[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Hardened builds

From: Ludovic Courtès
Subject: Re: Hardened builds
Date: Wed, 09 Apr 2014 22:19:42 +0200
User-agent: Gnus/5.130007 (Ma Gnus v0.7) Emacs/24.3 (gnu/linux)


Anto Cvitić <address@hidden> skribis:

> Is there an easy way to modify the gnu-build-system so that packages are
> compiled with for example -fstack-protector and other flags to compiler and
> linker? Inspired from

Yes, we can do that on a per-package basis, by passing specific CFLAGS
or such to ./configure.

To automate it, we could write a function that takes a package, and
returns the same package but with that additional configure flag, like:

  (define (hardened-package p)
    (package (inherit p)
        `(#:configure-flags '("CFLAGS=-fstack-protector")))))

(In real life this would have to be a bit more sophisticated so that P’s
configure flags are not discarded, but you get the idea.)

We could also do that automatically in gnu-build-system, but that may
not be a good idea.

Or, we could add an option to gnu-build-system that does that, so that a
package definition can enable it with just:

  (arguments '(#:hardened? #t))

Perhaps that is the best thing to do.

> It would be nice with a hadened guix, perhaps even with grsecurity patches.

I agree it would be nice.

> I would gladly help with this effort, but alas am not a lisper, yet.

The goal of Guix is to allow non-lispers to contribute (package
definitions can be understood without being a lisper, no?), and to
stealthily turn them into Schemers as they get more experienced.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]