Commit 676df1cf authored by John Ericson's avatar John Ericson
Browse files

openbsd: Add static linking support 

I've had better luck creating statically-linked binaries that work than
dynamically-linked ones, so this is needed quite practically.
parent b178ec77

doc/stdenv/stdenv.chapter.md

+5 −1
Original line number Diff line number Diff line
@@ -1521,7 +1521,11 @@ The following flags are disabled by default and should be enabled with `hardenin 


#### `pie` {#pie}



This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for `musl` based package builds.

This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for



  - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.



  - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.



Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.

pkgs/build-support/bintools-wrapper/default.nix

+14 −10
Original line number Diff line number Diff line
@@ -45,16 +45,20 @@ 
    "relro"

    "stackprotector"

    "strictoverflow"

  ] ++ lib.optional (with stdenvNoCC;

  ] ++ lib.optional (with stdenvNoCC; lib.any (x: x) [

    # OpenBSD static linking requires PIE

    (with targetPlatform; isOpenBSD && isStatic)

    (lib.all (x: x) [

      # Musl-based platforms will keep "pie", other platforms will not.

      # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`

      # in the nixpkgs manual to inform users about the defaults.

    targetPlatform.libc == "musl"

      (targetPlatform.libc == "musl")

      # Except when:

      #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.

      #    - static armv7l, where compilation fails.

    && !(targetPlatform.isAarch && targetPlatform.isStatic)

  ) "pie"

      (!(targetPlatform.isAarch && targetPlatform.isStatic))

    ])

  ]) "pie"



# Darwin code signing support utilities

, postLinkSignHook ? null, signingUtils ? null

pkgs/os-specific/bsd/openbsd/pkgs/csu.nix

+10 −0
Original line number Diff line number Diff line 
{

  lib,

  mkDerivation,

  fetchpatch,

  bsdSetupHook,

  openbsdSetupHook,

  makeMinimal,
@@ -11,6 +12,15 @@ 
mkDerivation {

  noLibc = true;

  path = "lib/csu";

  patches = [

    # Support for a new NOBLIBSTATIC make variable

    (fetchpatch {

      name = "nolibstatic-support.patch";

      url = "https://marc.info/?l=openbsd-tech&m=171972639411562&q=raw";

      hash = "sha256-ZMegMq/A/SeFp8fofIyF0AA0IUo/11ZgKxg/UNT4z3E=";

      includes = [ "libexec/ld.so/*" ];

    })

  ];

  nativeBuildInputs = [

    bsdSetupHook

    openbsdSetupHook

pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix

+7 −5
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
  lib,

  crossLibcStdenv,

  mkDerivation,

  fetchpatch,

  bsdSetupHook,

  openbsdSetupHook,

  makeMinimal,
@@ -9,13 +10,11 @@ 
  flex,

  byacc,

  gencat,

  lorder,

  tsort,

  rpcgen,

  csu,

  include,

  ctags,

  tsort,

  llvmPackages,

  fetchpatch,

}:



mkDerivation {
@@ -35,9 +34,11 @@ mkDerivation { 
  patches = [

    ./netbsd-make-to-lower.patch

    ./disable-librebuild.patch

    # Do not produce ctags, can do that separately.

    (fetchpatch {

      name = "skip-tags.patch";

      url = "https://marc.info/?l=openbsd-tech&m=171575286706032&q=raw";

      sha256 = "sha256-2fqabJZLUvXUIWe5WZ4NrTOwgQCXqH49Wo0hAPu5lu0=";

      hash = "sha256-2fqabJZLUvXUIWe5WZ4NrTOwgQCXqH49Wo0hAPu5lu0=";

    })

  ];
@@ -47,6 +48,7 @@ mkDerivation { 
    makeMinimal

    install

    tsort

    lorder

    gencat

  ];

pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix

+10 −1
Original line number Diff line number Diff line
@@ -14,11 +14,20 @@ mkDerivation { 
  dontBuild = true;



  patches = [

    # Use `$AR` not hardcoded `ar`

    (fetchpatch {

      name = "use-ar-variable.patch";

      url = "https://marc.info/?l=openbsd-tech&m=171575284906018&q=raw";

      sha256 = "sha256-bigxJGbaf9mCmFXxLVzQpnUUaEMMDfF3eZkTXVzd6B8=";

      hash = "sha256-bigxJGbaf9mCmFXxLVzQpnUUaEMMDfF3eZkTXVzd6B8=";

    })

    ./netbsd-make-sinclude.patch

    # Support for a new NOBLIBSTATIC make variable

    (fetchpatch {

      name = "nolibstatic-support.patch";

      url = "https://marc.info/?l=openbsd-tech&m=171972639411562&q=raw";

      hash = "sha256-p4izV6ZXkfgJud+ZZU1Wqr5qFuHUzE6qVXM7QnXvV3k=";

      includes = [ "share/mk/*" ];

    })

  ];



  postPatch = ''