Revert "Merge pull request #28029 from cstrahan/hardening-fix"

This reverts commit 0dbc006760, reversing
changes made to cb7f774265.

Should go into staging.

pkgs/build-support/bintools-wrapper/add-flags.sh

@@ -5,7 +5,6 @@ var_templates_list=(
     NIX+LDFLAGS_BEFORE
     NIX+LDFLAGS_AFTER
     NIX+LDFLAGS_HARDEN
-    NIX+HARDENING_ENABLE
 )
 var_templates_bool=(
     NIX+SET_BUILD_ID
@@ -24,10 +23,10 @@ if [ "${NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then
 fi
 
 for var in "${var_templates_list[@]}"; do
-    mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"}
+    mangleVarList "$var" "${role_infixes[@]}"
 done
 for var in "${var_templates_bool[@]}"; do
-    mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"}
+    mangleVarBool "$var" "${role_infixes[@]}"
 done
 
 if [ -e @out@/nix-support/libc-ldflags ]; then

pkgs/build-support/bintools-wrapper/add-hardening.sh

@@ -1,58 +1,53 @@
-declare -a hardeningLDFlags=()
+hardeningFlags=(relro bindnow)
+# Intentionally word-split in case 'hardeningEnable' is defined in
+# Nix. Also, our bootstrap tools version of bash is old enough that
+# undefined arrays trip `set -u`.
+if [[ -v hardeningEnable[@] ]]; then
+  hardeningFlags+=(${hardeningEnable[@]})
+fi
+hardeningLDFlags=()
 
-declare -A hardeningEnableMap=()
+declare -A hardeningDisableMap
 
-# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
+# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
-# array expansion also prevents undefined variables from causing trouble with
+for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
-# `set -u`.
+do
-for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
+  hardeningDisableMap[$flag]=1
-  hardeningEnableMap["$flag"]=1
-done
-
-# Remove unsupported flags.
-for flag in @hardening_unsupported_flags@; do
-  unset -v hardeningEnableMap["$flag"]
 done
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(pie relro bindnow)
-  declare -A hardeningDisableMap=()
-
-  # Determine which flags were effectively disabled so we can report below.
-  for flag in "${allHardeningFlags[@]}"; do
-    if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
-      hardeningDisableMap[$flag]=1
-    fi
-  done
-
   printf 'HARDENING: disabled flags:' >&2
   (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
   echo >&2
-
-  if (( "${#hardeningEnableMap[@]}" )); then
-    echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
-  fi
 fi
 
-for flag in "${!hardeningEnableMap[@]}"; do
+if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
-  case $flag in
+  if (( "${NIX_DEBUG:-0}" >= 1 )); then
-    pie)
+    echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
-      if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
+  fi
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
+  for flag in "${hardeningFlags[@]}"
-        hardeningLDFlags+=('-pie')
+  do
-      fi
+    if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
-      ;;
+      case $flag in
-    relro)
+        pie)
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
+          if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
-      hardeningLDFlags+=('-z' 'relro')
+            if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-      ;;
+            hardeningLDFlags+=('-pie')
-    bindnow)
+          fi
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi
+          ;;
-      hardeningLDFlags+=('-z' 'now')
+        relro)
-      ;;
+          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
-    *)
+          hardeningLDFlags+=('-z' 'relro')
-      # Ignore unsupported. Checked in Nix that at least *some*
+          ;;
-      # tool supports each flag.
+        bindnow)
-      ;;
+          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi
-  esac
+          hardeningLDFlags+=('-z' 'now')
-done
+          ;;
+        *)
+          # Ignore unsupported. Checked in Nix that at least *some*
+          # tool supports each flag.
+          ;;
+      esac
+    fi
+  done
+fi

pkgs/build-support/bintools-wrapper/ld-wrapper.sh

@@ -57,8 +57,8 @@ fi
 
 source @out@/nix-support/add-hardening.sh
 
-extraAfter=()
+extraAfter=("${hardeningLDFlags[@]}")
-extraBefore=(${hardeningLDFlags[@]+"${hardeningLDFlags[@]}"})
+extraBefore=()
 
 if [ -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ]; then
     extraAfter+=($NIX_@infixSalt@_LDFLAGS)

pkgs/build-support/bintools-wrapper/setup-hook.sh

@@ -83,10 +83,6 @@ do
     fi
 done
 
-# If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
-export NIX_HARDENING_ENABLE
-
 # No local scope in sourced file
 unset -v role_pre role_post cmd upper_case
 set +u

pkgs/build-support/cc-wrapper/add-flags.sh

@@ -30,10 +30,10 @@ fi
 # We need to mangle names for hygiene, but also take parameters/overrides
 # from the environment.
 for var in "${var_templates_list[@]}"; do
-    mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"}
+    mangleVarList "$var" "${role_infixes[@]}"
 done
 for var in "${var_templates_bool[@]}"; do
-    mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"}
+    mangleVarBool "$var" "${role_infixes[@]}"
 done
 
 # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -1,72 +1,67 @@
-declare -a hardeningCFlags=()
+hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
+# Intentionally word-split in case 'hardeningEnable' is defined in
+# Nix. Also, our bootstrap tools version of bash is old enough that
+# undefined arrays trip `set -u`.
+if [[ -v hardeningEnable[@] ]]; then
+  hardeningFlags+=(${hardeningEnable[@]})
+fi
+hardeningCFlags=()
 
-declare -A hardeningEnableMap=()
+declare -A hardeningDisableMap
 
-# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
+# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
-# array expansion also prevents undefined variables from causing trouble with
+for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
-# `set -u`.
+do
-for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
+  hardeningDisableMap[$flag]=1
-  hardeningEnableMap["$flag"]=1
-done
-
-# Remove unsupported flags.
-for flag in @hardening_unsupported_flags@; do
-  unset -v hardeningEnableMap["$flag"]
 done
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format)
-  declare -A hardeningDisableMap=()
-
-  # Determine which flags were effectively disabled so we can report below.
-  for flag in "${allHardeningFlags[@]}"; do
-    if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
-      hardeningDisableMap["$flag"]=1
-    fi
-  done
-
   printf 'HARDENING: disabled flags:' >&2
   (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
   echo >&2
-
-  if (( "${#hardeningEnableMap[@]}" )); then
-    echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
-  fi
 fi
 
-for flag in "${!hardeningEnableMap[@]}"; do
+if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
-  case $flag in
+  if (( "${NIX_DEBUG:-0}" >= 1 )); then
-    fortify)
+    echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
+  fi
-      hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
+  for flag in "${hardeningFlags[@]}"
-      ;;
+  do
-    stackprotector)
+    if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
+      case $flag in
-      hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
+        fortify)
-      ;;
+          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
-    pie)
+          hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
+          ;;
-      hardeningCFlags+=('-fPIE')
+        stackprotector)
-      if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
+          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
+          hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
-        hardeningCFlags+=('-pie')
+          ;;
-      fi
+        pie)
-      ;;
+          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
-    pic)
+          hardeningCFlags+=('-fPIE')
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
+          if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
-      hardeningCFlags+=('-fPIC')
+            if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-      ;;
+            hardeningCFlags+=('-pie')
-    strictoverflow)
+          fi
-       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
+          ;;
-      hardeningCFlags+=('-fno-strict-overflow')
+        pic)
-      ;;
+          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
-    format)
+          hardeningCFlags+=('-fPIC')
-      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
+          ;;
-      hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
+        strictoverflow)
-      ;;
+          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
-    *)
+          hardeningCFlags+=('-fno-strict-overflow')
-      # Ignore unsupported. Checked in Nix that at least *some*
+          ;;
-      # tool supports each flag.
+        format)
-      ;;
+          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
-  esac
+          hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
-done
+          ;;
+        *)
+          # Ignore unsupported. Checked in Nix that at least *some*
+          # tool supports each flag.
+          ;;
+      esac
+    fi
+  done
+fi

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -134,8 +134,8 @@ fi
 source @out@/nix-support/add-hardening.sh
 
 # Add the flags for the C compiler proper.
-extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE)
+extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE "${hardeningCFlags[@]}")
-extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"})
+extraBefore=()
 
 if [ "$dontLink" != 1 ]; then
 

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -147,10 +147,6 @@ export ${role_pre}CXX=@named_cxx@
 export CC${role_post}=@named_cc@
 export CXX${role_post}=@named_cxx@
 
-# If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
-export NIX_HARDENING_ENABLE
-
 # No local scope in sourced file
 unset -v role_pre role_post
 set +u

pkgs/stdenv/generic/make-derivation.nix

@@ -74,11 +74,6 @@ rec {
     # TODO(@Ericson2314): Make this more modular, and not O(n^2).
     let
       supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
-      defaultHardeningFlags = lib.remove "pie" supportedHardeningFlags;
-      enabledHardeningOptions =
-        if builtins.elem "all" hardeningDisable
-        then []
-        else lib.subtractLists hardeningDisable (defaultHardeningFlags ++ hardeningEnable);
       # hardeningDisable additionally supports "all".
       erroneousHardeningFlags = lib.subtractLists supportedHardeningFlags (hardeningEnable ++ lib.remove "all" hardeningDisable);
     in if builtins.length erroneousHardeningFlags != 0
@@ -184,8 +179,6 @@ rec {
             ++ optional (elem "host"   configurePlatforms) "--host=${stdenv.hostPlatform.config}"
             ++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
 
-        } // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != []) {
-          NIX_HARDENING_ENABLE = enabledHardeningOptions;
         } // lib.optionalAttrs (stdenv.buildPlatform.isDarwin) {
           # TODO: remove lib.unique once nix has a list canonicalization primitive
           __sandboxProfile =