diff options
| author | Samuel Dionne-Riel <samuel@dionne-riel.com> | 2021-03-23 18:45:48 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-03-23 18:45:48 -0400 |
| commit | 76552e95cc6679de7b690ef624135b71b3b326d7 (patch) | |
| tree | 54be650cdc71d28b9a0e33531d83601660e8ab56 /pkgs/stdenv/generic | |
| parent | 924b214e05cb466f26c51f1cfaaa135e881664c5 (diff) | |
| download | nixpkgs-76552e95cc6679de7b690ef624135b71b3b326d7.tar nixpkgs-76552e95cc6679de7b690ef624135b71b3b326d7.tar.gz nixpkgs-76552e95cc6679de7b690ef624135b71b3b326d7.tar.bz2 nixpkgs-76552e95cc6679de7b690ef624135b71b3b326d7.tar.lz nixpkgs-76552e95cc6679de7b690ef624135b71b3b326d7.tar.xz nixpkgs-76552e95cc6679de7b690ef624135b71b3b326d7.tar.zst nixpkgs-76552e95cc6679de7b690ef624135b71b3b326d7.zip | |
stdenv: Fix regression on ARM+static when enabling hardening (#115363)
4e9dc46dea0ef8cf15c567fa863796bb23099d0b re-enabled hardening for Musl, which is good. Though static builds for ARM fail in various ways - cross armv7l static does not build - cross aarch64 static produces segfaulting dynamically linked binaries - native aarch64 static also produces segfaulting dynamically linked binaries It seems that for native x86_64-linux, static builds are fine though. This works around the issue by removing PIE from the hardening flags, keeping all other hardening flags. This is an improvement (I think) from before 4e9dc46d. Fixes #114953
Diffstat (limited to 'pkgs/stdenv/generic')
| -rw-r--r-- | pkgs/stdenv/generic/make-derivation.nix | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix index 19c3d8965a7..2b89b37f786 100644 --- a/pkgs/stdenv/generic/make-derivation.nix +++ b/pkgs/stdenv/generic/make-derivation.nix @@ -106,7 +106,12 @@ in rec { ++ depsTargetTarget ++ depsTargetTargetPropagated) == 0; dontAddHostSuffix = attrs ? outputHash && !noNonNativeDeps || (stdenv.noCC or false); supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ]; - defaultHardeningFlags = if stdenv.hostPlatform.isMusl + # Musl-based platforms will keep "pie", other platforms will not. + defaultHardeningFlags = if stdenv.hostPlatform.isMusl && + # Except when: + # - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries. + # - static armv7l, where compilation fails. + !((stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isAarch32) && stdenv.hostPlatform.isStatic) then supportedHardeningFlags else lib.remove "pie" supportedHardeningFlags; enabledHardeningOptions = |