From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Hardened builds Date: Wed, 09 Apr 2014 22:19:42 +0200 Message-ID: <87sipm2r35.fsf@gnu.org> References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:50298) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WXyyQ-0003K2-Ml for guix-devel@gnu.org; Wed, 09 Apr 2014 16:20:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WXyyH-0006kE-2a for guix-devel@gnu.org; Wed, 09 Apr 2014 16:19:54 -0400 Received: from hera.aquilenet.fr ([2a01:474::1]:38675) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WXyyG-0006k1-R9 for guix-devel@gnu.org; Wed, 09 Apr 2014 16:19:45 -0400 In-Reply-To: ("Anto \=\?utf-8\?Q\?Cviti\=C4\=87\=22's\?\= message of "Wed, 9 Apr 2014 00:31:28 +0200") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Anto =?utf-8?Q?Cviti=C4=87?= Cc: guix-devel@gnu.org Hello, Anto Cviti=C4=87 skribis: > Is there an easy way to modify the gnu-build-system so that packages are > compiled with for example -fstack-protector and other flags to compiler a= nd > linker? Inspired from https://wiki.debian.org/Hardening Yes, we can do that on a per-package basis, by passing specific CFLAGS or such to ./configure. To automate it, we could write a function that takes a package, and returns the same package but with that additional configure flag, like: (define (hardened-package p) (package (inherit p) (arguments `(#:configure-flags '("CFLAGS=3D-fstack-protector"))))) (In real life this would have to be a bit more sophisticated so that P=E2= =80=99s configure flags are not discarded, but you get the idea.) We could also do that automatically in gnu-build-system, but that may not be a good idea. Or, we could add an option to gnu-build-system that does that, so that a package definition can enable it with just: (arguments '(#:hardened? #t)) Perhaps that is the best thing to do. > It would be nice with a hadened guix, perhaps even with grsecurity patche= s. I agree it would be nice. > I would gladly help with this effort, but alas am not a lisper, yet. The goal of Guix is to allow non-lispers to contribute (package definitions can be understood without being a lisper, no?), and to stealthily turn them into Schemers as they get more experienced. :-) Ludo=E2=80=99.