hardening: ld wrapper changes, setup-hook, etc

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -1,4 +1,4 @@
-allHardeningFlags=(fortify stackprotector pie pic strictoverflow format relro bindnow)
+allHardeningFlags=(fortify stackprotector pie pic strictoverflow format)
 hardeningCFlags=()
 
 declare -A hardeningEnableMap=()
@@ -12,7 +12,7 @@ done
 
 # Remove unsupported flags.
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-    declare -A hardeningDisableMap=()
+  declare -A hardeningDisableMap=()
 fi
 for flag in @hardening_unsupported_flags@; do
   [[ -n ${hardeningEnableMap[$flag]} ]] || continue

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -135,7 +135,6 @@ source @out@/nix-support/add-hardening.sh
 
 # Add the flags for the C compiler proper.
 extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE)
-
 extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"})
 
 if [ "$dontLink" != 1 ]; then

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -147,6 +147,10 @@ export ${role_pre}CXX=@named_cxx@
 export CC${role_post}=@named_cc@
 export CXX${role_post}=@named_cxx@
 
+# If unset, assume the default hardening flags.
+: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
+export NIX_HARDENING_ENABLE
+
 # No local scope in sourced file
 unset -v role_pre role_post
 set +u