2

In an attempt to build GCC (6.3) on NixOS (16.09), within a nix-shell, I get this:

make[1]: Entering directory '<my-build-path>/coreboot/util/crossgcc/build-i386-elf-GCC/build-x86_64-pc-linux-gnu/libcpp'
test -f config.h || (rm -f stamp-h1 && make stamp-h1)
g++  -I../../../gcc-6.3.0/libcpp -I. -I../../../gcc-6.3.0/libcpp/../include -I../../../gcc-6.3.0/libcpp/include  -O2  -fomit-frame-pointer -m64 -W -Wall -Wno-narrowing -Wwrite-strings -Wmissing-format-attribute -pedantic -Wno-long-long  -fno-exceptions -fno-rtti -I../../../gcc-6.3.0/libcpp -I. -I../../../gcc-6.3.0/libcpp/../include -I../../../gcc-6.3.0/libcpp/include   -c -o expr.o -MT expr.o -MMD -MP -MF .deps/expr.Tpo ../../../gcc-6.3.0/libcpp/expr.c
../../../gcc-6.3.0/libcpp/expr.c: In function 'unsigned int cpp_classify_number(cpp_reader*, const cpp_token*, const char**, source_location)':
../../../gcc-6.3.0/libcpp/expr.c:686:18: error: format not a string literal and no format arguments [-Werror=format-security]
        0, message);
                  ^
../../../gcc-6.3.0/libcpp/expr.c:689:39: error: format not a string literal and no format arguments [-Werror=format-security]
           virtual_location, 0, message);
                                       ^
cc1plus: some warnings being treated as errors
make[1]: *** [Makefile:224: expr.o] Error 1
make[1]: Leaving directory '<my-build-path>/coreboot/util/crossgcc/build-i386-elf-GCC/build-x86_64-pc-linux-gnu/libcpp'
make: *** [Makefile:2730: all-build-libcpp] Error 2
sh ../gcc-6.3.0/mkinstalldirs <my-build-path>/coreboot/util/crossgcc/xgcc <my-build-path>/coreboot/util/crossgcc/xgcc
sh: line 3: cd: i386-elf/libgcc: No such file or directory
make: *** [Makefile:10462: install-target-libgcc] Error 1

Where -Werror=format-security seems to be the reason for the failure (although I don't see this exact option in the command). Yet in <nixpkgs>/pkgs/development/compilers/gcc/6/default.nix I find this:

hardeningDisable = [ "format" ];

And guess that the failure may be due to the security hardening measures of NixOS, some of which have to be disabled to get GCC compiled (let's assume GCC dev's know what they're doing in those functions). Tested it with GCC 6.2 and 5.4 -- same thing.

So the question is how do I disable the hardening options (in particular format) for a nix-shell environment? Or where else those "warnings being treated as errors" come from?

Description(s) of the option(s):


According to this answer

nix-shell has nothing to do with the Nix expressions... but when I call make with the NIX_DEBUG flag,

env NIX_DEBUG=' ' make crossgcc-i386

I get the output from <nixpkgs>/pkgs/build-support/cc-wrapper/add-hardening.sh, e.g. HARDENING: enabling format; from what I infer that those "format security" options are actually applied when I call make in the nix-shell.


Perhaps I simply need to bump something via nixos-option, but which exactly option? I can't just grep it... (there's no analogue of dconf dump / or gsettings list-recursively)

  • So what happens if you insert a %s argument before message in each case in the source, e.g. 0, message); becomes 0, "%s", message);? – drewbenn May 29 '17 at 4:45
  • @drewbenn The warnings disappear, the compiler apparently works well, except maybe incorrectly working debug output; didn't test. The behavior should (almost) stay the same: it's just a va_list after all, as in printf, for example, but, because of some GCC's own format options (%<, %>), the argument isn't allowed to be a constant string. – Andrew Miloradovsky May 29 '17 at 4:58
  • Please post the solution as a self-answer instead of editing the question. – Zimm i48 May 29 '17 at 11:47
  • @AndrewMiloradovsky seems like it might be worth filing a defect upstream, then, to help increase its portability? – drewbenn May 29 '17 at 20:15
  • 1
    @Zimmi48 Done. Now it should better fit the SE paradigm, although the answer is just a workaround. – Andrew Miloradovsky May 30 '17 at 0:49
1

The format-security warnings have to be disabled, or at least not -Werror'd, because of this:

The hardening options are imposed by the compiler wrapper, that's why they are not shown in the log.

And hardeningDisable is apparently the only method to affect the wrapper.

One possible solution is to create a dummy Nix expression to be used with nix-shell -A. For example:
copy ~/.nix-defexpr/channels_root/nixos/ into a separate place (<nixpkgs'>) and make it writeable,
add <nixpkgs'>/pkgs/tools/misc/coreboot/default.nix containing

{ stdenv, gcc6, flex, bison, ncurses, iasl, doxygen, zlib, isl, python }:

stdenv.mkDerivation {
  name = "coreboot";

  buildInputs = [ gcc6 flex bison ncurses iasl doxygen zlib isl python ];

  hardeningDisable = [ "format" ];  # to build the cross-compiler
}

and register it in <nixpkgs'>/top-level/all-packages.nix as usual,
and, finally, call nix-shell <nixpkgs'> -A coreboot to create the environment needed.

Still I think it should be easier (workable for nix-shell -p).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.