Switching to individually generated derivations

nixos/modules/security/wrappers/default.nix

@@ -8,19 +8,22 @@ let
       (n: v: (if v ? "program" then v else v // {program=n;}))
       wrappers);
 
-  mkWrapper = { program, source ? null, ...}: ''
+  mkWrapper = { program, source ? null, ...}:
+    let buildWrapper = ''
           parentWrapperDir=$(dirname ${wrapperDir})
           gcc -Wall -O2 -DSOURCE_PROG=\"${source}\" -DWRAPPER_DIR=\"$parentWrapperDir\" \
+              -Wformat -Wformat-security -Werror=format-security \
+              -fstack-protector-strong --param ssp-buffer-size=4 \
+              -D_FORTIFY_SOURCE=2 -fPIC \
               -lcap-ng -lcap ${./wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \
               -I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include
         '';
-
-  wrappedPrograms = pkgs.stdenv.mkDerivation {
-    name         = "permissions-wrapper";
+    in pkgs.stdenv.mkDerivation {
+      name         = "${program}-wrapper";
       unpackPhase  = "true";
       installPhase = ''
         mkdir -p $out/bin
-      ${lib.concatMapStrings mkWrapper programs}
+        ${buildWrapper}
       '';
     };
 
@@ -34,8 +37,9 @@ let
     , ...
     }:
     assert (lib.versionAtLeast (lib.getVersion config.boot.kernelPackages.kernel) "4.3");
-    ''
-      cp ${wrappedPrograms}/bin/${program}.wrapper $wrapperDir/${program}
+    let wrapperDrv = mkWrapper { inherit program source; };
+    in ''
+      cp ${wrapperDrv}/bin/${program}.wrapper $wrapperDir/${program}
 
       # Prevent races
       chmod 0000 $wrapperDir/${program}
@@ -60,8 +64,10 @@ let
     , setgid ? false
     , permissions ? "u+rx,g+x,o+x"
     , ...
-    }: ''
-      cp ${wrappedPrograms}/bin/${program}.wrapper $wrapperDir/${program}
+    }:
+    let wrapperDrv = mkWrapper { inherit program source; };
+    in ''
+      cp ${wrapperDrv}/bin/${program}.wrapper $wrapperDir/${program}
 
       # Prevent races
       chmod 0000 $wrapperDir/${program}