WIP: rewrite hardening in plain nix

[groxxda]

Motivation for this change

Doing it in nix makes it more lazy.

See commit messages for more details

Fixes #18995

This PR is not ready to merge.
I post it to get feedback on the changes.

TODO:

• Add hardening for other cc derivations
• Handle pie hardening (probably via .spec file for gcc, sadly unsupported on clang)
• Make all flag more efficient (see 4bf0576 for details)

CC @fpletz @globin

Things done

• Tested using sandboxing
  (nix.useSandbox on NixOS,
  or option build-use-sandbox in nix.conf
  on non-NixOS)
• Built on platform(s)
  • NixOS
  • OS X
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

---

[groxxda]

@fpletz can I help with the remaining todos?

[fpletz]

Yes, please start if you can. I will have time again to look at these issues at the weekend. Too much dayjob-stuff to do.

[groxxda]

@fpletz can you share your work for spec files somewhere?

[aneeshusa]

I'm a big fan of doing more in Nix (see my cmakeFlags/configureFlags PRs), but since this adds more processing to mkDerivation, I believe this will require #18660 to allow easy overrides of the hardening flags.

[aneeshusa]

We need to keep supporting "all" for backwards compatibility right now, but a nice interface improvement we can get is also supporting hardeningEnable = true and hardeningDisable = true, instead of using "all" as a sentinel.

Edit: this could also be hardeningEnable = true and hardeningEnable = false, and not supporting a boolean value for hardeningDisable.

[groxxda]

@fpletz I think our best shot to handle pie gracefully is to modify (ld,cc)-wrapper instead of using spec files. Something along [pseudo code]

for flag in flags:
  if flag matches "-?-(static|shared)":
    disable_pie = true
if disable_pie:
  flags.remove("-pie")

just before the debug print..

[spacekitteh]

Cool. How's this coming?

Also, @grahamc security

[bjornfor]

Friendly bump. Are the remaining TODOs blockers?

[copumpkin]

Any progress here?

[fpletz]

Closing in favour of #28029.