hardening: fix #18995
This commit is contained in:
parent
cc4677c36e
commit
9fe17b2153
|
@ -5,6 +5,7 @@ var_templates_list=(
|
||||||
NIX+LDFLAGS_BEFORE
|
NIX+LDFLAGS_BEFORE
|
||||||
NIX+LDFLAGS_AFTER
|
NIX+LDFLAGS_AFTER
|
||||||
NIX+LDFLAGS_HARDEN
|
NIX+LDFLAGS_HARDEN
|
||||||
|
NIX+HARDENING_ENABLE
|
||||||
)
|
)
|
||||||
var_templates_bool=(
|
var_templates_bool=(
|
||||||
NIX+SET_BUILD_ID
|
NIX+SET_BUILD_ID
|
||||||
|
|
|
@ -1,33 +1,41 @@
|
||||||
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
|
allHardeningFlags=(fortify stackprotector pie pic strictoverflow format relro bindnow)
|
||||||
# Intentionally word-split in case 'hardeningEnable' is defined in
|
|
||||||
# Nix. Also, our bootstrap tools version of bash is old enough that
|
|
||||||
# undefined arrays trip `set -u`.
|
|
||||||
if [[ -v hardeningEnable[@] ]]; then
|
|
||||||
hardeningFlags+=(${hardeningEnable[@]})
|
|
||||||
fi
|
|
||||||
hardeningCFlags=()
|
hardeningCFlags=()
|
||||||
|
|
||||||
declare -A hardeningDisableMap
|
declare -A hardeningDisableMap
|
||||||
|
declare -A hardeningEnableMap
|
||||||
|
|
||||||
# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
|
# Create table of unsupported flags for this toolchain.
|
||||||
for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
|
for flag in @hardening_unsupported_flags@; do
|
||||||
do
|
|
||||||
hardeningDisableMap[$flag]=1
|
hardeningDisableMap[$flag]=1
|
||||||
done
|
done
|
||||||
|
|
||||||
|
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
|
||||||
|
# array expansion also prevents undefined variables from causing trouble with
|
||||||
|
# `set -u`.
|
||||||
|
for flag in ${NIX_HARDENING_ENABLE+}; do
|
||||||
|
if [[ -n "${hardeningDisableMap[$flag]}" ]]; then
|
||||||
|
hardeningEnableMap[$flag]=1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||||
|
# Determine which flags were effectively disabled so we can report below.
|
||||||
|
for flag in ${allHardeningFlags[@]}; do
|
||||||
|
if [[ -z "${hardeningEnableMap[$flag]}" ]]; then
|
||||||
|
hardeningDisableMap[$flag]=1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
printf 'HARDENING: disabled flags:' >&2
|
printf 'HARDENING: disabled flags:' >&2
|
||||||
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
|
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
|
||||||
echo >&2
|
echo >&2
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
|
if (( "${#hardeningEnableMap[@]}" )); then
|
||||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||||
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
|
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
|
||||||
fi
|
fi
|
||||||
for flag in "${hardeningFlags[@]}"
|
for flag in "${!hardeningEnableMap[@]}"; do
|
||||||
do
|
|
||||||
if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
|
|
||||||
case $flag in
|
case $flag in
|
||||||
fortify)
|
fortify)
|
||||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
|
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
|
||||||
|
@ -62,6 +70,5 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
|
||||||
# tool supports each flag.
|
# tool supports each flag.
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
fi
|
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
|
|
|
@ -115,6 +115,23 @@ rec {
|
||||||
]
|
]
|
||||||
];
|
];
|
||||||
|
|
||||||
|
defaultHardeningFlags = [
|
||||||
|
"fortify" "stackprotector" "pic" "strictoverflow" "format" "relro" "bindnow"
|
||||||
|
];
|
||||||
|
|
||||||
|
hardeningDisable =
|
||||||
|
let val = attrs.hardeningDisable or [ ];
|
||||||
|
in if builtins.isList val then val else [ val ];
|
||||||
|
|
||||||
|
hardeningEnable =
|
||||||
|
let val = attrs.hardeningEnable or [ ];
|
||||||
|
in if builtins.isList val then val else [ val ];
|
||||||
|
|
||||||
|
enabledHardeningOptions =
|
||||||
|
if builtins.elem "all" hardeningDisable
|
||||||
|
then []
|
||||||
|
else lib.subtractLists hardeningDisable (defaultHardeningFlags ++ hardeningEnable);
|
||||||
|
|
||||||
outputs' =
|
outputs' =
|
||||||
outputs ++
|
outputs ++
|
||||||
(if separateDebugInfo then assert stdenv.hostPlatform.isLinux; [ "debug" ] else []);
|
(if separateDebugInfo then assert stdenv.hostPlatform.isLinux; [ "debug" ] else []);
|
||||||
|
@ -179,6 +196,8 @@ rec {
|
||||||
++ optional (elem "host" configurePlatforms) "--host=${stdenv.hostPlatform.config}"
|
++ optional (elem "host" configurePlatforms) "--host=${stdenv.hostPlatform.config}"
|
||||||
++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
|
++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
|
||||||
|
|
||||||
|
} // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != []) {
|
||||||
|
NIX_HARDENING_ENABLE = enabledHardeningOptions;
|
||||||
} // lib.optionalAttrs (stdenv.buildPlatform.isDarwin) {
|
} // lib.optionalAttrs (stdenv.buildPlatform.isDarwin) {
|
||||||
# TODO: remove lib.unique once nix has a list canonicalization primitive
|
# TODO: remove lib.unique once nix has a list canonicalization primitive
|
||||||
__sandboxProfile =
|
__sandboxProfile =
|
||||||
|
|
|
@ -7,6 +7,9 @@ fi
|
||||||
|
|
||||||
: ${outputs:=out}
|
: ${outputs:=out}
|
||||||
|
|
||||||
|
# If unset, assume the default hardening flags.
|
||||||
|
: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
|
||||||
|
export NIX_HARDENING_ENABLE
|
||||||
|
|
||||||
######################################################################
|
######################################################################
|
||||||
# Hook handling.
|
# Hook handling.
|
||||||
|
|
Loading…
Reference in a new issue