From 870c86d0ee45cb21ab72a6493c2558a2b3213cd0 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Wed, 15 Nov 2017 21:39:50 +0100 Subject: [PATCH] linux_hardened: structleak covers structs passed by address --- pkgs/os-specific/linux/kernel/hardened-config.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix index 7023c113190..a859a3cefbd 100644 --- a/pkgs/os-specific/linux/kernel/hardened-config.nix +++ b/pkgs/os-specific/linux/kernel/hardened-config.nix @@ -100,6 +100,9 @@ GCC_PLUGINS y # Enable gcc plugin options ${optionalString (versionAtLeast version "4.11") '' GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin ''} +${optionalString (versionAtLeast version "4.14") '' + GCC_PLUGIN_STRUCTLEAK_BYREF_ALL y # Also cover structs passed by address +''} # Disable various dangerous settings ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory