Fix hardening default for pkgsMusl to reenable -pie

[utsl42]

Motivation for this change

Found while attempting to fix or work around #101490:

pkgs/stdenv/generic/make-derivation.nix

 108   │       supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
 109   │       defaultHardeningFlags = if stdenv.hostPlatform.isMusl
 110   │                               then supportedHardeningFlags
 111   │                               else lib.remove "pie" supportedHardeningFlags;

makes it look like -pie is enabled by default on Musl. But that doesn't work, because the line modified in this change fails to set NIX_HARDENING_ENABLE, which causes pkgs/build-support/cc-wrapper/setup-hook.sh and pkgs/build-support/bintools-wrapper/setup-hook.sh to fall back to:

  68   │ : ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Tested building pkgsMusl.stdenv. Validated it builds working binaries with -pie enabled.

[andir]

Can you also add the entire explanation to the commit message? Right now we do not have anything helpful in the commit message. If we have to go back to this (e.g. due to git blame) we wouldn't really see why that was done or how we ended up doing this.

[utsl42]

Done. Yeah, this was a bit convoluted.

[andir]

Thanks! Can you also prefix the first line of the commit message with stdenv: as that seems most appropriate for this change.

[symphorien]

checked that pkgsMusl.openssl now build a pie executable (it currently does not on nixos-unstable)

[TredwellGit]

#104091

[SuperSandro2000]

@utsl42 please fix the eval error.

[symphorien]

The eval error is related to django, which does not make sense.

@GrahamcOfBorg eval

[SuperSandro2000]

This is a semi-automatic executed nixpkgs-review which is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).
If you have any questions or problems please reach out to SuperSandro2000 on IRC.

Result of nixpkgs-review pr 101606 run on x86_64-linux 1

1 package marked as broken and skipped:

• nix-exec

2 packages blacklisted:

• tests.nixos-functions.nixos-test
• tests.nixos-functions.nixosTest-test

9 packages failed to build and are new build failures:

• haskellPackages.hercules-ci-agent: log https://termbin.com/ka4m
• hercules-ci-agent: log https://termbin.com/9tw3
• python37Packages.nassl: log https://termbin.com/9b4z
• python37Packages.sslyze: log was empty
• python38Packages.nassl: log https://termbin.com/plmj
• sslyze: log was empty
• (python38Packages.sslyze): log was empty
• python39Packages.nassl: log https://termbin.com/oa5u
• python39Packages.sslyze: log was empty

59 packages built:

• bundix
• busybox-sandbox-shell
• cabal2nix
• cachix
• common-updater-scripts
• crate2nix
• crystal2nix
• dep2nix
• disnix
• disnixos
• dydisnix
• fusionInventory
• go2nix
• haskellPackages.cachix
• haskellPackages.nix-paths
• haskellPackages.update-nix-fetchgit
• hydra-unstable
• libnixxml
• lispPackages.quicklisp-to-nix
• lispPackages.quicklisp-to-nix-system-info
• nix (nixStable)
• nix-bundle
• nix-direnv
• nix-doc
• nix-du
• nix-index
• nix-pin
• nix-plugins
• nix-prefetch
• nix-prefetch-bzr
• nix-prefetch-cvs
• nix-prefetch-docker
• nix-prefetch-git
• nix-prefetch-hg
• nix-prefetch-scripts
• nix-prefetch-svn
• nix-serve
• nix-update
• nix-update-source
• nixFlakes (nixUnstable)
• nixos-generators
• nixos-rebuild
• nixos-shell
• nixpkgs-review
• nixui
• pkgsMusl.stdenv
• pkgsStatic.stdenv
• python37Packages.nix-kernel
• python37Packages.nixpkgs
• python37Packages.pythonix
• python38Packages.nix-kernel
• python38Packages.nixpkgs
• python38Packages.pythonix
• python39Packages.nix-kernel
• python39Packages.nixpkgs
• python39Packages.pythonix
• update-nix-fetchgit
• vgo2nix
• vulnix

[nh2]

This broke GHC on musl, see writeup here:

#129247 (comment)