Use general hardening flag toggle lists

The following parameters are now available:

  * hardeningDisable
    To disable specific hardening flags
  * hardeningEnable
    To enable specific hardening flags

Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.

cc-wrapper supports the following flags:

  * fortify
  * stackprotector
  * pie (disabled by default)
  * pic
  * strictoverflow
  * format
  * relro
  * bindnow

pkgs/build-support/cc-wrapper/add-hardening

@@ -0,0 +1,41 @@
+hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
+hardeningFlags+=("${hardeningEnable[@]}")
+hardeningCFlags=()
+hardeningLDFlags=()
+
+if [[ ! $hardeningDisable == "all" ]]; then
+  for flag in "${hardeningFlags[@]}"
+  do
+    if [[ ! "$hardeningDisable" =~ "$flag" ]]; then
+      case $flag in
+        fortify)
+          hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
+          ;;
+        stackprotector)
+          hardeningCFlags+=('-fstack-protector-strong')
+          ;;
+        pie)
+          hardeningCFlags+=('-fPIE' '-pie')
+          ;;
+        pic)
+          hardeningCFlags+=('-fPIC')
+          ;;
+        strictoverflow)
+          hardeningCFlags+=('-fno-strict-overflow')
+          ;;
+        format)
+          hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
+          ;;
+        relro)
+          hardeningLDFlags+=('-z relro')
+          ;;
+        bindnow)
+          hardeningLDFlags+=('-z now')
+          ;;
+        *)
+          echo "Hardening flag unknown: $flag"
+          ;;
+      esac
+    fi
+  done
+fi

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -56,7 +56,6 @@ if [ "$nonFlagArgs" = 0 ]; then
     dontLink=1
 fi
 
-
 # Optionally filter out paths not refering to the store.
 params=("$@")
 if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
@@ -90,16 +89,17 @@ if [[ "@prog@" = *++ ]]; then
     fi
 fi
 
-# Add the flags for the C compiler proper.
-extraAfter=($NIX_CFLAGS_COMPILE)
-extraBefore=()
+source @out@/nix-support/add-hardening.sh
 
+# Add the flags for the C compiler proper.
+extraAfter=($NIX_CFLAGS_COMPILE ${hardeningCFlags[@]})
+extraBefore=()
 
 if [ "$dontLink" != 1 ]; then
 
     # Add the flags that should only be passed to the compiler when
     # linking.
-    extraAfter+=($NIX_CFLAGS_LINK)
+    extraAfter+=($NIX_CFLAGS_LINK ${hardeningLDFlags[@]})
 
     # Add the flags that should be passed to the linker (and prevent
     # `ld-wrapper' from adding NIX_LDFLAGS again).

pkgs/build-support/cc-wrapper/default.nix

@@ -234,6 +234,7 @@ stdenv.mkDerivation {
       rm $out/nix-support/setup-hook.tmp
 
       substituteAll ${./add-flags} $out/nix-support/add-flags.sh
+      cp -p ${./add-hardening} $out/nix-support/add-hardening.sh
       cp -p ${./utils.sh} $out/nix-support/utils.sh
     ''
     + extraBuildCommands;

pkgs/build-support/cc-wrapper/ld-wrapper.sh

@@ -47,8 +47,9 @@ if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
     params=("${rest[@]}")
 fi
 
+source @out@/nix-support/add-hardening.sh
 
-extra=()
+extra=(${hardeningLDFlags[@]})
 extraBefore=()
 
 if [ -z "$NIX_LDFLAGS_SET" ]; then
@@ -56,7 +57,7 @@ if [ -z "$NIX_LDFLAGS_SET" ]; then
     extraBefore+=($NIX_LDFLAGS_BEFORE)
 fi
 
-extra+=($NIX_LDFLAGS_AFTER)
+extra+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
 
 
 # Add all used dynamic libraries to the rpath.