pytrainer: unpin python 3.10
[NixPkgs.git] / pkgs / build-support / cc-wrapper / add-hardening.sh
blob4440d99ccabafe4282f6978e858ffd55745e5794
1 declare -a hardeningCFlagsAfter=()
2 declare -a hardeningCFlagsBefore=()
4 declare -A hardeningEnableMap=()
6 # Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
7 # array expansion also prevents undefined variables from causing trouble with
8 # `set -u`.
9 for flag in ${NIX_HARDENING_ENABLE_@suffixSalt@-}; do
10 hardeningEnableMap["$flag"]=1
11 done
13 # fortify3 implies fortify enablement - make explicit before
14 # we filter unsupported flags because unsupporting fortify3
15 # doesn't mean we should unsupport fortify too
16 if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
17 hardeningEnableMap["fortify"]=1
20 # Remove unsupported flags.
21 for flag in @hardening_unsupported_flags@; do
22 unset -v "hardeningEnableMap[$flag]"
23 # fortify being unsupported implies fortify3 is unsupported
24 if [[ "$flag" = 'fortify' ]] ; then
25 unset -v "hardeningEnableMap['fortify3']"
27 done
29 # now make fortify and fortify3 mutually exclusive
30 if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
31 unset -v "hardeningEnableMap['fortify']"
34 if (( "${NIX_DEBUG:-0}" >= 1 )); then
35 declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection pacret pie pic strictoverflow format trivialautovarinit zerocallusedregs)
36 declare -A hardeningDisableMap=()
38 # Determine which flags were effectively disabled so we can report below.
39 for flag in "${allHardeningFlags[@]}"; do
40 if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
41 hardeningDisableMap["$flag"]=1
43 done
45 printf 'HARDENING: disabled flags:' >&2
46 (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
47 echo >&2
49 if (( "${#hardeningEnableMap[@]}" )); then
50 echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
54 for flag in "${!hardeningEnableMap[@]}"; do
55 case $flag in
56 fortify | fortify3)
57 # Use -U_FORTIFY_SOURCE to avoid warnings on toolchains that explicitly
58 # set -D_FORTIFY_SOURCE=0 (like 'clang -fsanitize=address').
59 hardeningCFlagsBefore+=('-O2' '-U_FORTIFY_SOURCE')
60 # Unset any _FORTIFY_SOURCE values the command-line may have set before
61 # enforcing our own value, avoiding (potentially fatal) redefinition
62 # warnings
63 hardeningCFlagsAfter+=('-U_FORTIFY_SOURCE')
64 case $flag in
65 fortify)
66 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
67 hardeningCFlagsAfter+=('-D_FORTIFY_SOURCE=2')
69 fortify3)
70 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify3 >&2; fi
71 hardeningCFlagsAfter+=('-D_FORTIFY_SOURCE=3')
74 # Ignore unsupported.
76 esac
78 shadowstack)
79 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling shadowstack >&2; fi
80 hardeningCFlagsBefore+=('-fcf-protection=return')
82 pacret)
83 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pacret >&2; fi
84 hardeningCFlagsBefore+=('-mbranch-protection=pac-ret')
86 stackprotector)
87 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
88 hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
90 stackclashprotection)
91 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stack-clash-protection >&2; fi
92 hardeningCFlagsBefore+=('-fstack-clash-protection')
94 pie)
95 # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
96 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
97 hardeningCFlagsBefore=('-fPIE' "${hardeningCFlagsBefore[@]}")
98 if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
99 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
100 hardeningCFlagsBefore=('-pie' "${hardeningCFlagsBefore[@]}")
103 pic)
104 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
105 hardeningCFlagsBefore+=('-fPIC')
107 strictoverflow)
108 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
109 if (( @isClang@ )); then
110 # In Clang, -fno-strict-overflow only serves to set -fwrapv and is
111 # reported as an unused CLI argument if -fwrapv or -fno-wrapv is set
112 # explicitly, so we side step that by doing the conversion here.
114 # See: https://github.com/llvm/llvm-project/blob/llvmorg-16.0.6/clang/lib/Driver/ToolChains/Clang.cpp#L6315
116 hardeningCFlagsBefore+=('-fwrapv')
117 else
118 hardeningCFlagsBefore+=('-fno-strict-overflow')
121 trivialautovarinit)
122 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling trivialautovarinit >&2; fi
123 hardeningCFlagsBefore+=('-ftrivial-auto-var-init=pattern')
125 format)
126 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
127 hardeningCFlagsBefore+=('-Wformat' '-Wformat-security' '-Werror=format-security')
129 zerocallusedregs)
130 if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling zerocallusedregs >&2; fi
131 hardeningCFlagsBefore+=('-fzero-call-used-regs=used-gpr')
134 # Ignore unsupported. Checked in Nix that at least *some*
135 # tool supports each flag.
137 esac
138 done