Nixpkgs Toolchain Wrappers, Hooks, Purity, and Hardening

The CC Wrapper wraps a C toolchain for a bunch of miscellaneous purposes. Specifically, a C compiler (GCC or Clang), wrapped binary tools, and a C standard library (glibc or Darwin’s libSystem, just for the dynamic loader) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by the CC Wrapper. Packages typically depend on the CC Wrapper, which in turn (at run-time) depends on the Bintools Wrapper. Dependency finding is undoubtedly the main task of the CC Wrapper. This works just like the Bintools Wrapper, except that any `include` subdirectory of any relevant dependency is added to `NIX_CFLAGS_COMPILE`. The setup hook itself contains elaborate comments describing the exact mechanism by which this is accomplished. Similarly, the CC Wrapper follows the Bintools Wrapper in defining standard environment variables with the names of the tools it wraps, for the same reasons described above. Importantly, while it includes a `cc` symlink to the c compiler for portability, the `CC` will be defined using the compiler’s “real name” (i.e. `gcc` or `clang`). This helps lousy build systems that inspect on the name of the compiler rather than run it. Here are some more packages that provide a setup hook. Since the list of hooks is extensible, this is not an exhaustive list. The mechanism is only to be used as a last resort, so it might cover most uses. ### Other hooks {#stdenv-other-hooks} Many other packages provide hooks, that are not part of `stdenv`. You can find these in the [Hooks Reference](#chap-hooks). ### Compiler and Linker wrapper hooks {#compiler-linker-wrapper-hooks} If the file `${cc}/nix-support/cc-wrapper-hook` exists, it will be run at the end of the [compiler wrapper](#cc-wrapper). If the file `${binutils}/nix-support/ld-wrapper-hook` exists, it will be run at the end of the linker wrapper, before the linker runs. If the file `${binutils}/nix-support/post-link-hook` exists, it will be run at the end of the linker wrapper. These hooks allow a user to inject code into the wrappers. As an example, these hooks can be used to extract `extraBefore`, `params` and `extraAfter` which store all the command line arguments passed to the compiler and linker respectively. ## Purity in Nixpkgs {#sec-purity-in-nixpkgs} *Measures taken to prevent dependencies on packages outside the store, and what you can do to prevent them.* GCC doesn’t search in locations such as `/usr/include`. In fact, attempts to add such directories through the `-I` flag are filtered out. Likewise, the linker (from GNU binutils) doesn’t search in standard locations such as `/usr/lib`. Programs built on Linux are linked against a GNU C Library that likewise doesn’t search in the default system locations. ## Hardening in Nixpkgs {#sec-hardening-in-nixpkgs} There are flags available to harden packages at compile or link-time. These can be toggled using the `stdenv.mkDerivation` parameters `hardeningDisable` and `hardeningEnable`. Both parameters take a list of flags as strings. The special `"all"` flag can be passed to `hardeningDisable` to turn off all hardening. These flags can also be used as environment variables for testing or development purposes. For more in-depth information on these hardening flags and hardening in general, refer to the [Debian Wiki](https://wiki.debian.org/Hardening), [Ubuntu Wiki](https://wiki.ubuntu.com/Security/Features), [Gentoo Wiki](https://wiki.gentoo.org/wiki/Project:Hardened), and the [Arch Wiki](https://wiki.archlinux.org/title/Security). Note that support for some hardening flags varies by compiler, CPU architecture, target OS and libc. Combinations of these that don't support a particular hardening flag will silently ignore attempts to enable it. To see exactly which hardening flags are being employed in any invocation, the `NIX_DEBUG` environment variable can be used. ### Hardening flags enabled by default {#sec-hardening-flags-enabled-by-default} The following flags are enabled by default and might require disabling with `hardeningDisable` if the program to be packaged is incompatible.

This text describes the CC Wrapper, a key component in Nixpkgs for managing C toolchains by wrapping C compilers, binary tools, and a C standard library. It handles dependency finding (adding `include` paths to `NIX_CFLAGS_COMPILE`), hardening, and purity checks, while also defining standard environment variables for tools like `CC`. The document also introduces various setup hooks, including specific 'Compiler and Linker wrapper hooks' that allow injecting custom code into the compiler and linker processes. Furthermore, it explains Nixpkgs' approach to 'Purity,' which prevents dependencies on packages outside the Nix store by ensuring tools like GCC and the linker don't search standard system paths. Finally, it details 'Hardening' in Nixpkgs, allowing users to enable or disable security-enhancing compilation and linking flags via `stdenv.mkDerivation` parameters, noting that some flags are enabled by default and support varies by platform and compiler.