colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hardening: debug with NIX_DEBUG

Browse Source
This commit is contained in:
Robin Gloster 2016-03-08 20:51:35 +00:00
parent 965abb6d54
commit 9a5b070b45
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkgs/build-support/cc-wrapper/add-hardening
View File

@ -14,30 +14,39 @@ if [[ ! $hardeningDisable == "all" ]]; then
if [[ ! "${hardeningDisable[@]}" =~ "$flag" ]]; then
case $flag in
fortify)
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling fortify; fi
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
;;
stackprotector)
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling stackprotector; fi
hardeningCFlags+=('-fstack-protector-strong' '--param ssp-buffer-size=4')
;;
pie)
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling CFlags -fPIE; fi
hardeningCFlags+=('-fPIE')
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling LDFlags -pie; fi
hardeningLDFlags+=('-pie')
fi
;;
pic)
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling pic; fi
hardeningCFlags+=('-fPIC')
;;
strictoverflow)
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling strictoverflow; fi
hardeningCFlags+=('-fno-strict-overflow')
;;
format)
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling format; fi
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
;;
relro)
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling relro; fi
hardeningLDFlags+=('-z relro')
;;
bindnow)
if [ -n "$NIX_DEBUG" ]; then echo HARDENING: enabling bindnow; fi
hardeningLDFlags+=('-z now')
;;
*)