colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #28806 from orivej/mkDerivation

Browse Source 
mkDerivation: fix hardening flags check
This commit is contained in:
John Ericson 2017-08-31 21:35:38 -04:00 committed by GitHub
commit 0cdbd2d662
2 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkgs/os-specific/linux/busybox/default.nix
View File

@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
sha256 = "1pv3vs2w4l2wnw5qb0rkbpvjjdd1fwjv87miavqq0r0ynqbfajwx";
};
hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
patches = [ ./busybox-in-store.patch ];

15
pkgs/stdenv/generic/make-derivation.nix
View File

@ -47,15 +47,14 @@ rec {
, ... } @ attrs:
# TODO(@Ericson2314): Make this more modular, and not O(n^2).
let allHardeningFlags = [
"fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro"
"bindnow"
];
in assert lib.all
(flag: lib.elem flag allHardeningFlags)
(hardeningEnable ++ hardeningDisable);
let
supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
erroneousHardeningFlags = lib.subtractLists supportedHardeningFlags (hardeningEnable ++ lib.remove "all" hardeningDisable);
in if builtins.length erroneousHardeningFlags != 0
then abort ("mkDerivation was called with unsupported hardening flags: " + lib.generators.toPretty {} {
inherit erroneousHardeningFlags hardeningDisable hardeningEnable supportedHardeningFlags;
})
else let
dependencies = map lib.chooseDevOutputs [
(map (drv: drv.nativeDrv or drv) nativeBuildInputs
++ lib.optional separateDebugInfo ../../build-support/setup-hooks/separate-debug-info.sh