Revert "Merge pull request #28029 from cstrahan/hardening-fix"
This reverts commit0dbc006760
, reversing changes made tocb7f774265
. Should go into staging.
This commit is contained in:
parent
0dbc006760
commit
6c064e6b1f
9 changed files with 108 additions and 134 deletions
|
@ -5,7 +5,6 @@ var_templates_list=(
|
|||
NIX+LDFLAGS_BEFORE
|
||||
NIX+LDFLAGS_AFTER
|
||||
NIX+LDFLAGS_HARDEN
|
||||
NIX+HARDENING_ENABLE
|
||||
)
|
||||
var_templates_bool=(
|
||||
NIX+SET_BUILD_ID
|
||||
|
@ -24,10 +23,10 @@ if [ "${NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then
|
|||
fi
|
||||
|
||||
for var in "${var_templates_list[@]}"; do
|
||||
mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"}
|
||||
mangleVarList "$var" "${role_infixes[@]}"
|
||||
done
|
||||
for var in "${var_templates_bool[@]}"; do
|
||||
mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"}
|
||||
mangleVarBool "$var" "${role_infixes[@]}"
|
||||
done
|
||||
|
||||
if [ -e @out@/nix-support/libc-ldflags ]; then
|
||||
|
|
|
@ -1,58 +1,53 @@
|
|||
declare -a hardeningLDFlags=()
|
||||
hardeningFlags=(relro bindnow)
|
||||
# Intentionally word-split in case 'hardeningEnable' is defined in
|
||||
# Nix. Also, our bootstrap tools version of bash is old enough that
|
||||
# undefined arrays trip `set -u`.
|
||||
if [[ -v hardeningEnable[@] ]]; then
|
||||
hardeningFlags+=(${hardeningEnable[@]})
|
||||
fi
|
||||
hardeningLDFlags=()
|
||||
|
||||
declare -A hardeningEnableMap=()
|
||||
declare -A hardeningDisableMap
|
||||
|
||||
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
|
||||
# array expansion also prevents undefined variables from causing trouble with
|
||||
# `set -u`.
|
||||
for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
|
||||
hardeningEnableMap["$flag"]=1
|
||||
done
|
||||
|
||||
# Remove unsupported flags.
|
||||
for flag in @hardening_unsupported_flags@; do
|
||||
unset -v hardeningEnableMap["$flag"]
|
||||
# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
|
||||
for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
|
||||
do
|
||||
hardeningDisableMap[$flag]=1
|
||||
done
|
||||
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||
declare -a allHardeningFlags=(pie relro bindnow)
|
||||
declare -A hardeningDisableMap=()
|
||||
|
||||
# Determine which flags were effectively disabled so we can report below.
|
||||
for flag in "${allHardeningFlags[@]}"; do
|
||||
if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
|
||||
hardeningDisableMap[$flag]=1
|
||||
fi
|
||||
done
|
||||
|
||||
printf 'HARDENING: disabled flags:' >&2
|
||||
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
|
||||
echo >&2
|
||||
|
||||
if (( "${#hardeningEnableMap[@]}" )); then
|
||||
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
|
||||
fi
|
||||
fi
|
||||
|
||||
for flag in "${!hardeningEnableMap[@]}"; do
|
||||
case $flag in
|
||||
pie)
|
||||
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
|
||||
hardeningLDFlags+=('-pie')
|
||||
fi
|
||||
;;
|
||||
relro)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
|
||||
hardeningLDFlags+=('-z' 'relro')
|
||||
;;
|
||||
bindnow)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi
|
||||
hardeningLDFlags+=('-z' 'now')
|
||||
;;
|
||||
*)
|
||||
# Ignore unsupported. Checked in Nix that at least *some*
|
||||
# tool supports each flag.
|
||||
;;
|
||||
esac
|
||||
done
|
||||
if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
|
||||
fi
|
||||
for flag in "${hardeningFlags[@]}"
|
||||
do
|
||||
if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
|
||||
case $flag in
|
||||
pie)
|
||||
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
|
||||
hardeningLDFlags+=('-pie')
|
||||
fi
|
||||
;;
|
||||
relro)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
|
||||
hardeningLDFlags+=('-z' 'relro')
|
||||
;;
|
||||
bindnow)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi
|
||||
hardeningLDFlags+=('-z' 'now')
|
||||
;;
|
||||
*)
|
||||
# Ignore unsupported. Checked in Nix that at least *some*
|
||||
# tool supports each flag.
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
|
|
@ -57,8 +57,8 @@ fi
|
|||
|
||||
source @out@/nix-support/add-hardening.sh
|
||||
|
||||
extraAfter=()
|
||||
extraBefore=(${hardeningLDFlags[@]+"${hardeningLDFlags[@]}"})
|
||||
extraAfter=("${hardeningLDFlags[@]}")
|
||||
extraBefore=()
|
||||
|
||||
if [ -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ]; then
|
||||
extraAfter+=($NIX_@infixSalt@_LDFLAGS)
|
||||
|
|
|
@ -83,10 +83,6 @@ do
|
|||
fi
|
||||
done
|
||||
|
||||
# If unset, assume the default hardening flags.
|
||||
: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
|
||||
export NIX_HARDENING_ENABLE
|
||||
|
||||
# No local scope in sourced file
|
||||
unset -v role_pre role_post cmd upper_case
|
||||
set +u
|
||||
|
|
|
@ -30,10 +30,10 @@ fi
|
|||
# We need to mangle names for hygiene, but also take parameters/overrides
|
||||
# from the environment.
|
||||
for var in "${var_templates_list[@]}"; do
|
||||
mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"}
|
||||
mangleVarList "$var" "${role_infixes[@]}"
|
||||
done
|
||||
for var in "${var_templates_bool[@]}"; do
|
||||
mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"}
|
||||
mangleVarBool "$var" "${role_infixes[@]}"
|
||||
done
|
||||
|
||||
# `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
|
||||
|
|
|
@ -1,72 +1,67 @@
|
|||
declare -a hardeningCFlags=()
|
||||
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
|
||||
# Intentionally word-split in case 'hardeningEnable' is defined in
|
||||
# Nix. Also, our bootstrap tools version of bash is old enough that
|
||||
# undefined arrays trip `set -u`.
|
||||
if [[ -v hardeningEnable[@] ]]; then
|
||||
hardeningFlags+=(${hardeningEnable[@]})
|
||||
fi
|
||||
hardeningCFlags=()
|
||||
|
||||
declare -A hardeningEnableMap=()
|
||||
declare -A hardeningDisableMap
|
||||
|
||||
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
|
||||
# array expansion also prevents undefined variables from causing trouble with
|
||||
# `set -u`.
|
||||
for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
|
||||
hardeningEnableMap["$flag"]=1
|
||||
done
|
||||
|
||||
# Remove unsupported flags.
|
||||
for flag in @hardening_unsupported_flags@; do
|
||||
unset -v hardeningEnableMap["$flag"]
|
||||
# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
|
||||
for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
|
||||
do
|
||||
hardeningDisableMap[$flag]=1
|
||||
done
|
||||
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||
declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format)
|
||||
declare -A hardeningDisableMap=()
|
||||
|
||||
# Determine which flags were effectively disabled so we can report below.
|
||||
for flag in "${allHardeningFlags[@]}"; do
|
||||
if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
|
||||
hardeningDisableMap["$flag"]=1
|
||||
fi
|
||||
done
|
||||
|
||||
printf 'HARDENING: disabled flags:' >&2
|
||||
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
|
||||
echo >&2
|
||||
|
||||
if (( "${#hardeningEnableMap[@]}" )); then
|
||||
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
|
||||
fi
|
||||
fi
|
||||
|
||||
for flag in "${!hardeningEnableMap[@]}"; do
|
||||
case $flag in
|
||||
fortify)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
|
||||
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
|
||||
;;
|
||||
stackprotector)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
|
||||
hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
|
||||
;;
|
||||
pie)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
|
||||
hardeningCFlags+=('-fPIE')
|
||||
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
|
||||
hardeningCFlags+=('-pie')
|
||||
fi
|
||||
;;
|
||||
pic)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
|
||||
hardeningCFlags+=('-fPIC')
|
||||
;;
|
||||
strictoverflow)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
|
||||
hardeningCFlags+=('-fno-strict-overflow')
|
||||
;;
|
||||
format)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
|
||||
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
|
||||
;;
|
||||
*)
|
||||
# Ignore unsupported. Checked in Nix that at least *some*
|
||||
# tool supports each flag.
|
||||
;;
|
||||
esac
|
||||
done
|
||||
if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then
|
||||
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
|
||||
fi
|
||||
for flag in "${hardeningFlags[@]}"
|
||||
do
|
||||
if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
|
||||
case $flag in
|
||||
fortify)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
|
||||
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
|
||||
;;
|
||||
stackprotector)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
|
||||
hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
|
||||
;;
|
||||
pie)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
|
||||
hardeningCFlags+=('-fPIE')
|
||||
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
|
||||
hardeningCFlags+=('-pie')
|
||||
fi
|
||||
;;
|
||||
pic)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
|
||||
hardeningCFlags+=('-fPIC')
|
||||
;;
|
||||
strictoverflow)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
|
||||
hardeningCFlags+=('-fno-strict-overflow')
|
||||
;;
|
||||
format)
|
||||
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
|
||||
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
|
||||
;;
|
||||
*)
|
||||
# Ignore unsupported. Checked in Nix that at least *some*
|
||||
# tool supports each flag.
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
|
|
@ -134,8 +134,8 @@ fi
|
|||
source @out@/nix-support/add-hardening.sh
|
||||
|
||||
# Add the flags for the C compiler proper.
|
||||
extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE)
|
||||
extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"})
|
||||
extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE "${hardeningCFlags[@]}")
|
||||
extraBefore=()
|
||||
|
||||
if [ "$dontLink" != 1 ]; then
|
||||
|
||||
|
|
|
@ -147,10 +147,6 @@ export ${role_pre}CXX=@named_cxx@
|
|||
export CC${role_post}=@named_cc@
|
||||
export CXX${role_post}=@named_cxx@
|
||||
|
||||
# If unset, assume the default hardening flags.
|
||||
: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
|
||||
export NIX_HARDENING_ENABLE
|
||||
|
||||
# No local scope in sourced file
|
||||
unset -v role_pre role_post
|
||||
set +u
|
||||
|
|
|
@ -74,11 +74,6 @@ rec {
|
|||
# TODO(@Ericson2314): Make this more modular, and not O(n^2).
|
||||
let
|
||||
supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
|
||||
defaultHardeningFlags = lib.remove "pie" supportedHardeningFlags;
|
||||
enabledHardeningOptions =
|
||||
if builtins.elem "all" hardeningDisable
|
||||
then []
|
||||
else lib.subtractLists hardeningDisable (defaultHardeningFlags ++ hardeningEnable);
|
||||
# hardeningDisable additionally supports "all".
|
||||
erroneousHardeningFlags = lib.subtractLists supportedHardeningFlags (hardeningEnable ++ lib.remove "all" hardeningDisable);
|
||||
in if builtins.length erroneousHardeningFlags != 0
|
||||
|
@ -184,8 +179,6 @@ rec {
|
|||
++ optional (elem "host" configurePlatforms) "--host=${stdenv.hostPlatform.config}"
|
||||
++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
|
||||
|
||||
} // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != []) {
|
||||
NIX_HARDENING_ENABLE = enabledHardeningOptions;
|
||||
} // lib.optionalAttrs (stdenv.buildPlatform.isDarwin) {
|
||||
# TODO: remove lib.unique once nix has a list canonicalization primitive
|
||||
__sandboxProfile =
|
||||
|
|
Loading…
Reference in a new issue