Use general hardening flag toggle lists

The following parameters are now available:

  * hardeningDisable
    To disable specific hardening flags
  * hardeningEnable
    To enable specific hardening flags

Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.

cc-wrapper supports the following flags:

  * fortify
  * stackprotector
  * pie (disabled by default)
  * pic
  * strictoverflow
  * format
  * relro
  * bindnow

pkgs/tools/graphics/barcode/default.nix

@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1indapql5fjz0bysyc88cmc54y8phqrbi7c76p71fgjp45jcyzp8";
   };
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   meta = with stdenv.lib; {
     description = "GNU barcode generator";

pkgs/tools/graphics/editres/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres";
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   meta = {
     homepage = "http://cgit.freedesktop.org/xorg/app/editres/";

pkgs/tools/graphics/ggobi/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--with-all-plugins";
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   meta = with stdenv.lib; {
     description = "Visualization program for exploring high-dimensional data";

pkgs/tools/graphics/graphviz/2.0.nix

@@ -14,8 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [pkgconfig xlibsWrapper libpng libjpeg expat libXaw yacc libtool fontconfig pango gd];
 
-  hardening_format = false;
-  hardening_fortify = false;
+  hardeningDisable = [ "format" "fortify" ];
 
   configureFlags =
     [ "--with-pngincludedir=${libpng}/include"

pkgs/tools/graphics/graphviz/2.32.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     ]
     ++ stdenv.lib.optional (xorg == null) "--without-x";
 
-  hardening_fortify = false;
+  hardeningDisable = [ "fortify" ];
 
   preBuild = ''
     sed -e 's@am__append_5 *=.*@am_append_5 =@' -i lib/gvc/Makefile

pkgs/tools/graphics/graphviz/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "17l5czpvv5ilmg17frg0w4qwf89jzh2aglm9fgx0l0aakn6j7al1";
   };
 
-  hardening_fortify = false;
+  hardeningDisable = [ "fortify" ];
 
   patches =
     [ ./0001-vimdot-lookup-vim-in-PATH.patch

pkgs/tools/graphics/nifskope/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   # Inspired by linux-install/nifskope.spec.in.
   installPhase =

pkgs/tools/graphics/plotutils/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--enable-libplotter"; # required for pstoedit
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   doCheck = true;
 

pkgs/tools/graphics/pngcheck/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pzkj1bb4kdybk6vbfq9s0wzdm5szmrgixkas3xmbpv4mhws1w3p";
   };
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   makefile = "Makefile.unx";
   makeFlags = "ZPATH=${zlib}/lib";

pkgs/tools/graphics/qrcode/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     inherit (s) rev url sha256;
   };
 
-  hardening_fortify = false;
+  hardeningDisable = [ "fortify" ];
 
   installPhase = ''
     mkdir -p "$out"/{bin,share/doc/qrcode}

pkgs/tools/graphics/transfig/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   buildInputs = [zlib libjpeg libpng imake];
   inherit libpng;
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   patches = [prefixPatch1 prefixPatch2 prefixPatch3 varargsPatch gensvgPatch];
 

pkgs/tools/graphics/zbar/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-video" ];
 
-  hardening_fortify = false;
+  hardeningDisable = [ "fortify" ];
 
   meta = with stdenv.lib; {
     description = "Bar code reader";