8 Commits

Author SHA1 Message Date
Philip Taron 1be059d60a freshBootstrapTools.bootstrapTools: extract as a sort of package 2024-08-04 17:36:45 +02:00
Philip Taron 921c21f4a9 freshBootstrapTools: unify glibc and musl into the same directory
CI required that I `nixfmt` them at the same time.
2024-08-04 17:36:45 +02:00
Franz Pletz 3db93c351d cc-wrapper: add stack clash protection hardening flag
Most Linux distributions are enabling this these days and it does
protect against real world vulnerabilities as demonstrated by
CVE-2018-16864 and CVE-2018-16865.

Fix #53753.

Information on llvm version support gleaned from
https://github.com/llvm/llvm-project/commit/6609892a2dcdd1a4f6adefe191b55524861f020c
https://github.com/llvm/llvm-project/commit/68e07da3e5d5175e24caa309e2b13cb333365c8c
https://github.com/llvm/llvm-project/commit/092507a730fa4fad6dbe544cd139cfb7e8179aa4

Information on gcc version support a lot harder to gather,
but both 32bit and 64bit arm do appear to be supported
based on the test suite.
2024-06-07 20:23:46 +01:00
Robert Scott 4a91b3e798 cc-wrapper: add trivialautovarinit hardening flag support
this equates to -ftrivial-auto-var-init=pattern

clang has removed support for -ftrivial-auto-var-init=zero and
are unlikely to re-add it, so use -ftrivial-auto-var-init=pattern
on both compilers if only to make behaviour more consistent
between the two.

add to pkgsExtraHardening's defaultHardeningFlags.
2024-02-24 12:00:09 +00:00
Robert Scott 40868719b0 cc-wrapper: add zerocallusedregs hardening flag
this uses the value `used-gpr` which seems to be a commonly
chosen value for general use
2024-01-20 13:48:33 +00:00
Robert Scott c09e1fa406 gcc: mark hardeningUnsupportedFlags fortify3 for all but gcc 12 2023-01-24 21:52:12 +00:00
regnat 14f66d60a7 Make the bootsrap respect the contentAddressedByDefault setting
Patch every `derivation` call in the bootsrap process to add it a
conditional `__contentAddressed` parameter.

That way, passing `contentAddressedByDefault` means that the entire
build closure of a system can be content addressed
2021-04-28 10:25:49 +02:00
John Ericson 7960a1b1b8 linux stdenv: Avoid assert false
On one hand, don't want to pass garbage that affects hash, on the other
hand footguns are bad.

Now, factored out the derivation so only need to pass in what is used.
2016-12-15 17:09:29 -05:00