MirrorHub/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-16 23:03:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

mkDerivation: fix hardening flags check

Browse source 
- allow "all" in hardeningDisable
- fix busybox flags
- print detailed error message

Discussed at https://github.com/NixOS/nixpkgs/pull/28555#issuecomment-326413032
This commit is contained in:
Orivej Desh 2017-09-01 00:46:26 +00:00
parent 46d6fecf78
commit d70006c6d9
2 changed files with 8 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkgs/os-specific/linux/busybox/default.nix
View file

@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
sha256 = "1pv3vs2w4l2wnw5qb0rkbpvjjdd1fwjv87miavqq0r0ynqbfajwx";
};
hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
patches = [ ./busybox-in-store.patch ];

15
pkgs/stdenv/generic/make-derivation.nix
View file

@ -47,15 +47,14 @@ rec {
, ... } @ attrs:
# TODO(@Ericson2314): Make this more modular, and not O(n^2).
let allHardeningFlags = [
"fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro"
"bindnow"
];
in assert lib.all
(flag: lib.elem flag allHardeningFlags)
(hardeningEnable ++ hardeningDisable);
let
supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
erroneousHardeningFlags = lib.subtractLists supportedHardeningFlags (hardeningEnable ++ lib.remove "all" hardeningDisable);
in if builtins.length erroneousHardeningFlags != 0
then abort ("mkDerivation was called with unsupported hardening flags: " + lib.generators.toPretty {} {
inherit erroneousHardeningFlags hardeningDisable hardeningEnable supportedHardeningFlags;
})
else let
dependencies = map lib.chooseDevOutputs [
(map (drv: drv.nativeDrv or drv) nativeBuildInputs
++ lib.optional separateDebugInfo ../../build-support/setup-hooks/separate-debug-info.sh