hardening: fix #18995
This commit is contained in:
parent
cc4677c36e
commit
9fe17b2153
|
@ -5,6 +5,7 @@ var_templates_list=(
|
|||
NIX+LDFLAGS_BEFORE
|
||||
NIX+LDFLAGS_AFTER
|
||||
NIX+LDFLAGS_HARDEN
|
||||
NIX+HARDENING_ENABLE
|
||||
)
|
||||
var_templates_bool=(
|
||||
NIX+SET_BUILD_ID
|
||||
|
|
|
@ -1,33 +1,41 @@
|
|||
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
|
||||
# Intentionally word-split in case 'hardeningEnable' is defined in
|
||||
# Nix. Also, our bootstrap tools version of bash is old enough that
|
||||
# undefined arrays trip `set -u`.
|
||||
if [[ -v hardeningEnable[@] ]]; then
|
||||
hardeningFlags+=(${hardeningEnable[@]})
|
||||
fi
|
||||
allHardeningFlags=(fortify stackprotector pie pic strictoverflow format relro bindnow)
|
||||
hardeningCFlags=()
|
||||
|
||||
declare -A hardeningDisableMap
|
||||
declare -A hardeningEnableMap
|
||||
|
||||
# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
|
||||
for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
|
||||
do
|
||||
# Create table of unsupported flags for this toolchain.
|
||||
for flag in @hardening_unsupported_flags@; do
|
||||
hardeningDisableMap[$flag]=1
|
||||
done
|
||||
|
||||
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
|
||||
# array expansion also prevents undefined variables from causing trouble with
|
||||
# `set -u`.
|
||||
for flag in ${NIX_HARDENING_ENABLE+}; do
|
||||
if [[ -n "${hardeningDisableMap[$flag]}" ]]; then
|
||||
hardeningEnableMap[$flag]=1
|
||||
fi
|
||||
done
|
||||
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||
# Determine which flags were effectively disabled so we can report below.
|
||||
for flag in ${allHardeningFlags[@]}; do
|
||||
if [[ -z "${hardeningEnableMap[$flag]}" ]]; then
|
||||
hardeningDisableMap[$flag]=1
|
||||
fi
|
||||
done
|
||||
|
||||
printf 'HARDENING: disabled flags:' >&2
|
||||
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
|
||||
echo >&2
|
||||
fi
|
||||
|
||||
if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
|
||||
if (( "${#hardeningEnableMap[@]}" )); then
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
|
||||
fi
|
||||
for flag in "${hardeningFlags[@]}"
|
||||
do
|
||||
if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
|
||||
for flag in "${!hardeningEnableMap[@]}"; do
|
||||
case $flag in
|
||||
fortify)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
|
||||
|
@ -62,6 +70,5 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
|
|||
# tool supports each flag.
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
|
|
@ -115,6 +115,23 @@ rec {
|
|||
]
|
||||
];
|
||||
|
||||
defaultHardeningFlags = [
|
||||
"fortify" "stackprotector" "pic" "strictoverflow" "format" "relro" "bindnow"
|
||||
];
|
||||
|
||||
hardeningDisable =
|
||||
let val = attrs.hardeningDisable or [ ];
|
||||
in if builtins.isList val then val else [ val ];
|
||||
|
||||
hardeningEnable =
|
||||
let val = attrs.hardeningEnable or [ ];
|
||||
in if builtins.isList val then val else [ val ];
|
||||
|
||||
enabledHardeningOptions =
|
||||
if builtins.elem "all" hardeningDisable
|
||||
then []
|
||||
else lib.subtractLists hardeningDisable (defaultHardeningFlags ++ hardeningEnable);
|
||||
|
||||
outputs' =
|
||||
outputs ++
|
||||
(if separateDebugInfo then assert stdenv.hostPlatform.isLinux; [ "debug" ] else []);
|
||||
|
@ -179,6 +196,8 @@ rec {
|
|||
++ optional (elem "host" configurePlatforms) "--host=${stdenv.hostPlatform.config}"
|
||||
++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
|
||||
|
||||
} // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != []) {
|
||||
NIX_HARDENING_ENABLE = enabledHardeningOptions;
|
||||
} // lib.optionalAttrs (stdenv.buildPlatform.isDarwin) {
|
||||
# TODO: remove lib.unique once nix has a list canonicalization primitive
|
||||
__sandboxProfile =
|
||||
|
|
|
@ -7,6 +7,9 @@ fi
|
|||
|
||||
: ${outputs:=out}
|
||||
|
||||
# If unset, assume the default hardening flags.
|
||||
: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
|
||||
export NIX_HARDENING_ENABLE
|
||||
|
||||
######################################################################
|
||||
# Hook handling.
|
||||
|
|
Loading…
Reference in a new issue