all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* Hardened builds
@ 2014-04-08 22:31 Anto Cvitić
  2014-04-09 20:19 ` Ludovic Courtès
  0 siblings, 1 reply; 2+ messages in thread
From: Anto Cvitić @ 2014-04-08 22:31 UTC (permalink / raw)
  To: guix-devel

[-- Attachment #1: Type: text/plain, Size: 378 bytes --]

Hello,

Is there an easy way to modify the gnu-build-system so that packages are
compiled with for example -fstack-protector and other flags to compiler and
linker? Inspired from https://wiki.debian.org/Hardening

It would be nice with a hadened guix, perhaps even with grsecurity patches.
I would gladly help with this effort, but alas am not a lisper, yet.

Kind regards
Anto

[-- Attachment #2: Type: text/html, Size: 522 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Hardened builds
  2014-04-08 22:31 Hardened builds Anto Cvitić
@ 2014-04-09 20:19 ` Ludovic Courtès
  0 siblings, 0 replies; 2+ messages in thread
From: Ludovic Courtès @ 2014-04-09 20:19 UTC (permalink / raw)
  To: Anto Cvitić; +Cc: guix-devel

Hello,

Anto Cvitić <anto.cvitic@gmail.com> skribis:

> Is there an easy way to modify the gnu-build-system so that packages are
> compiled with for example -fstack-protector and other flags to compiler and
> linker? Inspired from https://wiki.debian.org/Hardening

Yes, we can do that on a per-package basis, by passing specific CFLAGS
or such to ./configure.

To automate it, we could write a function that takes a package, and
returns the same package but with that additional configure flag, like:

  (define (hardened-package p)
    (package (inherit p)
      (arguments
        `(#:configure-flags '("CFLAGS=-fstack-protector")))))

(In real life this would have to be a bit more sophisticated so that P’s
configure flags are not discarded, but you get the idea.)

We could also do that automatically in gnu-build-system, but that may
not be a good idea.

Or, we could add an option to gnu-build-system that does that, so that a
package definition can enable it with just:

  (arguments '(#:hardened? #t))

Perhaps that is the best thing to do.

> It would be nice with a hadened guix, perhaps even with grsecurity patches.

I agree it would be nice.

> I would gladly help with this effort, but alas am not a lisper, yet.

The goal of Guix is to allow non-lispers to contribute (package
definitions can be understood without being a lisper, no?), and to
stealthily turn them into Schemers as they get more experienced.
:-)

Ludo’.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2014-04-09 20:20 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-04-08 22:31 Hardened builds Anto Cvitić
2014-04-09 20:19 ` Ludovic Courtès

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.