stdenvBootstrapTools: Bundle all *.o files from libc

[chivay]

Description of changes

Scrt1.o is a critical file used for linking PIE binaries. Add it to the package to enable PIE-based hardening.

Add all *.o files to the package to enable all build modes as suggested by @trofi in #252310 (comment)

This is a prerequisite for enabling PIE globally for all packages as seen in #252310

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[chivay]

The build seems to work

$ nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix
/nix/store/zv4jy75p366wc1x9qrb7hgn43n4b0qbw-binutils-2.40
/nix/store/05bivb1i136v52x76azidjnnrpvw21c7-gcc-12.3.0
/nix/store/x8jgdyfjjcc0yskdcq1xf9h4hsy9qnb8-bootstrap-tools
/nix/store/681zsgx3l6kzvvl5fw7n4j2y1rg3cs5k-stdenv-bootstrap-tools
/nix/store/h2q9bjns3xkdn58jnp59y6a5g8zg99bp-busybox-1.36.1
/nix/store/7fi3fimhrbq38kgnxn5jgh6wv0zk9yc2-coreutils-9.3
/nix/store/8smqhxykil8c1a5rxwnhrczn4v1wf83h-stdenv-bootstrap-tools
/nix/store/agyhffawfg61zyq2sp09s2zvci4w8hr9-gnutar-1.35
/nix/store/dpc0pi887saag12pb8754w6wal8wgsk7-test-bootstrap-tools

[RaitoBezarius]

I don't know if this should target staging… :D

[chivay]

If my understanding is correct the change itself won't trigger any rebuilds since the bootstrap tools are updated manually? 🤔

[RaitoBezarius]

Right, but I wonder if the bootstrap tools should be updated as part of this change "atomically" Le jeu. 7 sept. 2023 à 03:46, Hubert Jasudowicz ***@***.***> a écrit :

…

If my understanding is correct the change itself won't trigger any rebuilds since the bootstrap tools are updated manually? 🤔 — Reply to this email directly, view it on GitHub <#253760 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACMZRDNUYVUSFOA3TZO2CLXZERO3ANCNFSM6AAAAAA4OEVSEA> . You are receiving this because you commented.Message ID: ***@***.***>

[Artturin]

tested with

git apply - <<< $(curl "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/253760.patch")
nix build ".#freshBootstrapTools.bootstrapFiles.bootstrapTools"
readlink -f result *copy*

diff --git a/pkgs/stdenv/linux/bootstrap-files/x86_64.nix b/pkgs/stdenv/linux/bootstrap-files/x86_64.nix
index bdfa98c89cbc..4c8a72839162 100644
--- a/pkgs/stdenv/linux/bootstrap-files/x86_64.nix
+++ b/pkgs/stdenv/linux/bootstrap-files/x86_64.nix
@@ -2,8 +2,5 @@
 (import ./i686.nix) //
 
 {
-  bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-linux/x86_64/c5aabb0d603e2c1ea05f5a93b3be82437f5ebf31/bootstrap-tools.tar.xz";
-    sha256 = "a5ce9c155ed09397614646c9717fc7cd94b1023d7b76b618d409e4fefd6e9d39";
-  };
+  bootstrapTools = builtins.storePath /nix/store/lrpqbgnbcibsvx6w4fvwhppkrp4p0ls9-bootstrap-tools.tar.xz;
 }

git apply - <<< $(curl "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/252310.patch")
nix build ".#bash" --impure

[Artturin]

readelf -l ./result/bin/bash

before
Elf file type is EXEC (Executable file)
after
Elf file type is DYN (Position-Independent Executable file)

[Artturin]

Tested aarch64-linux(native remote nixbuild.net) but i was not able to build because
nix build ".#stdenv.__bootPackages.stdenv.__bootPackages.libxcrypt" --system aarch64-linux --impure -j0 --rebuild fails even without the changes here
libxcrypt> FAIL test/alg-yescrypt (exit status: 1)

ping @lovesegfault who did a bootstrap update in #207135

all gcc bootstrap files have to be updated

cross-trunk could be used like was done here https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/linux/bootstrap-files/armv7l.nix
https://hydra.nixos.org/jobset/nixpkgs/cross-trunk#tabs-jobs

[lovesegfault]

This should not have been merged without the associated bootstrap tarball updates. The process was not followed, and I am reverting this.

[lovesegfault]

It's unacceptable to ping me and merge the PR 5 mins later, @Artturin.

[Artturin]

This should not have been merged without the associated bootstrap tarball updates. The process was not followed, and I am reverting this.

As far as I understand it we have to wait for a channel update to get the new files and then update the bootstrap-files, that is why I merged it.

[Artturin]

I suppose you could build all the cross files locally but that does not seem as convenient as using hydra