Use a hardened stdenv by default

13 files changed, 31 insertions, 3 deletions

diff --git a/pkgs/development/libraries/CoinMP/default.nix b/pkgs/development/libraries/CoinMP/default.nix
index e819078f786..bdd380fd4b8 100644
--- a/pkgs/development/libraries/CoinMP/default.nix
+++ b/pkgs/development/libraries/CoinMP/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gqi2vqkg35gazzzv8asnhihchnbjcd6bzjfzqhmj7wy1dw9iiw6";
   };
 
+  noHardening_format = true;
+
   meta = with stdenv.lib; {
     homepage = https://projects.coin-or.org/CoinMP/;
     description = "COIN-OR lightweight API for COIN-OR libraries CLP, CBC, and CGL";
diff --git a/pkgs/development/libraries/audio/libbs2b/default.nix b/pkgs/development/libraries/audio/libbs2b/default.nix
index e43a5acb6bd..e9a13b6ff87 100644
--- a/pkgs/development/libraries/audio/libbs2b/default.nix
+++ b/pkgs/development/libraries/audio/libbs2b/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig libsndfile ];
 
+  noHardening_format = true;
+
   meta = {
     homepage = "http://bs2b.sourceforge.net/";
     description = "Bauer stereophonic-to-binaural DSP library";
diff --git a/pkgs/development/libraries/fribidi/default.nix b/pkgs/development/libraries/fribidi/default.nix
index 23795e9633e..5d0e451c54c 100644
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@@ -3,12 +3,14 @@
 stdenv.mkDerivation rec {
   name = "fribidi-${version}";
   version = "0.19.6";
-  
+
   src = fetchurl {
     url = "http://fribidi.org/download/${name}.tar.bz2";
     sha256 = "0zg1hpaml34ny74fif97j7ngrshlkl3wk3nja3gmlzl17i1bga6b";
   };
 
+  noHardening_format = true;
+
   meta = with stdenv.lib; {
     homepage = http://fribidi.org/;
     description = "GNU implementation of the Unicode Bidirectional Algorithm (bidi)";
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index 7c3c53626b5..5ca1de273b4 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -2,16 +2,18 @@
 
 stdenv.mkDerivation {
   name = "gd-2.0.35";
-  
+
   src = fetchurl {
     url = http://www.libgd.org/releases/gd-2.0.35.tar.bz2;
     sha256 = "1y80lcmb8qbzf0a28841zxhq9ndfapmh2fsrqfd9lalxfj8288mz";
   };
-  
+
   buildInputs = [zlib libpng freetype];
 
   propagatedBuildInputs = [libjpeg fontconfig]; # urgh
 
+  noHardening_format = true;
+
   configureFlags = "--without-x";
 
   meta = {
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 3d7cfc0ca31..cbdb448723a 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation (rec {
 
   outputs = [ "out" "doc" ];
 
+  noHardening_format = true;
+
   LDFLAGS = if stdenv.isSunOS then "-lm -lmd -lmp -luutil -lnvpair -lnsl -lidmap -lavl -lsec" else "";
 
   configureFlags = [ "--disable-csharp" "--with-xz" ]
diff --git a/pkgs/development/libraries/giflib/libungif.nix b/pkgs/development/libraries/giflib/libungif.nix
index f3302f8f333..45384b825c1 100644
--- a/pkgs/development/libraries/giflib/libungif.nix
+++ b/pkgs/development/libraries/giflib/libungif.nix
@@ -6,5 +6,7 @@ stdenv.mkDerivation {
     url = mirror://sourceforge/giflib/libungif-4.1.4.tar.gz;
     md5 = "efdfcf8e32e35740288a8c5625a70ccb";
   };
+
+  noHardening_format = true;
 }
 
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 26d2f2454b4..6e9aa497f77 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -213,6 +213,10 @@ stdenv.mkDerivation ({
   preBuild = "unset NIX_DONT_SET_RPATH";
 }
 
+// stdenv.lib.optionalAttrs (name == "glibc-locales") {
+  noHardening_stackprotector = true;
+}
+
 // stdenv.lib.optionalAttrs (hurdHeaders != null) {
   # Work around the fact that the configure snippet that looks for
   # <hurd/version.h> does not honor `--with-headers=$sysheaders' and that
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 08eaf555e02..a2ecedbe7e9 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -25,6 +25,8 @@ in
 
     builder = ./builder.sh;
 
+    noHardening_all = true;
+
     # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
     # any program we run, because the gcc will have been placed at a new
     # store path than that determined when built (as a source for the
diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index e674aae2b58..e6209ad93f6 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jxlypkgb8bd1c114x96i699ib0glb5aca9dv56j377x2ldg4c65";
   };
 
+  noHardening_all = true;
+
   buildInputs = [ pciutils ];
 
   makeFlags = [
diff --git a/pkgs/development/libraries/libgphoto2/default.nix b/pkgs/development/libraries/libgphoto2/default.nix
index e25cdb61d86..3df793df73f 100644
--- a/pkgs/development/libraries/libgphoto2/default.nix
+++ b/pkgs/development/libraries/libgphoto2/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
   # These are mentioned in the Requires line of libgphoto's pkg-config file.
   propagatedBuildInputs = [ libexif ];
 
+  noHardening_format = true;
+
   meta = {
     homepage = http://www.gphoto.org/proj/libgphoto2/;
     description = "A library for accessing digital cameras";
diff --git a/pkgs/development/libraries/libvisual/default.nix b/pkgs/development/libraries/libvisual/default.nix
index dc2f0338b48..a2c9c52937e 100644
--- a/pkgs/development/libraries/libvisual/default.nix
+++ b/pkgs/development/libraries/libvisual/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig glib ];
 
+  noHardening_format = true;
+
   meta = {
     description = "An abstraction library for audio visualisations";
     homepage = "http://sourceforge.net/projects/libvisual/";
diff --git a/pkgs/development/libraries/pupnp/default.nix b/pkgs/development/libraries/pupnp/default.nix
index c5e26c1dfad..267b434da52 100644
--- a/pkgs/development/libraries/pupnp/default.nix
+++ b/pkgs/development/libraries/pupnp/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0amjv4lypvclmi4vim2qdyw5xa6v4x50zjgf682vahqjc0wjn55k";
   };
 
+  noHardening_all = true;
+
   meta = {
     description = "libupnp, an open source UPnP development kit for Linux";
 
diff --git a/pkgs/development/libraries/speechd/default.nix b/pkgs/development/libraries/speechd/default.nix
index 5104532ea91..cbd731aef68 100644
--- a/pkgs/development/libraries/speechd/default.nix
+++ b/pkgs/development/libraries/speechd/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ dotconf glib pkgconfig ];
 
+  noHardening_format = true;
+
   meta = {
     description = "Common interface to speech synthesis";