From: ludo@gnu.org (Ludovic Courtès)
To: "Anto Cvitić" <anto.cvitic@gmail.com>
Cc: guix-devel@gnu.org
Subject: Re: Hardened builds
Date: Wed, 09 Apr 2014 22:19:42 +0200 [thread overview]
Message-ID: <87sipm2r35.fsf@gnu.org> (raw)
In-Reply-To: <CACqPFT0nEFkT+k6p1m42uWW52Xc6HmqdL-0U81O2icvdyud10Q@mail.gmail.com> ("Anto \=\?utf-8\?Q\?Cviti\=C4\=87\=22's\?\= message of "Wed, 9 Apr 2014 00:31:28 +0200")
Hello,
Anto Cvitić <anto.cvitic@gmail.com> skribis:
> Is there an easy way to modify the gnu-build-system so that packages are
> compiled with for example -fstack-protector and other flags to compiler and
> linker? Inspired from https://wiki.debian.org/Hardening
Yes, we can do that on a per-package basis, by passing specific CFLAGS
or such to ./configure.
To automate it, we could write a function that takes a package, and
returns the same package but with that additional configure flag, like:
(define (hardened-package p)
(package (inherit p)
(arguments
`(#:configure-flags '("CFLAGS=-fstack-protector")))))
(In real life this would have to be a bit more sophisticated so that P’s
configure flags are not discarded, but you get the idea.)
We could also do that automatically in gnu-build-system, but that may
not be a good idea.
Or, we could add an option to gnu-build-system that does that, so that a
package definition can enable it with just:
(arguments '(#:hardened? #t))
Perhaps that is the best thing to do.
> It would be nice with a hadened guix, perhaps even with grsecurity patches.
I agree it would be nice.
> I would gladly help with this effort, but alas am not a lisper, yet.
The goal of Guix is to allow non-lispers to contribute (package
definitions can be understood without being a lisper, no?), and to
stealthily turn them into Schemers as they get more experienced.
:-)
Ludo’.
prev parent reply other threads:[~2014-04-09 20:20 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-08 22:31 Hardened builds Anto Cvitić
2014-04-09 20:19 ` Ludovic Courtès [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87sipm2r35.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=anto.cvitic@gmail.com \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.