cc-wrapper hardeningFlags tests: fix expected behaviour in corner cases, add tests for stackclashprotection

[risicle]

Description of changes

A few fixups for the recently merged #217390, straightening out the expected behaviour of one test to match current reality and changing a few tests to use a _FORTIFY_SOURCE=1-protectable example program so that it can be more useful for testing clang's behaviour too.

Note there are two tests here that will (still) be failing on tests.hardeningFlags-clang until I can get the fix for that merged (#253194, but is headed for staging): fortify3EnabledEnvEnablesFortify1 and fortify3EnabledEnvEnablesFortify1ExecTest.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/2705

[risicle]

Have pushed some further fixes and added some tests for the recently added stackclashprotection flag.

Would love to get this merged and have a little more green around https://hydra.nixos.org/eval/1807613?filter=hardeningflags&compare=1807605&full=

[emilazy]

@ofborg build tests.hardeningFlags-gcc tests.hardeningFlags-clang

[emilazy]

I successfully ran nom build --impure --expr 'let pkgs = (builtins.getFlake "github:NixOS/nixpkgs/pull/253186/merge").legacyPackages.${builtins.currentSystem}; in pkgs.lib.filterAttrs (k: v: (builtins.tryEval v).success && v ? drvPath && (builtins.tryEval v.drvPath).success) pkgs.tests.hardeningFlags-gcc' on x86_64-linux. -clang yields the following error:

test-pieExplicitDisabled> /nix/store/cjahfl54j3931zm56rvpcim3d4hyxpg9-test-bin/bin/test-bin:
test-pieExplicitDisabled>  Position Independent Executable: yes
test-pieExplicitDisabled>  Stack protected: yes
test-pieExplicitDisabled>  Fortify Source functions: yes
test-pieExplicitDisabled>  Read-only relocations: yes
test-pieExplicitDisabled>  Immediate binding: yes
test-pieExplicitDisabled>  Stack clash protection: unknown, no -fstack-clash-protection instructions found
test-pieExplicitDisabled>  Control flow integrity: no, not found! (ignored)
test-pieExplicitDisabled> ERROR: Expected hardening-check to fail, but it passed!

I just wanted to check if this is expected or not, as it’s not in your list of known failing tests.

[risicle]

I assume this is pkgs.tests.hardeningFlags-clang.pieExplicitDisabled failing, which fails for me too. I just haven't marked it as broken because ... I'm not really happy with it being broken ;)

Is it that it's not possible to disable pie on clang/linux? Are we just not supplying the right flags at the right point? Don't know - it's something we need to investigate at some point.

[emilazy]

I’m pretty sure you can turn off PIE with Clang? But yeah, I have no idea.

tests.hardeningFlags-clang builds on x86_64-darwin, tests.hardeningFlags-gcc doesn’t but that’s probably unrelated. Looks good to me!