Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
31 kB · 1112 lines
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113{ lib, stdenv, runCommand, runCommandWith, runCommandCC, bintools, hello, debian-devscripts,}:
let # writeCBin from trivial-builders won't let us choose # our own stdenv writeCBinWithStdenv = codePath: stdenv': env: runCommandWith { name = "test-bin"; stdenv = stdenv'; derivationArgs = { inherit codePath; preferLocalBuild = true; allowSubstitutes = false; } // env; } '' [ -n "$postConfigure" ] && eval "$postConfigure" [ -n "$preBuild" ] && eval "$preBuild" n=$out/bin/test-bin mkdir -p "$(dirname "$n")" cp "$codePath" code.c NIX_DEBUG=1 $CC -x c code.c -O1 $TEST_EXTRA_FLAGS -o "$n" '';
f1exampleWithStdEnv = writeCBinWithStdenv ./fortify1-example.c; f2exampleWithStdEnv = writeCBinWithStdenv ./fortify2-example.c; f3exampleWithStdEnv = writeCBinWithStdenv ./fortify3-example.c;
flexArrF2ExampleWithStdEnv = writeCBinWithStdenv ./flex-arrays-fortify-example.c;
# for when we need a slightly more complicated program helloWithStdEnv = stdenv': env: (hello.override { stdenv = stdenv'; }).overrideAttrs ( { preBuild = '' export CFLAGS="$TEST_EXTRA_FLAGS" ''; NIX_DEBUG = "1"; postFixup = '' cp $out/bin/hello $out/bin/test-bin ''; } // env );
stdenvUnsupport = additionalUnsupported: stdenv.override { cc = stdenv.cc.override { cc = ( lib.extendDerivation true rec { # this is ugly - have to cross-reference from # hardeningUnsupportedFlagsByTargetPlatform to hardeningUnsupportedFlags # because the finalAttrs mechanism that hardeningUnsupportedFlagsByTargetPlatform # implementations use to do this won't work with lib.extendDerivation. # but it's simplified by the fact that targetPlatform is already fixed # at this point. hardeningUnsupportedFlagsByTargetPlatform = _: hardeningUnsupportedFlags; hardeningUnsupportedFlags = ( if stdenv.cc.cc ? hardeningUnsupportedFlagsByTargetPlatform then stdenv.cc.cc.hardeningUnsupportedFlagsByTargetPlatform stdenv.targetPlatform else (stdenv.cc.cc.hardeningUnsupportedFlags or [ ]) ) ++ additionalUnsupported; } stdenv.cc.cc ); }; allowedRequisites = null; };
checkTestBin = testBin: { # can only test flags that are detectable by hardening-check ignoreBindNow ? true, ignoreFortify ? true, ignorePie ? true, ignoreRelRO ? true, ignoreStackProtector ? true, ignoreStackClashProtection ? true, expectFailure ? false, }: let stackClashStr = "Stack clash protection: yes"; expectFailureClause = lib.optionalString expectFailure " && echo 'ERROR: Expected hardening-check to fail, but it passed!' >&2 && false"; in runCommandCC "check-test-bin" { nativeBuildInputs = [ debian-devscripts ]; buildInputs = [ testBin ]; meta = { platforms = if ignoreStackClashProtection then lib.platforms.linux # ELF-reliant else [ "x86_64-linux" ]; # stackclashprotection test looks for x86-specific instructions # musl implementation of fortify undetectable by this means even if present, # static similarly broken = (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isStatic) && !ignoreFortify; }; } ( '' if ${lib.optionalString (!expectFailure) "!"} { hardening-check --nocfprotection --nobranchprotection \ ${lib.optionalString ignoreBindNow "--nobindnow"} \ ${lib.optionalString ignoreFortify "--nofortify"} \ ${lib.optionalString ignorePie "--nopie"} \ ${lib.optionalString ignoreRelRO "--norelro"} \ ${lib.optionalString ignoreStackProtector "--nostackprotector"} \ $(PATH=$HOST_PATH type -P test-bin) | tee $out '' + lib.optionalString (!ignoreStackClashProtection) '' # stack clash protection doesn't actually affect the exit code of # hardening-check (likely authors think false negatives too common) { grep -F '${stackClashStr}' $out || { echo "Didn't find '${stackClashStr}' in output" && false ;} ;} '' + '' } ; then '' + lib.optionalString expectFailure '' echo 'ERROR: Expected hardening-check to fail, but it passed!' >&2 '' + '' exit 2 fi '' );
nameDrvAfterAttrName = builtins.mapAttrs ( name: drv: drv.overrideAttrs (_: { name = "test-${name}"; }) );
fortifyExecTest = fortifyExecTestFull true "012345 7" "0123456 7";
# returning a specific exit code when aborting due to a fortify # check isn't mandated. so it's better to just ensure that a # nonzero exit code is returned when we go a single byte beyond # the buffer, with the example programs being designed to be # unlikely to genuinely segfault for such a small overflow. fortifyExecTestFull = expectProtection: saturatedArgs: oneTooFarArgs: testBin: runCommand "exec-test" { buildInputs = [ testBin ]; meta.broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform); } '' ( export PATH=$HOST_PATH echo "Saturated buffer:" # check program isn't completly broken test-bin ${saturatedArgs} echo "One byte too far:" # overflow byte being the null terminator? ( ${if expectProtection then "!" else ""} test-bin ${oneTooFarArgs} ) || ( echo 'Expected ${if expectProtection then "failure" else "success"}, but ${ if expectProtection then "succeeded" else "failed" }!' && exit 1 ) ) echo "Expected behaviour observed" touch $out '';
brokenIf = cond: drv: if cond then drv.overrideAttrs (old: { meta = old.meta or { } // { broken = true; }; }) else drv; overridePlatforms = platforms: drv: drv.overrideAttrs (old: { meta = old.meta or { } // { inherit platforms; }; });
instructionPresenceTest = label: mnemonicPattern: testBin: expectFailure: runCommand "${label}-instr-test" { nativeBuildInputs = [ bintools ]; buildInputs = [ testBin ]; } '' touch $out if $OBJDUMP -d \ --no-addresses \ --no-show-raw-insn \ "$(PATH=$HOST_PATH type -P test-bin)" \ | grep -E '${mnemonicPattern}' > /dev/null ; then echo "Found ${label} instructions" >&2 ${lib.optionalString expectFailure "exit 1"} else echo "Did not find ${label} instructions" >&2 ${lib.optionalString (!expectFailure) "exit 1"} fi '';
pacRetTest = testBin: expectFailure: overridePlatforms [ "aarch64-linux" ] ( instructionPresenceTest "pacret" "\\bpaciasp\\b" testBin expectFailure );
elfNoteTest = label: pattern: testBin: expectFailure: runCommand "${label}-elf-note-test" { nativeBuildInputs = [ bintools ]; buildInputs = [ testBin ]; } '' touch $out if $READELF -n "$(PATH=$HOST_PATH type -P test-bin)" \ | grep -E '${pattern}' > /dev/null ; then echo "Found ${label} note" >&2 ${lib.optionalString expectFailure "exit 1"} else echo "Did not find ${label} note" >&2 ${lib.optionalString (!expectFailure) "exit 1"} fi '';
shadowStackTest = testBin: expectFailure: brokenIf stdenv.hostPlatform.isMusl ( overridePlatforms [ "x86_64-linux" ] (elfNoteTest "shadowstack" "\\bSHSTK\\b" testBin expectFailure) );
innameDrvAfterAttrName ( { bindNowExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic ( checkTestBin (f2exampleWithStdEnv stdenv { hardeningEnable = [ "bindnow" ]; }) { ignoreBindNow = false; } );
fortifyExplicitEnabled = ( checkTestBin (f2exampleWithStdEnv stdenv { hardeningEnable = [ "fortify" ]; }) { ignoreFortify = false; } );
fortify1ExplicitEnabledExecTest = fortifyExecTest ( f1exampleWithStdEnv stdenv { hardeningEnable = [ "fortify" ]; } );
# musl implementation is effectively FORTIFY_SOURCE=1-only, fortifyExplicitEnabledExecTest = brokenIf stdenv.hostPlatform.isMusl ( fortifyExecTest ( f2exampleWithStdEnv stdenv { hardeningEnable = [ "fortify" ]; } ) );
fortify3ExplicitEnabled = brokenIf (!stdenv.cc.isGNU || lib.versionOlder stdenv.cc.version "12") ( checkTestBin (f3exampleWithStdEnv stdenv { hardeningEnable = [ "fortify3" ]; }) { ignoreFortify = false; } );
# musl implementation is effectively FORTIFY_SOURCE=1-only fortify3ExplicitEnabledExecTest = brokenIf (stdenv.hostPlatform.isMusl || !stdenv.cc.isGNU || lib.versionOlder stdenv.cc.version "12") ( fortifyExecTest ( f3exampleWithStdEnv stdenv { hardeningEnable = [ "fortify3" ]; } ) );
sfa1explicitEnabled = checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; }) { ignoreFortify = false; };
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa1explicitEnabledExecTest = brokenIf stdenv.hostPlatform.isMusl ( fortifyExecTestFull true "012345" "0123456" ( flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; } ) );
sfa1explicitEnabledDoesntProtectDefLen1 = checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; }) { ignoreFortify = false; expectFailure = true; };
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa1explicitEnabledDoesntProtectDefLen1ExecTest = brokenIf stdenv.hostPlatform.isMusl ( fortifyExecTestFull false "''" "0" ( flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; } ) );
sfa3explicitEnabledProtectsDefLen1 = checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays3" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; }) { ignoreFortify = false; };
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa3explicitEnabledProtectsDefLen1ExecTest = brokenIf stdenv.hostPlatform.isMusl ( fortifyExecTestFull true "''" "0" ( flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays3" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; } ) );
sfa3explicitEnabledDoesntProtectCorrectFlex = checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays3" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE="; }; }) { ignoreFortify = false; expectFailure = true; };
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa3explicitEnabledDoesntProtectCorrectFlexExecTest = brokenIf stdenv.hostPlatform.isMusl ( fortifyExecTestFull false "" "0" ( flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays3" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE="; }; } ) );
pieExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic ( checkTestBin (f2exampleWithStdEnv stdenv { hardeningEnable = [ "pie" ]; }) { ignorePie = false; } );
pieExplicitEnabledStructuredAttrs = brokenIf stdenv.hostPlatform.isStatic ( checkTestBin (f2exampleWithStdEnv stdenv { hardeningEnable = [ "pie" ]; __structuredAttrs = true; }) { ignorePie = false; } );
relROExplicitEnabled = checkTestBin (f2exampleWithStdEnv stdenv { hardeningEnable = [ "relro" ]; }) { ignoreRelRO = false; };
stackProtectorExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic ( checkTestBin (f2exampleWithStdEnv stdenv { hardeningEnable = [ "stackprotector" ]; }) { ignoreStackProtector = false; } );
# protection patterns generated by clang not detectable? stackClashProtectionExplicitEnabled = brokenIf stdenv.cc.isClang ( checkTestBin (helloWithStdEnv stdenv { hardeningEnable = [ "stackclashprotection" ]; }) { ignoreStackClashProtection = false; } );
pacRetExplicitEnabled = pacRetTest (helloWithStdEnv stdenv { hardeningEnable = [ "pacret" ]; }) false;
shadowStackExplicitEnabled = shadowStackTest (f1exampleWithStdEnv stdenv { hardeningEnable = [ "shadowstack" ]; }) false;
bindNowExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv { hardeningDisable = [ "bindnow" ]; }) { ignoreBindNow = false; expectFailure = true; };
fortifyExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv { hardeningDisable = [ "fortify" ]; }) { ignoreFortify = false; expectFailure = true; };
fortify3ExplicitDisabled = checkTestBin (f3exampleWithStdEnv stdenv { hardeningDisable = [ "fortify3" ]; }) { ignoreFortify = false; expectFailure = true; };
fortifyExplicitDisabledDisablesFortify3 = checkTestBin (f3exampleWithStdEnv stdenv { hardeningEnable = [ "fortify3" ]; hardeningDisable = [ "fortify" ]; }) { ignoreFortify = false; expectFailure = true; };
fortify3ExplicitDisabledDoesntDisableFortify = checkTestBin (f2exampleWithStdEnv stdenv { hardeningEnable = [ "fortify" ]; hardeningDisable = [ "fortify3" ]; }) { ignoreFortify = false; };
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa1explicitDisabled = brokenIf stdenv.hostPlatform.isMusl ( checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" ]; hardeningDisable = [ "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; }) { ignoreFortify = false; expectFailure = true; } );
sfa1explicitDisabledExecTest = fortifyExecTestFull false "012345" "0123456" ( flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" ]; hardeningDisable = [ "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; } );
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa1explicitDisabledDisablesSfa3 = brokenIf stdenv.hostPlatform.isMusl ( checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays3" ]; hardeningDisable = [ "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; }) { ignoreFortify = false; expectFailure = true; } );
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa1explicitDisabledDisablesSfa3ExecTest = brokenIf stdenv.hostPlatform.isMusl ( fortifyExecTestFull false "''" "0" ( flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays3" ]; hardeningDisable = [ "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; } ) );
sfa3explicitDisabledDoesntDisableSfa1 = checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays1" ]; hardeningDisable = [ "strictflexarrays3" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; }) { ignoreFortify = false; };
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa3explicitDisabledDoesntDisableSfa1ExecTest = brokenIf stdenv.hostPlatform.isMusl ( fortifyExecTestFull true "012345" "0123456" ( flexArrF2ExampleWithStdEnv stdenv { hardeningEnable = [ "fortify" "strictflexarrays1" ]; hardeningDisable = [ "strictflexarrays3" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; } ) );
pieExplicitDisabled = brokenIf (stdenv.hostPlatform.isMusl && stdenv.cc.isClang) ( checkTestBin (f2exampleWithStdEnv stdenv { hardeningDisable = [ "pie" ]; }) { ignorePie = false; expectFailure = true; } );
# can't force-disable ("partial"?) relro relROExplicitDisabled = brokenIf true ( checkTestBin (f2exampleWithStdEnv stdenv { hardeningDisable = [ "pie" ]; }) { ignoreRelRO = false; expectFailure = true; } );
stackProtectorExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv { hardeningDisable = [ "stackprotector" ]; }) { ignoreStackProtector = false; expectFailure = true; };
stackClashProtectionExplicitDisabled = checkTestBin (helloWithStdEnv stdenv { hardeningDisable = [ "stackclashprotection" ]; }) { ignoreStackClashProtection = false; expectFailure = true; };
pacRetExplicitDisabled = pacRetTest (helloWithStdEnv stdenv { hardeningDisable = [ "pacret" ]; }) true;
shadowStackExplicitDisabled = shadowStackTest (f1exampleWithStdEnv stdenv { hardeningDisable = [ "shadowstack" ]; }) true;
# most flags can't be "unsupported" by compiler alone and # binutils doesn't have an accessible hardeningUnsupportedFlags # mechanism, so can only test a couple of flags through altered # stdenv trickery
fortifyStdenvUnsupp = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport [ "fortify" "fortify3" ]) { hardeningEnable = [ "fortify" ]; } ) { ignoreFortify = false; expectFailure = true; };
fortify3StdenvUnsupp = checkTestBin (f3exampleWithStdEnv (stdenvUnsupport [ "fortify3" ]) { hardeningEnable = [ "fortify3" ]; }) { ignoreFortify = false; expectFailure = true; };
fortifyStdenvUnsuppUnsupportsFortify3 = checkTestBin (f3exampleWithStdEnv (stdenvUnsupport [ "fortify" ]) { hardeningEnable = [ "fortify3" ]; }) { ignoreFortify = false; expectFailure = true; };
fortify3StdenvUnsuppDoesntUnsuppFortify1 = checkTestBin (f1exampleWithStdEnv (stdenvUnsupport [ "fortify3" ]) { hardeningEnable = [ "fortify" ]; }) { ignoreFortify = false; };
fortify3StdenvUnsuppDoesntUnsuppFortify1ExecTest = fortifyExecTest ( f1exampleWithStdEnv (stdenvUnsupport [ "fortify3" ]) { hardeningEnable = [ "fortify" ]; } );
sfa1StdenvUnsupp = checkTestBin (flexArrF2ExampleWithStdEnv (stdenvUnsupport [ "strictflexarrays1" "strictflexarrays3" ]) { hardeningEnable = [ "fortify" "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; } ) { ignoreFortify = false; expectFailure = true; };
sfa3StdenvUnsupp = checkTestBin (flexArrF2ExampleWithStdEnv (stdenvUnsupport [ "strictflexarrays3" ]) { hardeningEnable = [ "fortify" "strictflexarrays3" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; }) { ignoreFortify = false; expectFailure = true; };
sfa1StdenvUnsuppUnsupportsSfa3 = checkTestBin (flexArrF2ExampleWithStdEnv (stdenvUnsupport [ "strictflexarrays1" ]) { hardeningEnable = [ "fortify" "strictflexarrays3" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; }) { ignoreFortify = false; expectFailure = true; };
sfa3StdenvUnsuppDoesntUnsuppSfa1 = checkTestBin (flexArrF2ExampleWithStdEnv (stdenvUnsupport [ "strictflexarrays3" ]) { hardeningEnable = [ "fortify" "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; }) { ignoreFortify = false; };
# musl implementation is effectively FORTIFY_SOURCE=1-only sfa3StdenvUnsuppDoesntUnsuppSfa1ExecTest = brokenIf stdenv.hostPlatform.isMusl ( fortifyExecTestFull true "012345" "0123456" ( flexArrF2ExampleWithStdEnv (stdenvUnsupport [ "strictflexarrays3" ]) { hardeningEnable = [ "fortify" "strictflexarrays1" ]; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; } ) );
stackProtectorStdenvUnsupp = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport [ "stackprotector" ]) { hardeningEnable = [ "stackprotector" ]; }) { ignoreStackProtector = false; expectFailure = true; };
stackClashProtectionStdenvUnsupp = checkTestBin (helloWithStdEnv (stdenvUnsupport [ "stackclashprotection" ]) { hardeningEnable = [ "stackclashprotection" ]; }) { ignoreStackClashProtection = false; expectFailure = true; };
# NIX_HARDENING_ENABLE set in the shell overrides hardeningDisable # and hardeningEnable
stackProtectorReenabledEnv = checkTestBin (f2exampleWithStdEnv stdenv { hardeningDisable = [ "stackprotector" ]; postConfigure = '' export NIX_HARDENING_ENABLE="stackprotector" ''; }) { ignoreStackProtector = false; };
stackProtectorReenabledFromAllEnv = checkTestBin (f2exampleWithStdEnv stdenv { hardeningDisable = [ "all" ]; postConfigure = '' export NIX_HARDENING_ENABLE="stackprotector" ''; }) { ignoreStackProtector = false; };
stackProtectorRedisabledEnv = checkTestBin (f2exampleWithStdEnv stdenv { hardeningEnable = [ "stackprotector" ]; postConfigure = '' export NIX_HARDENING_ENABLE="" ''; }) { ignoreStackProtector = false; expectFailure = true; };
fortify3EnabledEnvEnablesFortify1 = checkTestBin (f1exampleWithStdEnv stdenv { hardeningDisable = [ "fortify" "fortify3" ]; postConfigure = '' export NIX_HARDENING_ENABLE="fortify3" ''; }) { ignoreFortify = false; };
fortify3EnabledEnvEnablesFortify1ExecTest = fortifyExecTest ( f1exampleWithStdEnv stdenv { hardeningDisable = [ "fortify" "fortify3" ]; postConfigure = '' export NIX_HARDENING_ENABLE="fortify3" ''; } );
fortifyEnabledEnvDoesntEnableFortify3 = checkTestBin (f3exampleWithStdEnv stdenv { hardeningDisable = [ "fortify" "fortify3" ]; postConfigure = '' export NIX_HARDENING_ENABLE="fortify" ''; }) { ignoreFortify = false; expectFailure = true; };
sfa3EnabledEnvEnablesSfa1 = checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningDisable = [ "strictflexarrays1" "strictflexarrays3" ]; postConfigure = '' export NIX_HARDENING_ENABLE="fortify strictflexarrays3" ''; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; }) { ignoreFortify = false; };
sfa3EnabledEnvEnablesSfa1ExecTest = fortifyExecTestFull true "012345" "0123456" ( f1exampleWithStdEnv stdenv { hardeningDisable = [ "strictflexarrays1" "strictflexarrays3" ]; postConfigure = '' export NIX_HARDENING_ENABLE="fortify strictflexarrays3" ''; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=7"; }; } );
sfa1EnabledEnvDoesntEnableSfa3 = checkTestBin (flexArrF2ExampleWithStdEnv stdenv { hardeningDisable = [ "strictflexarrays1" "strictflexarrays3" ]; postConfigure = '' export NIX_HARDENING_ENABLE="fortify strictflexarrays1" ''; env = { TEST_EXTRA_FLAGS = "-DBUFFER_DEF_SIZE=1"; }; }) { ignoreFortify = false; expectFailure = true; };
# NIX_HARDENING_ENABLE can't enable an unsupported feature stackProtectorUnsupportedEnabledEnv = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport [ "stackprotector" ]) { postConfigure = '' export NIX_HARDENING_ENABLE="stackprotector" ''; }) { ignoreStackProtector = false; expectFailure = true; };
# current implementation prevents the command-line from disabling # fortify if cc-wrapper is enabling it.
fortify1ExplicitEnabledCmdlineDisabled = checkTestBin (f1exampleWithStdEnv stdenv { hardeningEnable = [ "fortify" ]; postConfigure = '' export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=0' ''; }) { ignoreFortify = false; expectFailure = false; };
# current implementation doesn't force-disable fortify if # command-line enables it even if we use hardeningDisable.
fortify1ExplicitDisabledCmdlineEnabled = checkTestBin (f1exampleWithStdEnv stdenv { hardeningDisable = [ "fortify" ]; postConfigure = '' export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=1' ''; }) { ignoreFortify = false; };
fortify1ExplicitDisabledCmdlineEnabledExecTest = fortifyExecTest ( f1exampleWithStdEnv stdenv { hardeningDisable = [ "fortify" ]; postConfigure = '' export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=1' ''; } );
fortify1ExplicitEnabledCmdlineDisabledNoWarn = f1exampleWithStdEnv stdenv { hardeningEnable = [ "fortify" ]; postConfigure = '' export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=0 -Werror' ''; };
} // ( let tb = f2exampleWithStdEnv stdenv { hardeningDisable = [ "all" ]; hardeningEnable = [ "fortify" "pie" ]; }; in {
allExplicitDisabledBindNow = checkTestBin tb { ignoreBindNow = false; expectFailure = true; };
allExplicitDisabledFortify = checkTestBin tb { ignoreFortify = false; expectFailure = true; };
allExplicitDisabledPie = brokenIf (stdenv.hostPlatform.isMusl && stdenv.cc.isClang) ( checkTestBin tb { ignorePie = false; expectFailure = true; } );
# can't force-disable ("partial"?) relro allExplicitDisabledRelRO = brokenIf true ( checkTestBin tb { ignoreRelRO = false; expectFailure = true; } );
allExplicitDisabledStackProtector = checkTestBin tb { ignoreStackProtector = false; expectFailure = true; };
allExplicitDisabledStackClashProtection = checkTestBin tb { ignoreStackClashProtection = false; expectFailure = true; };
allExplicitDisabledPacRet = pacRetTest (helloWithStdEnv stdenv { hardeningDisable = [ "all" ]; }) true;
allExplicitDisabledShadowStack = shadowStackTest (f1exampleWithStdEnv stdenv { hardeningDisable = [ "all" ]; }) true; } ))