pyrox.dev / nixpkgs
lol
fork atom

build-support: Use response-expanded params in pie test

When a response file is in use, "$*" contains the response file and not
the parameters; both the linker and compiler wrappers are updated to use
the response-expanded params.

The compiler driver likes to pass parameters to the linker via a
response file, including -shared.

LLD rejects the combination of (-shared -pie), whereas other linkers
silently ignore the contradiction:

```
ld.lld: error: -shared and -pie may not be used together
```

This breaks certain configurations using LLD as a linker.

Changing `add-hardening.sh` results in a full rebuild. To avoid the
rebuild, here is a quick test case which shows the new hardening script
allows the link to succeed:

```
{ pkgs ? import <nixpkgs> {} }:

let
# gcc silently accepts -shared -pie together, lld does not.
linker = pkgs.wrapBintoolsWith { bintools = pkgs.llvmPackages.lld; };

patchWrapper = prev: prev.overrideAttrs (final: prev: let
prevScript = builtins.match (".*(/nix/store/[a-z0-9]+-add-hardening.sh).*") prev.postFixup;
in {
postFixup = (builtins.replaceStrings prevScript ["${./new-add-hardening.sh}"] prev.postFixup);
});
in

pkgs.stdenv.mkDerivation {
name = "nixpkgs-hardening-bug";

src = pkgs.writeText "src.c" "int main(int argc, char* argv[]) { return 0; }";
NIX_HARDENING_ENABLE = "pie";

unpackPhase = ":";
buildPhase = ''
$CC -c -o src.o $src
bash -x ${patchWrapper linker}/bin/ld.lld -o $out @${pkgs.writeText "responsefile" "-shared"} src.o
'';
}
```

Fixes: #178162
Signed-off-by: Peter Waller <p@pwaller.net>

Peter Waller e0d2053b c311c7c5

options
unified split
Changed files
+6 -6
pkgs
build-support
bintools-wrapper
add-hardening.sh
cc-wrapper
add-hardening.sh
+5 -5
pkgs/build-support/bintools-wrapper/add-hardening.sh 
···

       
37

       
37

       
 

       
for flag in "${!hardeningEnableMap[@]}"; do


     

       
38

       
38

       
 

       
  case $flag in


     

       
39

       
39

       
 

       
    pie)


     

       
40

       

       
-

       
      if [[ ! (" $* " =~ " -shared " \


     

       
41

       

       
-

       
            || " $* " =~ " -static " \


     

       
42

       

       
-

       
            || " $* " =~ " -r " \


     

       
43

       

       
-

       
            || " $* " =~ " -Ur " \


     

       
44

       

       
-

       
            || " $* " =~ " -i ") ]]; then


     

       

       
40

       
+

       
      if [[ ! (" ${params[*]} " =~ " -shared " \


     

       

       
41

       
+

       
            || " ${params[*]} " =~ " -static " \


     

       

       
42

       
+

       
            || " ${params[*]} " =~ " -r " \


     

       

       
43

       
+

       
            || " ${params[*]} " =~ " -Ur " \


     

       

       
44

       
+

       
            || " ${params[*]} " =~ " -i ") ]]; then


     

       
45

       
45

       
 

       
        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi


     

       
46

       
46

       
 

       
        hardeningLDFlags+=('-pie')


     

       
47

       
47

       
 

       
      fi
+1 -1
pkgs/build-support/cc-wrapper/add-hardening.sh 
···

       
71

       
71

       
 

       
      # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags


     

       
72

       
72

       
 

       
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi


     

       
73

       
73

       
 

       
      hardeningCFlags=('-fPIE' "${hardeningCFlags[@]}")


     

       
74

       

       
-

       
      if [[ ! (" $* " =~ " -shared " || " $* " =~ " -static ") ]]; then


     

       

       
74

       
+

       
      if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then


     

       
75

       
75

       
 

       
        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi


     

       
76

       
76

       
 

       
        hardeningCFlags=('-pie' "${hardeningCFlags[@]}")


     

       
77

       
77

       
 

       
      fi