10 files changed, 19 insertions, 9 deletions
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index e7825a0ebd6..3d7bb74ce21 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -131,7 +131,7 @@ in stdenv.mkDerivation rec {
       "install -Dm444 usr/src/amdgpu-pro-${build}/${m}.xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/${m}.xz\n") modules)
   + ''
     mv $out/etc/vulkan $out/share
-    interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
+    interpreter="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
     libPath="$out/lib:$out/lib/gbm:$depLibPath"
   '' + optionalString (!stdenv.is64bit) ''
     for prog in clinfo modetest vbltest kms-universal-planes kms-steal-crtc modeprint amdgpu_test kmstest proptest; do
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index ee897fc3781..6c9c43e4e5a 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     sha256 = "1pv3vs2w4l2wnw5qb0rkbpvjjdd1fwjv87miavqq0r0ynqbfajwx";
   };
 
-  hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
+  hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
 
   patches = [ ./busybox-in-store.patch ];
 
diff --git a/pkgs/os-specific/linux/devmem2/default.nix b/pkgs/os-specific/linux/devmem2/default.nix
index 4cee9678a9b..969197c2dc9 100644
--- a/pkgs/os-specific/linux/devmem2/default.nix
+++ b/pkgs/os-specific/linux/devmem2/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
     sha256 = "14f1k7v6i1yaxg4xcaaf5i4aqn0yabba857zjnbg9wiymy82qf7c";
   };
 
+  hardeningDisable = [ "format" ];  # fix compile error
+
   buildCommand = ''
-    export hardeningDisable=format  # fix compile error
     cc "$src" -o devmem2
     install -D devmem2 "$out/bin/devmem2"
   '';
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index e67e54f7b43..1fdff871b73 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace configure \
       --replace '#define ELF_INTERPRETER "$interp"' \
-                "#define ELF_INTERPRETER \"$(cat $NIX_CC/nix-support/dynamic-linker)\""
+                "#define ELF_INTERPRETER \"$(cat $NIX_BINUTILS/nix-support/dynamic-linker)\""
   '';
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/firmware/fwupdate/default.nix b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
index 3acf1818f50..ee94ad4226e 100644
--- a/pkgs/os-specific/linux/firmware/fwupdate/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
@@ -17,7 +17,7 @@ let version = "8"; in
       buildInputs = [ gnu-efi libsmbios popt pkgconfig gettext ];
       propagatedBuildInputs = [ efivar ];
       # TODO: Just apply the disable to the efi subdir
-      hardeningDisable = "all";
+      hardeningDisable = [ "all" ];
       patchPhase = ''
         sed -i 's|/usr/include/smbios_c/token.h|smbios_c/token.h|' \
           linux/libfwup.c
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index bb714f60c2d..a029b582f38 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
     for f in $out/bin/*; do
       if isELF "$f"; then
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f"
+        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$f"
         patchelf --set-rpath "$out/lib" "$f"
       fi
     done
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
index 5d47df9a87a..a4704fd51df 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
@@ -81,7 +81,7 @@ installPhase() {
 
         for i in nvidia-settings nvidia-xconfig; do
 	    cp usr/bin/$i $out/bin/$i
-	    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+	    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
 	        --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
         done
     
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 99813d38236..f41229ace86 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -111,7 +111,7 @@ installPhase() {
         for i in nvidia-cuda-mps-control nvidia-cuda-mps-server nvidia-smi nvidia-debugdump; do
             if [ -e "$i" ]; then
                 install -Dm755 $i $bin/bin/$i
-                patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+                patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
                     --set-rpath $out/lib:$libPath $bin/bin/$i
             fi
         done
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 9ca48ccaf05..bc574bc0d79 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
 
         for i in $out/bin/* $out/sbin/*; do
           patchelf \
-            --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+            --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
             --set-rpath "$out/lib:$libPath" \
             $i
         done
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index c79343322d9..fdd5ada19cb 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -73,6 +73,15 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "stackprotector" ];
 
+  patches = [
+    # TODO: Remove this patch when we have a systemd version
+    # with https://github.com/systemd/systemd/pull/6678
+    (fetchpatch {
+        url = "https://github.com/systemd/systemd/commit/58a78ae77063eddfcd23ea272bd2e0ddc9ea3ff7.patch";
+        sha256 = "0g3pvqigs69mciw6lj3zg12dmxnhwxndwxdjg78af52xrp0djfg8";
+    })
+  ];
+
   preConfigure =
     ''
       unset RANLIB