JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nginx: Rmove custom hardening, now enabled by default

Browse Source
This commit is contained in:
Franz Pletz 2016-03-08 00:39:07 +01:00
parent e9fc4e7db6
commit fedf31660d
2 changed files with 4 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkgs/servers/http/nginx/default.nix
View File

@ -54,14 +54,7 @@ stdenv.mkDerivation rec {
NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations -Wno-error=conditional-uninitialized";
preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules)
+ optionalString (hardening && (stdenv.cc.cc.isGNU or false)) ''
configureFlagsArray=(
--with-cc-opt="-fPIE -fstack-protector-all --param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2"
--with-ld-opt="-pie -Wl,-z,relro,-z,now"
)
''
;
preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
hardeningEnable = [ "pie" ];

11
pkgs/servers/http/nginx/unstable.nix
View File

@ -52,14 +52,9 @@ stdenv.mkDerivation rec {
NIX_CFLAGS_COMPILE = [ "-I${libxml2}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules)
+ optionalString (hardening && (stdenv.cc.cc.isGNU or false)) ''
configureFlagsArray=(
--with-cc-opt="-fPIE -fstack-protector-all --param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2"
--with-ld-opt="-pie -Wl,-z,relro,-z,now"
)
''
;
preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
hardeningEnable = [ "pie" ];
postInstall = ''
mv $out/sbin $out/bin