unsupported_flags@; do
|
||||||
|
@ -12,8 +12,8 @@ done
|
||||||
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
|
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
|
||||||
# array expansion also prevents undefined variables from causing trouble with
|
# array expansion also prevents undefined variables from causing trouble with
|
||||||
# `set -u`.
|
# `set -u`.
|
||||||
for flag in ${NIX_HARDENING_ENABLE+}; do
|
for flag in ${NIX_HARDENING_ENABLE-}; do
|
||||||
if [[ -z "${hardeningDisableMap[$flag]}" ]]; then
|
if [[ -z "${hardeningDisableMap[$flag]-}" ]]; then
|
||||||
hardeningEnableMap[$flag]=1
|
hardeningEnableMap[$flag]=1
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
|
@ -21,7 +21,7 @@ done
|
||||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||||
# Determine which flags were effectively disabled so we can report below.
|
# Determine which flags were effectively disabled so we can report below.
|
||||||
for flag in ${allHardeningFlags[@]}; do
|
for flag in ${allHardeningFlags[@]}; do
|
||||||
if [[ -z "${hardeningEnableMap[$flag]}" ]]; then
|
if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
|
||||||
hardeningDisableMap[$flag]=1
|
hardeningDisableMap[$flag]=1
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
|
|
Loading…
Reference in a new issue