!UNVBThoJtlIiVwiDjU:nixos.org

Staging

314 Members
Staging merges | Running staging cycles: https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+head%3Astaging-next+head%3Astaging-next-25.05 | Review Reports: https://malob.github.io/nix-review-tools-reports/108 Servers

Load older messages


SenderMessageTime
7 Oct 2025
@k900:0upti.meK900I am rebuilding all of Qt, again16:39:01
@k900:0upti.meK900HOPEFULLY this is the last one16:39:48
@dramforever:matrix.orgdramforever
In reply to @grimmauld:grapevine.grimmauld.de
tbh i can't reproduce the issue and i am not familiar enough with pie+asan to judge the impact of just force-disabling asan in audit. unless anyone else has any ideas and/or strong opinions, i'll leave it as is. Willi Butz would you maybe open an upstream issue report?
how about disabling pie
16:40:32
@dramforever:matrix.orgdramforeverthen we go back to what we had in the 25.05 era16:40:47
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)thats also a decent proposal16:40:52
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)i'd probably feel better about that, disabled pie does at least mean probably no runtime crashes of the actual audit userspace16:41:28
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)
diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index 215cda4ba459..71bedbc56352 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -75,6 +75,9 @@ stdenv.mkDerivation (finalAttrs: {
     libcap_ng
   ];
 
+  # audit is built with asan, and asan breaks with pie on some kernels
+  hardeningDisable = [ "pie" ];
+
   configureFlags = [
     # z/OS plugin is not useful on Linux, and pulls in an extra openldap
     # dependency otherwise

Willi Butz could you try this one too maybe (on the machine that breaks)?

16:43:15
@willi:butz.cloudWilli Butzsure16:43:31
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)sorry to make you do the testing, but as long as you have a machine that reproduces i am afraid code-pingpong will be necessary16:44:03
@lt1379:matrix.orgLunthat won't do anything, the hardening flag is dysfunctional and pending removal :/16:44:39
@lt1379:matrix.orgLunNIX_CFLAGS_COMPILE no-pie or something16:44:49
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)oh no16:44:49
@dramforever:matrix.orgdramforeverwait, how did that happen16:45:06
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)won't that break a bunch of shit?16:45:29
@dramforever:matrix.orgdramforeverwhy is it pending removal?16:45:38
@dramforever:matrix.orgdramforevershouldn't we fix it?16:45:55
@lt1379:matrix.orgLunSee https://github.com/NixOS/nixpkgs/pull/439314, https://github.com/NixOS/nixpkgs/pull/44251016:45:56
@dramforever:matrix.orgdramforever... ouch16:46:35
@lt1379:matrix.orgLunLLVM stdenvs already built everything with pie ignoring hardening flags, other distros have been shipping gcc that turns pie on by default since ~2016, so ~everything non-ancient in the ecosystem passes no-pie if needed.16:46:52
@vcunat:matrix.orgVladimír ČunátAnd there's no demand for softening flags.16:47:12
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)
diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index 215cda4ba459..f4dbb79518be 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -75,6 +75,9 @@ stdenv.mkDerivation (finalAttrs: {
     libcap_ng
   ];
 
+  # audit is built with asan, and asan breaks with pie on some kernels
+  env.NIX_CFLAGS_COMPILE = "-no-pie";
+
   configureFlags = [
     # z/OS plugin is not useful on Linux, and pulls in an extra openldap
     # dependency otherwise

try this one then, i guess

16:48:13
@dramforever:matrix.orgdramforeverwell i guess you've thought about pkgsStatic and pkgsMusl so it's probably okay16:48:32
@dramforever:matrix.orgdramforeveri just thought it was dysfunctional before as well16:48:40
@dramforever:matrix.orgdramforeverwhich doesn't make sense16:48:50
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)but tbh i am at the end of my knowledge, i can't repro and i am lost with pie/asan, so this is just throwing shit at the wall and seeing what sticks16:49:01
@lt1379:matrix.orgLunthe dysfunction was in hardeningflags infra rather than just turning it on by default using the toolchain flags everyone else has been using for a decade16:49:04
@lt1379:matrix.orgLunis this some cursed issue where the hardened kernel widens the number of bits used for layout randomization and ASAN assumes it can store info in them?16:49:31
@reckenrode:matrix.orgRandy EckenrodeAre they releasing a new SDK?16:55:15
@willi:butz.cloudWilli Butz (just to confirm, the tests do indeed no longer pass after switching the local machine to 6_12_hardened) 16:56:56
@grimmauld:grapevine.grimmauld.deGrimmauld (any/all)oh thats amazing info!!16:57:16

Show newer messages


Back to Room ListRoom Version: 6