Merge branch 'hardened-stdenv' into staging

Closes #12895

Amazing work by @globin & @fpletz getting hardened compiler flags by
enabled default on the whole package set

pkgs/tools/system/cron/default.nix

@@ -9,6 +9,8 @@ stdenv.mkDerivation {
 
   unpackCmd = "(mkdir cron && cd cron && sh $curSrc)";
 
+  hardeningEnable = [ "pie" ];
+
   preBuild = ''
     substituteInPlace Makefile --replace ' -o root' ' ' --replace 111 755
     makeFlags="DESTROOT=$out"

pkgs/tools/system/facter/default.nix

@@ -13,9 +13,7 @@ stdenv.mkDerivation rec {
   # since we cant expand $out in cmakeFlags
   preConfigure = "cmakeFlags+=\" -DRUBY_LIB_INSTALL=$out/lib/ruby\"";
 
-  libyamlcpp_ = libyamlcpp.override { makePIC = true; };
-
-  buildInputs = [ boost cmake curl leatherman libyamlcpp_ openssl ruby utillinux ];
+  buildInputs = [ boost cmake curl leatherman libyamlcpp openssl ruby utillinux ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/puppetlabs/facter;

pkgs/tools/system/foremost/default.nix

@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  hardeningDisable = [ "format" ];
+
   preInstall = ''
     mkdir -p $out/{bin,share/man/man8}
   '';

pkgs/tools/system/gdmap/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "gdmap-0.8.1";
-  
+
   src = fetchurl {
     url = "mirror://sourceforge/gdmap/${name}.tar.gz";
     sha256 = "0nr8l88cg19zj585hczj8v73yh21k7j13xivhlzl8jdk0j0cj052";
@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./get_sensitive.patch ./set_flags.patch ];
 
+  hardeningDisable = [ "format" ];
+
   meta = with stdenv.lib; {
     homepage = http://gdmap.sourceforge.net;
     description = "Recursive rectangle map of disk usage";

pkgs/tools/system/rowhammer-test/default.nix

@@ -10,6 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1fbfcnm5gjish47wdvikcsgzlb5vnlfqlzzm6mwiw2j5qkq0914i";
   };
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isi686 "-Wno-error=format";
+
   buildPhase = "sh -e make.sh";
 
   installPhase = ''

pkgs/tools/system/rsyslog/default.nix

@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
     rabbitmq-c hiredis
   ] ++ stdenv.lib.optional stdenv.isLinux systemd;
 
+  hardeningDisable = [ "format" ];
+
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"

pkgs/tools/system/which/default.nix

@@ -2,12 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "which-2.21";
-  
+
   src = fetchurl {
     url = "mirror://gnu/which/${name}.tar.gz";
     sha256 = "1bgafvy3ypbhhfznwjv1lxmd6mci3x1byilnnkc7gcr486wlb8pl";
   };
 
+  # FIXME needs gcc 4.9 in bootstrap tools
+  hardeningDisable = [ "stackprotector" ];
+
   meta = with stdenv.lib; {
     homepage = http://ftp.gnu.org/gnu/which/;
     platforms = platforms.all;