diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix index 8959a99f7b7b..bc02fa5010d3 100644 --- a/nixos/modules/config/malloc.nix +++ b/nixos/modules/config/malloc.nix @@ -52,7 +52,7 @@ let or (throw "scudo not supported on ${pkgs.stdenv.hostPlatform.system}"); in { - libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo_standalone-${systemPlatform}.so"; + libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo-${systemPlatform}.so"; description = '' A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator, which aims at providing additional mitigations against heap based diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index e12eb19b13d8..06e5644f76e9 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -39,7 +39,7 @@ in nix.settings.allowed-users = mkDefault [ "@users" ]; environment.memoryAllocator.provider = mkDefault "scudo"; - environment.variables.SCUDO_OPTIONS = mkDefault "zero_contents=true"; + environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1"; security.lockKernelModules = mkDefault true; diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix index 482185111994..9e67b2bff8e9 100644 --- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix +++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix @@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: { env = { NIX_CFLAGS_COMPILE = toString ( [ - "-DSCUDO_DEFAULT_OPTIONS=delete_size_mismatch=false:dealloc_type_mismatch=false" + "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0" ] ++ lib.optionals (!haveLibc) [ # The compiler got stricter about this, and there is a usellvm patch below