diff options
Diffstat (limited to 'pkgs/build-support')
-rw-r--r-- | pkgs/build-support/bintools-wrapper/add-flags.sh | 16 | ||||
-rw-r--r-- | pkgs/build-support/bintools-wrapper/add-hardening.sh | 87 | ||||
-rw-r--r-- | pkgs/build-support/bintools-wrapper/default.nix | 14 | ||||
-rw-r--r-- | pkgs/build-support/bintools-wrapper/ld-wrapper.sh | 6 | ||||
-rw-r--r-- | pkgs/build-support/bintools-wrapper/setup-hook.sh | 44 | ||||
-rw-r--r-- | pkgs/build-support/cc-wrapper/add-flags.sh | 17 | ||||
-rw-r--r-- | pkgs/build-support/cc-wrapper/add-hardening.sh | 115 | ||||
-rw-r--r-- | pkgs/build-support/cc-wrapper/cc-wrapper.sh | 6 | ||||
-rw-r--r-- | pkgs/build-support/cc-wrapper/default.nix | 14 | ||||
-rw-r--r-- | pkgs/build-support/cc-wrapper/setup-hook.sh | 55 | ||||
-rw-r--r-- | pkgs/build-support/rust/default.nix | 2 | ||||
-rw-r--r-- | pkgs/build-support/setup-hooks/role.bash | 75 | ||||
-rw-r--r-- | pkgs/build-support/wrapper-common/utils.bash (renamed from pkgs/build-support/cc-wrapper/utils.sh) | 15 |
13 files changed, 256 insertions, 210 deletions
diff --git a/pkgs/build-support/bintools-wrapper/add-flags.sh b/pkgs/build-support/bintools-wrapper/add-flags.sh index 7d118d20fc6..e5c0556556c 100644 --- a/pkgs/build-support/bintools-wrapper/add-flags.sh +++ b/pkgs/build-support/bintools-wrapper/add-flags.sh @@ -5,28 +5,20 @@ var_templates_list=( NIX+LDFLAGS_BEFORE NIX+LDFLAGS_AFTER NIX+LDFLAGS_HARDEN + NIX+HARDENING_ENABLE ) var_templates_bool=( NIX+SET_BUILD_ID NIX+DONT_SET_RPATH ) -declare -a role_infixes=() -if [ "${NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_BUILD:-}" ]; then - role_infixes+=(_BUILD_) -fi -if [ "${NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_HOST:-}" ]; then - role_infixes+=(_) -fi -if [ "${NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then - role_infixes+=(_TARGET_) -fi +accumulateRoles for var in "${var_templates_list[@]}"; do - mangleVarList "$var" "${role_infixes[@]}" + mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"} done for var in "${var_templates_bool[@]}"; do - mangleVarBool "$var" "${role_infixes[@]}" + mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"} done if [ -e @out@/nix-support/libc-ldflags ]; then diff --git a/pkgs/build-support/bintools-wrapper/add-hardening.sh b/pkgs/build-support/bintools-wrapper/add-hardening.sh index 5282d17fce2..b7180870860 100644 --- a/pkgs/build-support/bintools-wrapper/add-hardening.sh +++ b/pkgs/build-support/bintools-wrapper/add-hardening.sh @@ -1,53 +1,58 @@ -hardeningFlags=(relro bindnow) -# Intentionally word-split in case 'hardeningEnable' is defined in -# Nix. Also, our bootstrap tools version of bash is old enough that -# undefined arrays trip `set -u`. -if [[ -v hardeningEnable[@] ]]; then - hardeningFlags+=(${hardeningEnable[@]}) -fi -hardeningLDFlags=() +declare -a hardeningLDFlags=() + +declare -A hardeningEnableMap=() -declare -A hardeningDisableMap +# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The +# array expansion also prevents undefined variables from causing trouble with +# `set -u`. +for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do + hardeningEnableMap["$flag"]=1 +done -# Intentionally word-split in case 'hardeningDisable' is defined in Nix. -for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@ -do - hardeningDisableMap[$flag]=1 +# Remove unsupported flags. +for flag in @hardening_unsupported_flags@; do + unset -v "hardeningEnableMap[$flag]" done if (( "${NIX_DEBUG:-0}" >= 1 )); then + declare -a allHardeningFlags=(pie relro bindnow) + declare -A hardeningDisableMap=() + + # Determine which flags were effectively disabled so we can report below. + for flag in "${allHardeningFlags[@]}"; do + if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then + hardeningDisableMap[$flag]=1 + fi + done + printf 'HARDENING: disabled flags:' >&2 (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2 echo >&2 -fi -if [[ -z "${hardeningDisableMap[all]:-}" ]]; then - if (( "${NIX_DEBUG:-0}" >= 1 )); then + if (( "${#hardeningEnableMap[@]}" )); then echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2; fi - for flag in "${hardeningFlags[@]}" - do - if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then - case $flag in - pie) - if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi - hardeningLDFlags+=('-pie') - fi - ;; - relro) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi - hardeningLDFlags+=('-z' 'relro') - ;; - bindnow) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi - hardeningLDFlags+=('-z' 'now') - ;; - *) - # Ignore unsupported. Checked in Nix that at least *some* - # tool supports each flag. - ;; - esac - fi - done fi + +for flag in "${!hardeningEnableMap[@]}"; do + case $flag in + pie) + if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi + hardeningLDFlags+=('-pie') + fi + ;; + relro) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi + hardeningLDFlags+=('-z' 'relro') + ;; + bindnow) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi + hardeningLDFlags+=('-z' 'now') + ;; + *) + # Ignore unsupported. Checked in Nix that at least *some* + # tool supports each flag. + ;; + esac +done diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix index 47301bbdde6..2739537c25d 100644 --- a/pkgs/build-support/bintools-wrapper/default.nix +++ b/pkgs/build-support/bintools-wrapper/default.nix @@ -74,7 +74,7 @@ in stdenv.mkDerivation { name = targetPrefix - + (if name != "" then name else "${bintoolsName}-wrapper") + + (if name != "" then name else stdenv.lib.removePrefix targetPrefix "${bintoolsName}-wrapper") + (stdenv.lib.optionalString (bintools != null && bintoolsVersion != "") "-${bintoolsVersion}"); preferLocalBuild = true; @@ -188,9 +188,15 @@ stdenv.mkDerivation { else throw "unknown emulation for platform: " + targetPlatform.config; in targetPlatform.platform.bfdEmulation or (fmt + sep + arch); + strictDeps = true; depsTargetTargetPropagated = extraPackages; - setupHook = ./setup-hook.sh; + wrapperName = "BINTOOLS_WRAPPER"; + + setupHooks = [ + ../setup-hooks/role.bash + ./setup-hook.sh + ]; postFixup = '' @@ -289,7 +295,7 @@ stdenv.mkDerivation { set +u substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh - substituteAll ${../cc-wrapper/utils.sh} $out/nix-support/utils.sh + substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash ## ## Extra custom steps @@ -300,7 +306,7 @@ stdenv.mkDerivation { inherit dynamicLinker expand-response-params; - # for substitution in utils.sh + # for substitution in utils.bash expandResponseParams = "${expand-response-params}/bin/expand-response-params"; meta = diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh index 991ed0fe263..ed2f00a8974 100644 --- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh +++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh @@ -14,7 +14,7 @@ if [ -n "@coreutils_bin@" ]; then PATH="@coreutils_bin@/bin" fi -source @out@/nix-support/utils.sh +source @out@/nix-support/utils.bash if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then source @out@/nix-support/add-flags.sh @@ -57,8 +57,8 @@ fi source @out@/nix-support/add-hardening.sh -extraAfter=("${hardeningLDFlags[@]}") -extraBefore=() +extraAfter=() +extraBefore=(${hardeningLDFlags[@]+"${hardeningLDFlags[@]}"}) if [ -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ]; then extraAfter+=($NIX_@infixSalt@_LDFLAGS) diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh index 48a00b0b9b0..34e85322650 100644 --- a/pkgs/build-support/bintools-wrapper/setup-hook.sh +++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh @@ -8,47 +8,25 @@ set -u # native compile. # # TODO(@Ericson2314): No native exception -[[ -z ${crossConfig-} ]] || (( "$hostOffset" < 0 )) || return 0 +[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0 bintoolsWrapper_addLDVars () { - case $depHostOffset in - -1) local role='BUILD_' ;; - 0) local role='' ;; - 1) local role='TARGET_' ;; - *) echo "bintools-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2; - return 1 ;; - esac + # See ../setup-hooks/role.bash + local role_post role_pre + getTargetRoleEnvHook if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then - export NIX_${role}LDFLAGS+=" -L$1/lib64" + export NIX_${role_pre}LDFLAGS+=" -L$1/lib64" fi if [[ -d "$1/lib" ]]; then - export NIX_${role}LDFLAGS+=" -L$1/lib" + export NIX_${role_pre}LDFLAGS+=" -L$1/lib" fi } -case $targetOffset in - -1) - export NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_BUILD=1 - role_pre='BUILD_' - role_post='_FOR_BUILD' - ;; - 0) - export NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_HOST=1 - role_pre='' - role_post='' - ;; - 1) - export NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_TARGET=1 - role_pre='TARGET_' - role_post='_FOR_TARGET' - ;; - *) - echo "cc-wrapper: used as improper sort of dependency" >2; - return 1 - ;; -esac +# See ../setup-hooks/role.bash +getTargetRole +getTargetRoleWrapper addEnvHooks "$targetOffset" bintoolsWrapper_addLDVars @@ -83,6 +61,10 @@ do fi done +# If unset, assume the default hardening flags. +: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"} +export NIX_HARDENING_ENABLE + # No local scope in sourced file unset -v role_pre role_post cmd upper_case set +u diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh index 604aaf6b6cf..9762894607a 100644 --- a/pkgs/build-support/cc-wrapper/add-flags.sh +++ b/pkgs/build-support/cc-wrapper/add-flags.sh @@ -14,26 +14,15 @@ var_templates_bool=( NIX+ENFORCE_NO_NATIVE ) -# Accumulate infixes for taking in the right input parameters. See setup-hook -# for details. -declare -a role_infixes=() -if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_BUILD:-}" ]; then - role_infixes+=(_BUILD_) -fi -if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_HOST:-}" ]; then - role_infixes+=(_) -fi -if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then - role_infixes+=(_TARGET_) -fi +accumulateRoles # We need to mangle names for hygiene, but also take parameters/overrides # from the environment. for var in "${var_templates_list[@]}"; do - mangleVarList "$var" "${role_infixes[@]}" + mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"} done for var in "${var_templates_bool[@]}"; do - mangleVarBool "$var" "${role_infixes[@]}" + mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"} done # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld. diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh index a35ff3cb426..fc40fe7408b 100644 --- a/pkgs/build-support/cc-wrapper/add-hardening.sh +++ b/pkgs/build-support/cc-wrapper/add-hardening.sh @@ -1,67 +1,72 @@ -hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow) -# Intentionally word-split in case 'hardeningEnable' is defined in -# Nix. Also, our bootstrap tools version of bash is old enough that -# undefined arrays trip `set -u`. -if [[ -v hardeningEnable[@] ]]; then - hardeningFlags+=(${hardeningEnable[@]}) -fi -hardeningCFlags=() +declare -a hardeningCFlags=() + +declare -A hardeningEnableMap=() -declare -A hardeningDisableMap +# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The +# array expansion also prevents undefined variables from causing trouble with +# `set -u`. +for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do + hardeningEnableMap["$flag"]=1 +done -# Intentionally word-split in case 'hardeningDisable' is defined in Nix. -for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@ -do - hardeningDisableMap[$flag]=1 +# Remove unsupported flags. +for flag in @hardening_unsupported_flags@; do + unset -v "hardeningEnableMap[$flag]" done if (( "${NIX_DEBUG:-0}" >= 1 )); then + declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format) + declare -A hardeningDisableMap=() + + # Determine which flags were effectively disabled so we can report below. + for flag in "${allHardeningFlags[@]}"; do + if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then + hardeningDisableMap["$flag"]=1 + fi + done + printf 'HARDENING: disabled flags:' >&2 (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2 echo >&2 -fi -if [[ -z "${hardeningDisableMap[all]:-}" ]]; then - if (( "${NIX_DEBUG:-0}" >= 1 )); then + if (( "${#hardeningEnableMap[@]}" )); then echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2; fi - for flag in "${hardeningFlags[@]}" - do - if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then - case $flag in - fortify) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi - hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2') - ;; - stackprotector) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi - hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4') - ;; - pie) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi - hardeningCFlags+=('-fPIE') - if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi - hardeningCFlags+=('-pie') - fi - ;; - pic) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi - hardeningCFlags+=('-fPIC') - ;; - strictoverflow) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi - hardeningCFlags+=('-fno-strict-overflow') - ;; - format) - if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi - hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security') - ;; - *) - # Ignore unsupported. Checked in Nix that at least *some* - # tool supports each flag. - ;; - esac - fi - done fi + +for flag in "${!hardeningEnableMap[@]}"; do + case $flag in + fortify) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi + hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2') + ;; + stackprotector) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi + hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4') + ;; + pie) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi + hardeningCFlags+=('-fPIE') + if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi + hardeningCFlags+=('-pie') + fi + ;; + pic) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi + hardeningCFlags+=('-fPIC') + ;; + strictoverflow) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi + hardeningCFlags+=('-fno-strict-overflow') + ;; + format) + if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi + hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security') + ;; + *) + # Ignore unsupported. Checked in Nix that at least *some* + # tool supports each flag. + ;; + esac +done diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh index c2e6c140635..1b43d7cc211 100644 --- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh +++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh @@ -15,7 +15,7 @@ if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin" fi -source @out@/nix-support/utils.sh +source @out@/nix-support/utils.bash # Flirting with a layer violation here. if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then @@ -134,8 +134,8 @@ fi source @out@/nix-support/add-hardening.sh # Add the flags for the C compiler proper. -extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE "${hardeningCFlags[@]}") -extraBefore=() +extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE) +extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"}) if [ "$dontLink" != 1 ]; then diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix index 8f99da805ec..a0955088eb7 100644 --- a/pkgs/build-support/cc-wrapper/default.nix +++ b/pkgs/build-support/cc-wrapper/default.nix @@ -71,7 +71,7 @@ assert nativePrefix == bintools.nativePrefix; stdenv.mkDerivation { name = targetPrefix - + (if name != "" then name else "${ccName}-wrapper") + + (if name != "" then name else stdenv.lib.removePrefix targetPrefix "${ccName}-wrapper") + (stdenv.lib.optionalString (cc != null && ccVersion != "") "-${ccVersion}"); preferLocalBuild = true; @@ -188,10 +188,16 @@ stdenv.mkDerivation { wrap ${targetPrefix}gccgo ${./cc-wrapper.sh} $ccPath/${targetPrefix}gccgo ''; + strictDeps = true; propagatedBuildInputs = [ bintools ]; depsTargetTargetPropagated = extraPackages; - setupHook = ./setup-hook.sh; + wrapperName = "CC_WRAPPER"; + + setupHooks = [ + ../setup-hooks/role.bash + ./setup-hook.sh + ]; postFixup = '' @@ -277,7 +283,7 @@ stdenv.mkDerivation { + '' substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh - substituteAll ${./utils.sh} $out/nix-support/utils.sh + substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash ## ## Extra custom steps @@ -288,7 +294,7 @@ stdenv.mkDerivation { inherit expand-response-params; - # for substitution in utils.sh + # for substitution in utils.bash expandResponseParams = "${expand-response-params}/bin/expand-response-params"; meta = diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh index 29a7306b9b7..9dacacc1f36 100644 --- a/pkgs/build-support/cc-wrapper/setup-hook.sh +++ b/pkgs/build-support/cc-wrapper/setup-hook.sh @@ -60,61 +60,28 @@ set -u # native compile. # # TODO(@Ericson2314): No native exception -[[ -z ${crossConfig-} ]] || (( "$hostOffset" < 0 )) || return 0 +[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0 # It's fine that any other cc-wrapper will redefine this. Bash functions close # over no state, and there's no @-substitutions within, so any redefined # function is guaranteed to be exactly the same. ccWrapper_addCVars () { - # The `depHostOffset` describes how the host platform of the dependencies - # are slid relative to the depending package. It is brought into scope of - # the environment hook defined as the role of the dependency being applied. - case $depHostOffset in - -1) local role='BUILD_' ;; - 0) local role='' ;; - 1) local role='TARGET_' ;; - *) echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2; - return 1 ;; - esac + # See ../setup-hooks/role.bash + local role_post role_pre + getTargetRoleEnvHook if [[ -d "$1/include" ]]; then - export NIX_${role}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include" + export NIX_${role_pre}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include" fi if [[ -d "$1/Library/Frameworks" ]]; then - export NIX_${role}CFLAGS_COMPILE+=" -F$1/Library/Frameworks" + export NIX_${role_pre}CFLAGS_COMPILE+=" -F$1/Library/Frameworks" fi } -# Since the same cc-wrapper derivation can be depend on in multiple ways, we -# need to accumulate *each* role (i.e. target platform relative the depending -# derivation) in which the cc-wrapper derivation is used. -# `NIX_CC_WRAPPER_@infixSalt@_TARGET_*` tracks this (needs to be an exported env -# var so can't use fancier data structures). -# -# We also need to worry about what role is being added on *this* invocation of -# setup-hook, which `role` tracks. -case $targetOffset in - -1) - export NIX_CC_WRAPPER_@infixSalt@_TARGET_BUILD=1 - role_pre='BUILD_' - role_post='_FOR_BUILD' - ;; - 0) - export NIX_CC_WRAPPER_@infixSalt@_TARGET_HOST=1 - role_pre='' - role_post='' - ;; - 1) - export NIX_CC_WRAPPER_@infixSalt@_TARGET_TARGET=1 - role_pre='TARGET_' - role_post='_FOR_TARGET' - ;; - *) - echo "cc-wrapper: used as improper sort of dependency" >2; - return 1 - ;; -esac +# See ../setup-hooks/role.bash +getTargetRole +getTargetRoleWrapper # We use the `targetOffset` to choose the right env hook to accumulate the right # sort of deps (those with that offset). @@ -147,6 +114,10 @@ export ${role_pre}CXX=@named_cxx@ export CC${role_post}=@named_cc@ export CXX${role_post}=@named_cxx@ +# If unset, assume the default hardening flags. +: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"} +export NIX_HARDENING_ENABLE + # No local scope in sourced file unset -v role_pre role_post set +u diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix index f407ba25bf8..d7d03aae33e 100644 --- a/pkgs/build-support/rust/default.nix +++ b/pkgs/build-support/rust/default.nix @@ -91,7 +91,7 @@ in stdenv.mkDerivation (args // { installPhase = args.installPhase or '' runHook preInstall mkdir -p $out/bin - find target/release -maxdepth 1 -executable -exec cp "{}" $out/bin \; + find target/release -maxdepth 1 -executable -type f -exec cp "{}" $out/bin \; runHook postInstall ''; diff --git a/pkgs/build-support/setup-hooks/role.bash b/pkgs/build-support/setup-hooks/role.bash new file mode 100644 index 00000000000..6f1c36f5c05 --- /dev/null +++ b/pkgs/build-support/setup-hooks/role.bash @@ -0,0 +1,75 @@ +# Since the same derivation can be depend on in multiple ways, we need to +# accumulate *each* role (i.e. host and target platforms relative the depending +# derivation) in which the derivation is used. +# +# The role is intened to be use as part of other variables names like +# - $NIX_${role_pre}_SOMETHING +# - $NIX_SOMETHING_${role_post} + +function getRole() { + case $1 in + -1) + role_pre='BUILD_' + role_post='_FOR_BUILD' + ;; + 0) + role_pre='' + role_post='' + ;; + 1) + role_pre='TARGET_' + role_post='_FOR_TARGET' + ;; + *) + echo "@name@: used as improper sort of dependency" >2 + return 1 + ;; + esac +} + +# `hostOffset` describes how the host platform of the package is slid relative +# to the depending package. `targetOffset` likewise describes the target +# platform of the package. Both are brought into scope of the setup hook defined +# for dependency whose setup hook is being processed relative to the package +# being built. + +function getHostRole() { + getRole "$hostOffset" +} +function getTargetRole() { + getRole "$targetOffset" +} + +# `depHostOffset` describes how the host platform of the dependencies are slid +# relative to the depending package. `depTargetOffset` likewise describes the +# target platform of dependenices. Both are brought into scope of the +# environment hook defined for the dependency being applied relative to the +# package being built. + +function getHostRoleEnvHook() { + getRole "$depHostOffset" +} +function getTargetRoleEnvHook() { + getRole "$depTargetOffset" +} + +# This variant is inteneded specifically for code-prodocing tool wrapper scripts +# `NIX_@wrapperName@_@infixSalt@_TARGET_*` tracks this (needs to be an exported +# env var so can't use fancier data structures). +function getTargetRoleWrapper() { + case $targetOffset in + -1) + export NIX_@wrapperName@_@infixSalt@_TARGET_BUILD=1 + ;; + 0) + export NIX_@wrapperName@_@infixSalt@_TARGET_HOST=1 + ;; + 1) + export NIX_@wrapperName@_@infixSalt@_TARGET_TARGET=1 + ;; + *) + echo "@name@: used as improper sort of dependency" >2 + return 1 + ;; + esac +} diff --git a/pkgs/build-support/cc-wrapper/utils.sh b/pkgs/build-support/wrapper-common/utils.bash index 9215fe2dc39..12b596a83e6 100644 --- a/pkgs/build-support/cc-wrapper/utils.sh +++ b/pkgs/build-support/wrapper-common/utils.bash @@ -1,3 +1,18 @@ +# Accumulate infixes for taking in the right input parameters with the `mangle*` +# functions below. See setup-hook for details. +accumulateRoles() { + declare -ga role_infixes=() + if [ "${NIX_@wrapperName@_@infixSalt@_TARGET_BUILD:-}" ]; then + role_infixes+=(_BUILD_) + fi + if [ "${NIX_@wrapperName@_@infixSalt@_TARGET_HOST:-}" ]; then + role_infixes+=(_) + fi + if [ "${NIX_@wrapperName@_@infixSalt@_TARGET_TARGET:-}" ]; then + role_infixes+=(_TARGET_) + fi +} + mangleVarList() { local var="$1" shift |