b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

make-derivation: enable pie hardening with musl

Browse source 
Fixes #49071

On ld.gold, we produce broken executables when linking with the Musl
libc. This appears to be a known bug when using ld.gold and Musl. This
thread describes the workaround as enabling PIE when using ld.gold and
Musl:

https://www.openwall.com/lists/musl/2015/05/01/5

By default we don’t enable PIE to avoid breaking things. But in the
Musl case we are breaking things by not enabling PIE. So this adds a
special case for defaultHardeningFlags which keeps the pie hardening
for everything. Any packages that break with PIE can add the pie flag
to disableHardeningFlags array (a no-op for now on anything but Musl).
This commit is contained in:
Matthew Bauer 2018-11-03 13:55:50 -05:00 committed by Robin Gloster
parent d3cfda14fb
commit 6d531f3541
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
pkgs/stdenv/generic/make-derivation.nix
View file

@ -93,7 +93,9 @@ rec {
++ depsTargetTarget ++ depsTargetTargetPropagated) == 0;
runtimeSensativeIfFixedOutput = fixedOutputDrv -> !noNonNativeDeps;
supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
defaultHardeningFlags = lib.remove "pie" supportedHardeningFlags;
defaultHardeningFlags = if stdenv.targetPlatform.isMusl
then supportedHardeningFlags
else lib.remove "pie" supportedHardeningFlags;
enabledHardeningOptions =
if builtins.elem "all" hardeningDisable
then []