Merge pull request #239331 from pwaller/fix-pie-hardening
This commit is contained in:
commit
8bf1b878cf
@ -37,11 +37,11 @@ fi
|
|||||||
for flag in "${!hardeningEnableMap[@]}"; do
|
for flag in "${!hardeningEnableMap[@]}"; do
|
||||||
case $flag in
|
case $flag in
|
||||||
pie)
|
pie)
|
||||||
if [[ ! (" $* " =~ " -shared " \
|
if [[ ! (" ${params[*]} " =~ " -shared " \
|
||||||
|| " $* " =~ " -static " \
|
|| " ${params[*]} " =~ " -static " \
|
||||||
|| " $* " =~ " -r " \
|
|| " ${params[*]} " =~ " -r " \
|
||||||
|| " $* " =~ " -Ur " \
|
|| " ${params[*]} " =~ " -Ur " \
|
||||||
|| " $* " =~ " -i ") ]]; then
|
|| " ${params[*]} " =~ " -i ") ]]; then
|
||||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
|
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
|
||||||
hardeningLDFlags+=('-pie')
|
hardeningLDFlags+=('-pie')
|
||||||
fi
|
fi
|
||||||
|
@ -71,7 +71,7 @@ for flag in "${!hardeningEnableMap[@]}"; do
|
|||||||
# NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
|
# NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
|
||||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
|
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
|
||||||
hardeningCFlags=('-fPIE' "${hardeningCFlags[@]}")
|
hardeningCFlags=('-fPIE' "${hardeningCFlags[@]}")
|
||||||
if [[ ! (" $* " =~ " -shared " || " $* " =~ " -static ") ]]; then
|
if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
|
||||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
|
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
|
||||||
hardeningCFlags=('-pie' "${hardeningCFlags[@]}")
|
hardeningCFlags=('-pie' "${hardeningCFlags[@]}")
|
||||||
fi
|
fi
|
||||||
|
Loading…
Reference in New Issue
Block a user