BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nginx, nginxUnstable: hardening: only use when the compiler is gcc

Browse source
This commit is contained in:
Michael Raskin 2016-03-04 16:57:47 +01:00
parent 7b9684a5b5
commit 708c6094c5
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkgs/servers/http/nginx/default.nix
View file

@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations -Wno-error=conditional-uninitialized";
preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules)
+ optionalString hardening ''
+ optionalString (hardening && (stdenv.cc.cc.isGNU or false)) ''
configureFlagsArray=(
--with-cc-opt="-fPIE -fstack-protector-all --param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2"
--with-ld-opt="-pie -Wl,-z,relro,-z,now"

2
pkgs/servers/http/nginx/unstable.nix
View file

@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules)
+ optionalString hardening ''
+ optionalString (hardening && (stdenv.cc.cc.isGNU or false)) ''
configureFlagsArray=(
--with-cc-opt="-fPIE -fstack-protector-all --param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2"
--with-ld-opt="-pie -Wl,-z,relro,-z,now"