hardening: fix #18995

This commit is contained in:
Charles Strahan 2017-08-07 23:20:21 -04:00
parent cc4677c36e
commit 9fe17b2153
No known key found for this signature in database
GPG key ID: BB47AB4B8489B5A5
4 changed files with 45 additions and 15 deletions

View file

@ -5,6 +5,7 @@ var_templates_list=(
NIX+LDFLAGS_BEFORE
NIX+LDFLAGS_AFTER
NIX+LDFLAGS_HARDEN
NIX+HARDENING_ENABLE
)
var_templates_bool=(
NIX+SET_BUILD_ID

View file

@ -1,33 +1,41 @@
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
# Intentionally word-split in case 'hardeningEnable' is defined in
# Nix. Also, our bootstrap tools version of bash is old enough that
# undefined arrays trip `set -u`.
if [[ -v hardeningEnable[@] ]]; then
hardeningFlags+=(${hardeningEnable[@]})
fi
allHardeningFlags=(fortify stackprotector pie pic strictoverflow format relro bindnow)
hardeningCFlags=()
declare -A hardeningDisableMap
declare -A hardeningEnableMap
# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
do
# Create table of unsupported flags for this toolchain.
for flag in @hardening_unsupported_flags@; do
hardeningDisableMap[$flag]=1
done
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
# array expansion also prevents undefined variables from causing trouble with
# `set -u`.
for flag in ${NIX_HARDENING_ENABLE+}; do
if [[ -n "${hardeningDisableMap[$flag]}" ]]; then
hardeningEnableMap[$flag]=1
fi
done
if (( "${NIX_DEBUG:-0}" >= 1 )); then
# Determine which flags were effectively disabled so we can report below.
for flag in ${allHardeningFlags[@]}; do
if [[ -z "${hardeningEnableMap[$flag]}" ]]; then
hardeningDisableMap[$flag]=1
fi
done
printf 'HARDENING: disabled flags:' >&2
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
echo >&2
fi
if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
if (( "${#hardeningEnableMap[@]}" )); then
if (( "${NIX_DEBUG:-0}" >= 1 )); then
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
fi
for flag in "${hardeningFlags[@]}"
do
if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
for flag in "${!hardeningEnableMap[@]}"; do
case $flag in
fortify)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
@ -62,6 +70,5 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
# tool supports each flag.
;;
esac
fi
done
fi

View file

@ -115,6 +115,23 @@ rec {
]
];
defaultHardeningFlags = [
"fortify" "stackprotector" "pic" "strictoverflow" "format" "relro" "bindnow"
];
hardeningDisable =
let val = attrs.hardeningDisable or [ ];
in if builtins.isList val then val else [ val ];
hardeningEnable =
let val = attrs.hardeningEnable or [ ];
in if builtins.isList val then val else [ val ];
enabledHardeningOptions =
if builtins.elem "all" hardeningDisable
then []
else lib.subtractLists hardeningDisable (defaultHardeningFlags ++ hardeningEnable);
outputs' =
outputs ++
(if separateDebugInfo then assert stdenv.hostPlatform.isLinux; [ "debug" ] else []);
@ -179,6 +196,8 @@ rec {
++ optional (elem "host" configurePlatforms) "--host=${stdenv.hostPlatform.config}"
++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
} // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != []) {
NIX_HARDENING_ENABLE = enabledHardeningOptions;
} // lib.optionalAttrs (stdenv.buildPlatform.isDarwin) {
# TODO: remove lib.unique once nix has a list canonicalization primitive
__sandboxProfile =

View file

@ -7,6 +7,9 @@ fi
: ${outputs:=out}
# If unset, assume the default hardening flags.
: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
export NIX_HARDENING_ENABLE
######################################################################
# Hook handling.