C: Difference between revisions

(One intermediate revision by the same user not shown)

Line 4:

== Differences between nixpkgs and the rest ==

The way nixpkgs and its stdenv handles compiling and linking is very different from other ~~linux~~ distributions.

The way nixpkgs and its stdenv handles compiling and linking is very different from other Linux distributions.

~~Usually~~ header files are put into well known paths i.e. <code>/usr/include</code>, where the compiler will

In more conventional Linux distributions it's usual that header files are put into well known paths i.e. <code>/usr/include</code>, where the compiler will look for them. Same is true when linking against libraries, which are put in a few places, where the build-time linker will find them. Dynamically linked libraries will have a run-time linker (also known as <code>ld.so</code>) set as an interpreter.

look for them. Same is true when linking against libraries, which are put in a few places, where the build-time

linker will find them. Dynamically linked libraries will have a run-time linker (also known as <code>ld.so</code>) set as an interpreter.

This linker reads <code>/etc/ld.so.conf</code> to figure out where to find libraries.

In nixpkgs in contrast this information is provided by environment variables.

Line 105:

Line 103:

== Hardening flags ==

To improve the security of applications the wrapper also injects additional hardening compile flags into the application.

To improve the security of applications the wrapper also injects additional hardening compile flags into the application. These nix flags enable different compiler flags, as seen in the [https://nixos.org/nixpkgs/manual/#sec-hardening-in-nixpkgs manual].

Under some circumstances this can make programs fail to build or function.

Under some circumstances this can make programs fail to build or function. For example, the `fortify` flag enables the `-O2` optimization level -- if you want to change this, you need to disable the `fortify` flag and re-add the compiler flags manually (`env.NIX_CFLAGS_COMPILE = [ "-O" "....."]`).

To disable all hardening options one can export the environment variable <code>hardeningDisable="all"</code>.

This also works for derivations like that: