cc-wrapper: include fortify-headers before libc includes for musl#219421
cc-wrapper: include fortify-headers before libc includes for musl#219421risicle merged 2 commits intoNixOS:stagingfrom
Conversation
0a575eb to
0bbae0e
Compare
There was a problem hiding this comment.
Shouldn't version number appear in the URL?
There was a problem hiding this comment.
I'm the one calling this 1.1alpine1 - the r1 is not an official designation, just alpine's release of the package. And it does differ from upstream's package slightly, including a patch to fix ppoll on some systems https://git.alpinelinux.org/aports/commit/main/fortify-headers?id=4f60e618352e581f7f77a3842e29141da8992d5f. r3 in fact includes patches for clang support, but I'm not using that one yet because I can't find a stable url for it, only appearing in the edge release.
0bbae0e to
56b5bb7
Compare
|
It appears to me that what #245550 has done is make both I guess at least it's consistent though. |
|
Yeah, I did not make it any better :( |
56b5bb7 to
95c4a1f
Compare
|
Have updated the comment. Would you approve of merging this as-is until someone decides to sort it out "properly"? |
Description of changes
Musl itself doesn't have support for
FORTIFY_SOURCE. Distributions like alpine use the fortify-headers project (https://git.2f30.org/fortify-headers/file/README.html) to provide some basic fortify support using a header#include_nextwrapper/passthru mechanism.This PR does the same, firstly by packaging
fortify-headers(in fact this extracts them from the alpine package because upstream only has a bare git repository and we don't want to depend on git in the bootstrap phases), then by applying them from the cc-wrapper on musl systems (or ifincludeFortifyHeadersis set manually).This can be tested using the tests in #217390 (cherry-pick on top of this). I added
tests.hardeningFlags.fortify1ExplicitEnabledExecTestto that specifically for testing this PR - thehardening-checkmethod won't be able to detectfortify-headers' entirely-inlined approach andfortify-headersreally only implementsFORTIFY_SOURCE=1mode. This passes for me forpkgsMuslandpkgsStaticon nixos x86_64.(Side note: I don't think it would be particularly hard to add
FORTIFY_SOURCE=2or evenFORTIFY_SOURCE=3mode tofortify-headers, but it feels like the author is opposed to this. Yell if you'd be interested for me to try this...)Things done
sandbox = trueset innix.conf? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)