cc-wrapper: add stackcheck hardening (stack clash)

This fixes the Stack Clash issue rediscovered by Qualys. See
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
for more information on the topic, specifically section III.

We don't have the kernel mitigation available because it is a Grsecurity
feature which we don't support anymore. Other distributions like Gentoo
Hardened and Arch already have `-fstack-check` enabled by default.

See the Gentoo page on Stack Clash for more information on this solution:
https://wiki.gentoo.org/wiki/Hardened/Gentoo_Hardened_and_Stack_Clash

This unfortunately doesn't apply to clang because `-fstack-check` is a
noop there. Note that the GCC implementation also has problems that could
be exploited to circumvent these checks but it is still better than
keeping it disabled.

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -1,4 +1,4 @@
-hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
+hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow stackcheck)
 hardeningFlags+=("${hardeningEnable[@]}")
 hardeningCFlags=()
 hardeningLDFlags=()
@@ -50,7 +50,11 @@ if [[ ! $hardeningDisable =~ "all" ]]; then
           if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling bindnow >&2; fi
           hardeningLDFlags+=('-z' 'now')
           ;;
-        *)
+        stackcheck)
+          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling stackcheck >&2; fi
+          hardeningCFlags+=('-fstack-check=specific')
+          ;;
+         *)
           echo "Hardening flag unknown: $flag" >&2
           ;;
       esac