Skip to content

Commit

Permalink
stdenv: support special 'all' hardening flag
Browse files Browse the repository at this point in the history
Since it was supported before, add it here.

The implementation favors readability over performance:
The case hardeningDisable=["all"] is unnecessarily unperformant.
  • Loading branch information
groxxda committed Oct 13, 2016
1 parent 4b93591 commit 4bf0576
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 3 deletions.
2 changes: 1 addition & 1 deletion pkgs/stdenv/generic/default.nix
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ let
, __propagatedImpureHostDeps ? []
, sandboxProfile ? ""
, propagatedSandboxProfile ? ""
, hardeningEnable ? [ "fortify" "stackprotector" "pic" "strictoverflow" "format" "relro" "bindnow" ]
, hardeningEnable ? [ "all" ]
, hardeningDisable ? [ ]
, ... } @ attrs:
let
Expand Down
14 changes: 12 additions & 2 deletions pkgs/stdenv/generic/hardening.nix
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
}:
let
inherit (builtins) filter map elem;
inherit (lib) getAttr concatMap flip;
inherit (lib) getAttr concatMap flip attrNames;

# mapping from nixpkgs hardening flags to their compiler / linker meanings
hardeningFlagMap = {
Expand Down Expand Up @@ -37,8 +37,18 @@ hardeningFlagMap = {
};
};

# handle special case enabled = "all"
hardeningEnable' = if elem "all" hardeningEnable
then attrNames hardeningFlagMap
else hardeningEnable;

# same for disable = "all"
hardeningDisable' = if elem "all" hardeningDisable
then attrNames hardeningFlagMap
else hardeningDisable;

# filter out disabled flags
enabledFlags = filter (x: ! elem x hardeningDisable) hardeningEnable;
enabledFlags = filter (x: ! elem x hardeningDisable') hardeningEnable';

# filter out unsupported flags
supportedEnabledFlags = filter (flip elem hardeningSupported) enabledFlags;
Expand Down

0 comments on commit 4bf0576

Please sign in to comment.