public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nginx: Rmove custom hardening, now enabled by default

Browse Source
This commit is contained in:
Franz Pletz 2016-03-08 00:39:07 +01:00
parent e9fc4e7db6
commit fedf31660d
2 changed files with 4 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkgs/servers/http/nginx/default.nix
View File

@ -54,14 +54,7 @@ stdenv.mkDerivation rec {
NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations -Wno-error=conditional-uninitialized"; NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations -Wno-error=conditional-uninitialized";
preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules) preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
+ optionalString (hardening && (stdenv.cc.cc.isGNU or false)) ''
configureFlagsArray=(
--with-cc-opt="-fPIE -fstack-protector-all --param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2"
--with-ld-opt="-pie -Wl,-z,relro,-z,now"
)
''
;
hardeningEnable = [ "pie" ]; hardeningEnable = [ "pie" ];

11
pkgs/servers/http/nginx/unstable.nix
View File

@ -52,14 +52,9 @@ stdenv.mkDerivation rec {
NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations"; NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules) preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
+ optionalString (hardening && (stdenv.cc.cc.isGNU or false)) ''
configureFlagsArray=( hardeningEnable = [ "pie" ];
--with-cc-opt="-fPIE -fstack-protector-all --param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2"
--with-ld-opt="-pie -Wl,-z,relro,-z,now"
)
''
;
postInstall = '' postInstall = ''
mv $out/sbin $out/bin mv $out/sbin $out/bin