Merge pull request #323608 from obsidiansystems/openbsd-static (279c439a) · Commits · nix / nixpkgs

doc/stdenv/stdenv.chapter.md

+5 −1

Original line number	Diff line number	Diff line
		@@ -1527,7 +1527,11 @@ The following flags are disabled by default and should be enabled with `hardenin

		#### `pie` {#pie}

		This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for `musl` based package builds.
		This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for

		- `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.

		- Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.

		Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.

+14 −10

Original line number	Diff line number	Diff line
		@@ -46,16 +46,20 @@
		"stackprotector"
		"strictoverflow"
		"zerocallusedregs"
		] ++ lib.optional (with stdenvNoCC;
		] ++ lib.optional (with stdenvNoCC; lib.any (x: x) [
		# OpenBSD static linking requires PIE
		(with targetPlatform; isOpenBSD && isStatic)
		(lib.all (x: x) [
		# Musl-based platforms will keep "pie", other platforms will not.
		# If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
		# in the nixpkgs manual to inform users about the defaults.
		targetPlatform.libc == "musl"
		(targetPlatform.libc == "musl")
		# Except when:
		# - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
		# - static armv7l, where compilation fails.
		&& !(targetPlatform.isAarch && targetPlatform.isStatic)
		) "pie"
		(!(targetPlatform.isAarch && targetPlatform.isStatic))
		])
		]) "pie"

		# Darwin code signing support utilities
		, postLinkSignHook ? null, signingUtils ? null

+10 −0

Original line number	Diff line number	Diff line
		{
		lib,
		mkDerivation,
		fetchpatch,
		bsdSetupHook,
		openbsdSetupHook,
		makeMinimal,
		@@ -11,6 +12,15 @@
		mkDerivation {
		noLibc = true;
		path = "lib/csu";
		patches = [
		# Support for a new NOBLIBSTATIC make variable
		(fetchpatch {
		name = "nolibstatic-support.patch";
		url = "https://marc.info/?l=openbsd-tech&m=171972639411562&q=raw";
		hash = "sha256-ZMegMq/A/SeFp8fofIyF0AA0IUo/11ZgKxg/UNT4z3E=";
		includes = [ "libexec/ld.so/*" ];
		})
		];
		nativeBuildInputs = [
		bsdSetupHook
		openbsdSetupHook

+7 −5

Original line number	Diff line number	Diff line
		@@ -2,6 +2,7 @@
		lib,
		crossLibcStdenv,
		mkDerivation,
		fetchpatch,
		bsdSetupHook,
		openbsdSetupHook,
		makeMinimal,
		@@ -9,13 +10,11 @@
		flex,
		byacc,
		gencat,
		lorder,
		tsort,
		rpcgen,
		csu,
		include,
		ctags,
		tsort,
		llvmPackages,
		fetchpatch,
		}:

		mkDerivation {
		@@ -35,9 +34,11 @@ mkDerivation {
		patches = [
		./netbsd-make-to-lower.patch
		./disable-librebuild.patch
		# Do not produce ctags, can do that separately.
		(fetchpatch {
		name = "skip-tags.patch";
		url = "https://marc.info/?l=openbsd-tech&m=171575286706032&q=raw";
		sha256 = "sha256-2fqabJZLUvXUIWe5WZ4NrTOwgQCXqH49Wo0hAPu5lu0=";
		hash = "sha256-2fqabJZLUvXUIWe5WZ4NrTOwgQCXqH49Wo0hAPu5lu0=";
		})
		];

		@@ -47,6 +48,7 @@ mkDerivation {
		makeMinimal
		install
		tsort
		lorder
		gencat
		];

+10 −1

Original line number	Diff line number	Diff line
		@@ -14,11 +14,20 @@ mkDerivation {
		dontBuild = true;

		patches = [
		# Use `$AR` not hardcoded `ar`
		(fetchpatch {
		name = "use-ar-variable.patch";
		url = "https://marc.info/?l=openbsd-tech&m=171575284906018&q=raw";
		sha256 = "sha256-bigxJGbaf9mCmFXxLVzQpnUUaEMMDfF3eZkTXVzd6B8=";
		hash = "sha256-bigxJGbaf9mCmFXxLVzQpnUUaEMMDfF3eZkTXVzd6B8=";
		})
		./netbsd-make-sinclude.patch
		# Support for a new NOBLIBSTATIC make variable
		(fetchpatch {
		name = "nolibstatic-support.patch";
		url = "https://marc.info/?l=openbsd-tech&m=171972639411562&q=raw";
		hash = "sha256-p4izV6ZXkfgJud+ZZU1Wqr5qFuHUzE6qVXM7QnXvV3k=";
		includes = [ "share/mk/*" ];
		})
		];

		postPatch = ''