Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix hardening default for pkgsMusl to reenable -pie #101606

Merged
merged 1 commit into from Jan 30, 2021
Merged

Fix hardening default for pkgsMusl to reenable -pie #101606

merged 1 commit into from Jan 30, 2021

Conversation

utsl42
Copy link
Contributor

@utsl42 utsl42 commented Oct 24, 2020

Motivation for this change

Found while attempting to fix or work around #101490:

pkgs/stdenv/generic/make-derivation.nix

 108   │       supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
 109   │       defaultHardeningFlags = if stdenv.hostPlatform.isMusl
 110   │                               then supportedHardeningFlags
 111   │                               else lib.remove "pie" supportedHardeningFlags;

makes it look like -pie is enabled by default on Musl. But that doesn't work, because the line modified in this change fails to set NIX_HARDENING_ENABLE, which causes pkgs/build-support/cc-wrapper/setup-hook.sh and pkgs/build-support/bintools-wrapper/setup-hook.sh to fall back to:

  68   │ : ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

Tested building pkgsMusl.stdenv. Validated it builds working binaries with -pie enabled.

@andir
Copy link
Member

andir commented Oct 24, 2020

Can you also add the entire explanation to the commit message? Right now we do not have anything helpful in the commit message. If we have to go back to this (e.g. due to git blame) we wouldn't really see why that was done or how we ended up doing this.

@utsl42
Copy link
Contributor Author

utsl42 commented Oct 25, 2020

Done. Yeah, this was a bit convoluted.

@andir
Copy link
Member

andir commented Oct 25, 2020

Thanks! Can you also prefix the first line of the commit message with stdenv: as that seems most appropriate for this change.

@utsl42
stdenv: Fix hardening default for pkgsMusl to reenable -pie
4e9dc46 
defaultHardeningFlags is set to enable pie for Musl, but is not
actually used because the default is never put into
NIX_HARDENING_ENABLE. That still works for cases other than Musl
only because NIX_HARDENING_ENABLE is defaulted in the binutils and
cc-wrapper setup-hook.sh scripts.
@symphorien
Copy link
Member

checked that pkgsMusl.openssl now build a pie executable (it currently does not on nixos-unstable)

@utsl42 utsl42 mentioned this pull request Oct 26, 2020
Draft
10 tasks
@TredwellGit
Copy link
Member

#104091

@SuperSandro2000
Copy link
Member

@utsl42 please fix the eval error.

@symphorien
Copy link
Member

The eval error is related to django, which does not make sense.

@GrahamcOfBorg eval

@SuperSandro2000
Copy link
Member

This is a semi-automatic executed nixpkgs-review which is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).
If you have any questions or problems please reach out to SuperSandro2000 on IRC.

Result of nixpkgs-review pr 101606 run on x86_64-linux 1

1 package marked as broken and skipped:
  • nix-exec
2 packages blacklisted:
  • tests.nixos-functions.nixos-test
  • tests.nixos-functions.nixosTest-test
9 packages failed to build and are new build failures:
59 packages built:
  • bundix
  • busybox-sandbox-shell
  • cabal2nix
  • cachix
  • common-updater-scripts
  • crate2nix
  • crystal2nix
  • dep2nix
  • disnix
  • disnixos
  • dydisnix
  • fusionInventory
  • go2nix
  • haskellPackages.cachix
  • haskellPackages.nix-paths
  • haskellPackages.update-nix-fetchgit
  • hydra-unstable
  • libnixxml
  • lispPackages.quicklisp-to-nix
  • lispPackages.quicklisp-to-nix-system-info
  • nix (nixStable)
  • nix-bundle
  • nix-direnv
  • nix-doc
  • nix-du
  • nix-index
  • nix-pin
  • nix-plugins
  • nix-prefetch
  • nix-prefetch-bzr
  • nix-prefetch-cvs
  • nix-prefetch-docker
  • nix-prefetch-git
  • nix-prefetch-hg
  • nix-prefetch-scripts
  • nix-prefetch-svn
  • nix-serve
  • nix-update
  • nix-update-source
  • nixFlakes (nixUnstable)
  • nixos-generators
  • nixos-rebuild
  • nixos-shell
  • nixpkgs-review
  • nixui
  • pkgsMusl.stdenv
  • pkgsStatic.stdenv
  • python37Packages.nix-kernel
  • python37Packages.nixpkgs
  • python37Packages.pythonix
  • python38Packages.nix-kernel
  • python38Packages.nixpkgs
  • python38Packages.pythonix
  • python39Packages.nix-kernel
  • python39Packages.nixpkgs
  • python39Packages.pythonix
  • update-nix-fetchgit
  • vgo2nix
  • vulnix

@symphorien symphorien merged commit a6840c5 into NixOS:master Jan 30, 2021
@samueldr samueldr mentioned this pull request Mar 3, 2021
Closed
@nh2 nh2 mentioned this pull request Jul 4, 2021
Closed
@nh2
Copy link
Contributor

nh2 commented Jul 4, 2021

This broke GHC on musl, see writeup here:

#129247 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Ericson2314 Ericson2314 Awaiting requested review from Ericson2314 Ericson2314 is a code owner

@matthewbauer matthewbauer Awaiting requested review from matthewbauer

Assignees
No one assigned
Labels
6.topic: stdenv Standard environment 10.rebuild-darwin: 0 10.rebuild-linux: 11-100
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@utsl42 @andir @symphorien @TredwellGit @SuperSandro2000 @nh2