stdenv: Fix regression on ARM+static when enabling hardening

[samueldr]

Motivation for this change

4e9dc46 re-enabled hardening for Musl,
which is good.

Though static builds for ARM fail in various ways

• cross armv7l static does not build
• cross aarch64 static produces segfaulting dynamically linked binaries
• native aarch64 static also produces segfaulting dynamically linked binaries

It seems that for native x86_64-linux, static builds are fine though.

This works around the issue by removing PIE from the hardening flags,
keeping all other hardening flags. This is an improvement (I think) from
before 4e9dc46.

Fixes #114953

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

In addition to manual testing, a WIP testing harness within Mobile NixOS was used to verify things work.

• cross-canary: Execute cross-built binaries using qemu-user mobile-nixos/mobile-nixos#317

I eventually plan to fold this concept into Nixpkgs proper, but to expedite testing being actually ran it's happening on that side-project.

[samueldr]

Yes, the comment indent is weird.

It is not an error, but to keep the relevant comments close to the code.

If I didn't make the change to be the least intrusive in diffs, it would have looked like:

{/*...*/

defaultHardeningFlags =
  # Musl-based platforms will keep "pie", other platforms will not.
  if stdenv.hostPlatform.isMusl &&
    # Except when:
    #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
    #    - static armv7l, where compilation fails.
    !((stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isAarch32) && stdenv.hostPlatform.isStatic)
  then supportedHardeningFlags
  else lib.remove "pie" supportedHardeningFlags;

/*...*/}

I'm not exactly sure how I should format the comments around here to keep the relevant bits at the right location.

[fogti]

I think it may be a good idea to place the condition inside an( with stdenv.hostPlatform; /* ... */ ) block, e.g.:

{/*...*/
      defaultHardeningFlags = if (with stdenv.hostPlatform; isMusl &&
                                # Except when:
                                #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
                                #    - static armv7l, where compilation fails.
                                !((isAarch64 || isAarch32) && isStatic))
                              then supportedHardeningFlags
                              else lib.remove "pie" supportedHardeningFlags;
/*...*/}

[samueldr]

Converted to draft only to prevent an accidental merge. Once ofborg confirms this is a no-op outside of cross it will be safe to go in either master directly, or staging.

[samueldr]

This PR still needs a review, thanks!

[veprbl]

This looks good to me still.

The only comment that I have is that if static+pie doesn't work on arm, we might as well mark it as broken on anything that is not x86_64.

[samueldr]

Note that I did not test non-static musl. Only static+musl (because static+musl is our pkgsStatic).