From 0f7ca26a48389bf9133573f5eaf2d7b30cf51625 Mon Sep 17 00:00:00 2001 From: Pierre Bourdon Date: Fri, 4 Jan 2019 02:08:49 +0100 Subject: [PATCH] kernel/hardened-config.nix: add STACKLEAK plugin on 4.20+ --- pkgs/os-specific/linux/kernel/hardened-config.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix index 2454ecd0b05..9d28b3edf85 100644 --- a/pkgs/os-specific/linux/kernel/hardened-config.nix +++ b/pkgs/os-specific/linux/kernel/hardened-config.nix @@ -113,6 +113,9 @@ ${optionalString (versionAtLeast version "4.11") '' ${optionalString (versionAtLeast version "4.14") '' GCC_PLUGIN_STRUCTLEAK_BYREF_ALL y # Also cover structs passed by address ''} +${optionalString (versionAtLeast version "4.20") '' + GCC_PLUGIN_STACKLEAK y # A port of the PaX stackleak plugin +''} # Disable various dangerous settings ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory