From 506ec38e7f2292790dba1b34b5def792ad2de5e8 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sun, 17 Dec 2023 14:04:44 +0000 Subject: [PATCH] cc-wrapper, clang: use new mechanism to selectively unsupport zerocallusedregs this allows a compiler derivation to provide a hardeningUnsupportedFlagsByTargetPlatform passthru attr that will be called with the targetPlatform to determine the unsupported hardening flags for that platform. we can do this because even though a clang compiler is multi-target by nature, cc-wrapper effectively fixes the target platform at wrapping time. otherwise we'd have to sniff the intended target at runtime, which wouldn't be fun at all. the advantage of using a new attribute instead of allowing hardeningUnsupportedFlags to optionally be a function is that hardeningUnsupportedFlags retains its simple overriding pattern for simple cases (i.e. `(prev.hardeningUnsupportedFlags or []) ++ [ "foo" ]` ) which will continue to work as long as the bottom-most function of hardeningUnsupportedFlagsByTargetPlatform falls back to hardeningUnsupportedFlags. --- pkgs/build-support/cc-wrapper/default.nix | 11 ++++++++++- pkgs/development/compilers/llvm/15/clang/default.nix | 7 ++++--- pkgs/development/compilers/llvm/16/clang/default.nix | 7 ++++--- pkgs/development/compilers/llvm/17/clang/default.nix | 7 ++++--- pkgs/development/compilers/llvm/git/clang/default.nix | 7 ++++--- 5 files changed, 26 insertions(+), 13 deletions(-) diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix index 59aaa41e9c17..693c6e6fcfd4 100644 --- a/pkgs/build-support/cc-wrapper/default.nix +++ b/pkgs/build-support/cc-wrapper/default.nix @@ -223,6 +223,15 @@ let defaultHardeningFlags = bintools.defaultHardeningFlags or []; + # if cc.hardeningUnsupportedFlagsByTargetPlatform exists, this is + # called with the targetPlatform as an argument and + # cc.hardeningUnsupportedFlags is completely ignored - the function + # is responsible for including the constant hardeningUnsupportedFlags + # list however it sees fit. + ccHardeningUnsupportedFlags = if cc ? hardeningUnsupportedFlagsByTargetPlatform + then cc.hardeningUnsupportedFlagsByTargetPlatform targetPlatform + else (cc.hardeningUnsupportedFlags or []); + darwinPlatformForCC = optionalString stdenv.targetPlatform.isDarwin ( if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx" else targetPlatform.darwinPlatform @@ -584,7 +593,7 @@ stdenv.mkDerivation { ## Hardening support ## + '' - export hardening_unsupported_flags="${builtins.concatStringsSep " " (cc.hardeningUnsupportedFlags or [])}" + export hardening_unsupported_flags="${builtins.concatStringsSep " " ccHardeningUnsupportedFlags}" '' # Machine flags. These are necessary to support diff --git a/pkgs/development/compilers/llvm/15/clang/default.nix b/pkgs/development/compilers/llvm/15/clang/default.nix index 8c19956a0bfe..9ec15a393004 100644 --- a/pkgs/development/compilers/llvm/15/clang/default.nix +++ b/pkgs/development/compilers/llvm/15/clang/default.nix @@ -7,7 +7,7 @@ }: let - self = stdenv.mkDerivation (rec { + self = stdenv.mkDerivation (finalAttrs: rec { pname = "clang"; inherit version; @@ -99,9 +99,10 @@ let isClang = true; hardeningUnsupportedFlags = [ "fortify3" - # supported on x86_64/aarch64 only - "zerocallusedregs" ]; + hardeningUnsupportedFlagsByTargetPlatform = targetPlatform: + lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs" + ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []); }; meta = llvm_meta // { diff --git a/pkgs/development/compilers/llvm/16/clang/default.nix b/pkgs/development/compilers/llvm/16/clang/default.nix index 4e260906a2c5..43c497b92761 100644 --- a/pkgs/development/compilers/llvm/16/clang/default.nix +++ b/pkgs/development/compilers/llvm/16/clang/default.nix @@ -7,7 +7,7 @@ }: let - self = stdenv.mkDerivation (rec { + self = stdenv.mkDerivation (finalAttrs: rec { pname = "clang"; inherit version; @@ -93,9 +93,10 @@ let isClang = true; hardeningUnsupportedFlags = [ "fortify3" - # supported on x86_64/aarch64 only - "zerocallusedregs" ]; + hardeningUnsupportedFlagsByTargetPlatform = targetPlatform: + lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs" + ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []); }; meta = llvm_meta // { diff --git a/pkgs/development/compilers/llvm/17/clang/default.nix b/pkgs/development/compilers/llvm/17/clang/default.nix index 7b530e009de2..f2f114233c28 100644 --- a/pkgs/development/compilers/llvm/17/clang/default.nix +++ b/pkgs/development/compilers/llvm/17/clang/default.nix @@ -7,7 +7,7 @@ }: let - self = stdenv.mkDerivation (rec { + self = stdenv.mkDerivation (finalAttrs: rec { pname = "clang"; inherit version; @@ -97,9 +97,10 @@ let isClang = true; hardeningUnsupportedFlags = [ "fortify3" - # supported on x86_64/aarch64 only - "zerocallusedregs" ]; + hardeningUnsupportedFlagsByTargetPlatform = targetPlatform: + lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs" + ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []); }; meta = llvm_meta // { diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix index b8e5c4eb5910..7d0dc964a9e4 100644 --- a/pkgs/development/compilers/llvm/git/clang/default.nix +++ b/pkgs/development/compilers/llvm/git/clang/default.nix @@ -7,7 +7,7 @@ }: let - self = stdenv.mkDerivation (rec { + self = stdenv.mkDerivation (finalAttrs: rec { pname = "clang"; inherit version; @@ -97,9 +97,10 @@ let isClang = true; hardeningUnsupportedFlags = [ "fortify3" - # supported on x86_64/aarch64 only - "zerocallusedregs" ]; + hardeningUnsupportedFlagsByTargetPlatform = targetPlatform: + lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs" + ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []); }; meta = llvm_meta // {