cc-wrapper: Remove redundant hardening

[Ericson2314]

Motivation for this change

I can't find these flags (-z relno -z now) documented for GCC anywhere, and they are already passed to ld anyways.

Based on aff1f4a, I think these were accidentally passed to the C compiler from the beginning.

Things done

• Tested using sandboxing
  (nix.useSandbox on NixOS,
  or option build-use-sandbox in nix.conf
  on non-NixOS)
• Built stdenv on platform(s)
  • NixOS --- https://hydra.mayflower.de/jobset/mayflower/hydra-jobs-hardening-redundancy
  • macOS
  • Linux
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

---

[mention-bot]

@Ericson2314, thanks for your PR! By analyzing the history of the files in this pull request, we identified @edolstra, @abbradar and @vcunat to be potential reviewers.

[periklis]

afaik these are clear linker flags to control relocation on build/link-time since the addresses of the code-segments are known. I suspect these flags are passed with purpose to the gcc driver, who passes them to the linker in the end.

[Ericson2314]

Ah, per https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html

-z is passed directly on to the linker along with the keyword keyword. See the section in the documentation of your linker for permitted values and their meanings.

But if it's just a pass-through, then we don't need to do this as the linker wrapper will add it anyways.

[Ericson2314]

@globin based on the hydra job I think this will be good to merge tomorrow if my Darwin stdenv build finishes?

[orivej]

@Ericson2314 The next commit 97a4883 broke the evaluation of nixUnstable:

$ nix-build ~/.nixpkgs/nixpkgs -A nixUnstable --show-trace                                                                                                               /tmp
error: while evaluating the attribute ‘configureFlags’ of the derivation ‘nix-1.12pre5511_c94f3d55’ at /home/uj/.nixpkgs/nixpkgs/pkgs/stdenv/generic/make-derivation.nix:98:11:
while evaluating ‘override’ at /home/uj/.nixpkgs/nixpkgs/lib/customisation.nix:78:20, called from /home/uj/.nixpkgs/nixpkgs/pkgs/tools/package-management/nix/default.nix:13:8:
while evaluating ‘makeOverridable’ at /home/uj/.nixpkgs/nixpkgs/lib/customisation.nix:72:24, called from /home/uj/.nixpkgs/nixpkgs/lib/customisation.nix:78:29:
while evaluating anonymous function at /home/uj/.nixpkgs/nixpkgs/pkgs/os-specific/linux/busybox/default.nix:1:1, called from /home/uj/.nixpkgs/nixpkgs/lib/customisation.nix:74:12:
while evaluating ‘mkDerivation’ at /home/uj/.nixpkgs/nixpkgs/pkgs/stdenv/generic/make-derivation.nix:15:5, called from /home/uj/.nixpkgs/nixpkgs/pkgs/os-specific/linux/busybox/default.nix:29:1:
assertion failed at /home/uj/.nixpkgs/nixpkgs/pkgs/stdenv/generic/make-derivation.nix:54:8

I don't understand why…

[orivej]

This change to pkgs/stdenv/generic/make-derivation.nix helps with debugging:

-    let allHardeningFlags = [
-      "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro"
-      "bindnow"
-    ];
-    in assert lib.all
-      (flag: lib.elem flag allHardeningFlags)
-      (hardeningEnable ++ hardeningDisable);
-
-    let
+    let unsupportedHardeningFlags = lib.subtractLists [
+      "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow"
+    ] (hardeningEnable ++ hardeningDisable);
+    in if builtins.length unsupportedHardeningFlags != 0
+    then abort ("unsupported hardening flags: " + lib.escapeShellArgs unsupportedHardeningFlags)
+    else let

nix-build ~/.nixpkgs/nixpkgs -A gnat --show-trace fails with intelligible

while evaluating ‘mkDerivation’ at /home/uj/.nixpkgs/nixpkgs/pkgs/stdenv/generic/make-derivation.nix:15:5, called from /home/uj/.nixpkgs/nixpkgs/pkgs/development/compilers/gcc/4.5/default.nix:128:1:
evaluation aborted with the following error message: ‘unsupported hardening flags: 'all'’

but nix-build ~/.nixpkgs/nixpkgs -A nixUnstable --show-trace fails with mysterious

while evaluating ‘override’ at /home/uj/.nixpkgs/nixpkgs/lib/customisation.nix:78:20, called from /home/uj/.nixpkgs/nixpkgs/pkgs/tools/package-management/nix/default.nix:13:8:
while evaluating ‘makeOverridable’ at /home/uj/.nixpkgs/nixpkgs/lib/customisation.nix:72:24, called from /home/uj/.nixpkgs/nixpkgs/lib/customisation.nix:78:29:
while evaluating anonymous function at /home/uj/.nixpkgs/nixpkgs/pkgs/os-specific/linux/busybox/default.nix:1:1, called from /home/uj/.nixpkgs/nixpkgs/lib/customisation.nix:74:12:
while evaluating ‘mkDerivation’ at /home/uj/.nixpkgs/nixpkgs/pkgs/stdenv/generic/make-derivation.nix:15:5, called from /home/uj/.nixpkgs/nixpkgs/pkgs/os-specific/linux/busybox/default.nix:29:1:
evaluation aborted with the following error message: ‘unsupported hardening flags: 'fortify'’

[Ericson2314]

Ah, and I was just about to post

$ nix-instantiate --eval --show-trace -E '((import ./. {}).busybox.override { enableStatic = true; }).hardeningDisable'

So, what do you think is going on? "fortify" is definitely on my whitelist.

"all"not being there (though it definitely should be) somewhat spooks me too, as nix-env -qaP -f . --out-path --show-trace succeed.

[orivej]

Is this a bug in Nix?

$ nix-repl
Welcome to Nix version 1.11.13. Type :? for help.

nix-repl> :a import <nixpkgs> { }
Added 7763 variables.

nix-repl> lib.subtractLists ["a" "b"] ([ "a" "b" ])
[ ]

nix-repl> lib.subtractLists ["a" "b"] ([ "a" ] ++ (lib.optional true ["b"]))
[ [ ... ] ]

nix-repl> builtins.length (lib.subtractLists ["a" "b"] ([ "a" ] ++ (lib.optional true ["b"])))
1

nix-repl> builtins.head (lib.subtractLists ["a" "b"] ([ "a" ] ++ (lib.optional true ["b"])))
[ "b" ]

[orivej]

No, it's my mistake of testing with optional instead of optionals.

[orivej]

busybox is subject to exactly this problem with its

hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];

that evaluates to [ "format" [ "fortify" ] ].