treewide: disable pie in more places

Some packages don’t work correctly with pie. Here I disable it for:

- busybox
- linux kernel
- kexectools

I also get rid of the Musl conditional for disabling pie in GCC and
Binutils. Some day we might want to enable PIE without Musl and it
will be useful to have the *just* work with our compiler and linkers.
This commit is contained in:
Matthew Bauer
2018-11-10 13:49:36 -06:00
parent 08d98b2e38
commit 76c956be5c
11 changed files with 12 additions and 11 deletions

View File

@@ -42,7 +42,8 @@ stdenv.mkDerivation rec {
sha256 = "1dzg45vgy2w1xcd3p6h8d76ykhabbvk1h0lf8yb24ikrwlv8cr4p";
};
hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
hardeningDisable = [ "format" "pie" ]
++ lib.optionals enableStatic [ "fortify" ];
patches = [
./busybox-in-store.patch

View File

@@ -269,7 +269,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.platform kernelPatches
++ optionals stdenv.lib.inNixShell [ pkgconfig ncurses ]
;
hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" ];
hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
# Absolute paths for compilers avoid any PATH-clobbering issues.
makeFlags = commonMakeFlags ++ [

View File

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
sha256 = "1ac20jws8iys9w6dpn4q3hihyx73zkabdwv3gcb779cxfrmq2k2h";
};
hardeningDisable = [ "format" "pic" "relro" ];
hardeningDisable = [ "format" "pic" "relro" "pie" ];
configureFlags = [ "BUILD_CC=${buildPackages.stdenv.cc.targetPrefix}cc" ];
nativeBuildInputs = [ buildPackages.stdenv.cc ];