diff options
| author | Matthew Bauer <mjbauer95@gmail.com> | 2018-11-03 13:55:50 -0500 |
|---|---|---|
| committer | Robin Gloster <mail@glob.in> | 2018-11-07 15:24:51 +0100 |
| commit | 6d531f354155043518a59161f42f24f5918e76ab (patch) | |
| tree | 1684ee0fe7f97fba1413742b4881220f8f016aab /pkgs/stdenv/generic | |
| parent | d3cfda14fb63f0fd77288c52e7b6b7c5a831147d (diff) | |
| download | nixpkgs-6d531f354155043518a59161f42f24f5918e76ab.tar nixpkgs-6d531f354155043518a59161f42f24f5918e76ab.tar.gz nixpkgs-6d531f354155043518a59161f42f24f5918e76ab.tar.bz2 nixpkgs-6d531f354155043518a59161f42f24f5918e76ab.tar.lz nixpkgs-6d531f354155043518a59161f42f24f5918e76ab.tar.xz nixpkgs-6d531f354155043518a59161f42f24f5918e76ab.tar.zst nixpkgs-6d531f354155043518a59161f42f24f5918e76ab.zip | |
make-derivation: enable pie hardening with musl
Fixes #49071 On ld.gold, we produce broken executables when linking with the Musl libc. This appears to be a known bug when using ld.gold and Musl. This thread describes the workaround as enabling PIE when using ld.gold and Musl: https://www.openwall.com/lists/musl/2015/05/01/5 By default we don’t enable PIE to avoid breaking things. But in the Musl case we are breaking things by not enabling PIE. So this adds a special case for defaultHardeningFlags which keeps the pie hardening for everything. Any packages that break with PIE can add the pie flag to disableHardeningFlags array (a no-op for now on anything but Musl).
Diffstat (limited to 'pkgs/stdenv/generic')
| -rw-r--r-- | pkgs/stdenv/generic/make-derivation.nix | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix index e06faed30a1..6c0c94487de 100644 --- a/pkgs/stdenv/generic/make-derivation.nix +++ b/pkgs/stdenv/generic/make-derivation.nix @@ -93,7 +93,9 @@ rec { ++ depsTargetTarget ++ depsTargetTargetPropagated) == 0; runtimeSensativeIfFixedOutput = fixedOutputDrv -> !noNonNativeDeps; supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ]; - defaultHardeningFlags = lib.remove "pie" supportedHardeningFlags; + defaultHardeningFlags = if stdenv.targetPlatform.isMusl + then supportedHardeningFlags + else lib.remove "pie" supportedHardeningFlags; enabledHardeningOptions = if builtins.elem "all" hardeningDisable then [] |