public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hardenning: Rejigger ifs and explicit declare and unset -v

Browse Source
This commit is contained in:
John Ericson 2018-04-10 15:42:05 -04:00 committed by Charles Strahan
parent 386e77dae9
commit 4c76d87871
2 changed files with 14 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkgs/build-support/bintools-wrapper/add-hardening.sh
View File

@ -1,4 +1,4 @@
hardeningFlags=() declare -a hardeningLDFlags=()
declare -A hardeningEnableMap=() declare -A hardeningEnableMap=()
@ -11,14 +11,14 @@ done
# Remove unsupported flags. # Remove unsupported flags.
for flag in @hardening_unsupported_flags@; do for flag in @hardening_unsupported_flags@; do
unset hardeningEnableMap[$flag] unset -v hardeningEnableMap["$flag"]
done done
if (( "${NIX_DEBUG:-0}" >= 1 )); then if (( "${NIX_DEBUG:-0}" >= 1 )); then
# Determine which flags were effectively disabled so we can report below. # Determine which flags were effectively disabled so we can report below.
allHardeningFlags=(pie relro bindnow) declare -a allHardeningFlags=(pie relro bindnow)
declare -A hardeningDisableMap=() declare -A hardeningDisableMap=()
for flag in ${allHardeningFlags[@]}; do for flag in "${allHardeningFlags[@]}"; do
if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
hardeningDisableMap[$flag]=1 hardeningDisableMap[$flag]=1
fi fi
@ -27,12 +27,12 @@ if (( "${NIX_DEBUG:-0}" >= 1 )); then
printf 'HARDENING: disabled flags:' >&2 printf 'HARDENING: disabled flags:' >&2
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2 (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
echo >&2 echo >&2
fi
if (( "${#hardeningEnableMap[@]}" )); then if (( "${#hardeningEnableMap[@]}" )); then
if (( "${NIX_DEBUG:-0}" >= 1 )); then
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2; echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
fi fi
fi
for flag in "${!hardeningEnableMap[@]}"; do for flag in "${!hardeningEnableMap[@]}"; do
case $flag in case $flag in
pie) pie)
@ -55,4 +55,3 @@ if (( "${#hardeningEnableMap[@]}" )); then
;; ;;
esac esac
done done
fi

13
pkgs/build-support/cc-wrapper/add-hardening.sh
View File

@ -1,4 +1,4 @@
hardeningCFlags=() declare -a hardeningCFlags=()
declare -A hardeningEnableMap=() declare -A hardeningEnableMap=()
@ -11,14 +11,14 @@ done
# Remove unsupported flags. # Remove unsupported flags.
for flag in @hardening_unsupported_flags@; do for flag in @hardening_unsupported_flags@; do
unset hardeningEnableMap[$flag] unset -v hardeningEnableMap["$flag"]
done done
if (( "${NIX_DEBUG:-0}" >= 1 )); then if (( "${NIX_DEBUG:-0}" >= 1 )); then
# Determine which flags were effectively disabled so we can report below. # Determine which flags were effectively disabled so we can report below.
allHardeningFlags=(fortify stackprotector pie pic strictoverflow format) declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format)
declare -A hardeningDisableMap=() declare -A hardeningDisableMap=()
for flag in ${allHardeningFlags[@]}; do for flag in "${allHardeningFlags[@]}"; do
if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
hardeningDisableMap[$flag]=1 hardeningDisableMap[$flag]=1
fi fi
@ -27,12 +27,12 @@ if (( "${NIX_DEBUG:-0}" >= 1 )); then
printf 'HARDENING: disabled flags:' >&2 printf 'HARDENING: disabled flags:' >&2
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2 (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
echo >&2 echo >&2
fi
if (( "${#hardeningEnableMap[@]}" )); then if (( "${#hardeningEnableMap[@]}" )); then
if (( "${NIX_DEBUG:-0}" >= 1 )); then
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2; echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
fi fi
fi
for flag in "${!hardeningEnableMap[@]}"; do for flag in "${!hardeningEnableMap[@]}"; do
case $flag in case $flag in
fortify) fortify)
@ -69,4 +69,3 @@ if (( "${#hardeningEnableMap[@]}" )); then
;; ;;
esac esac
done done
fi