From af0e598057fcdd487b80f9973df415b707066f01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20St=C3=BChrk?= <andy@yaxi.tech>
Date: Thu, 9 Feb 2023 11:41:09 +0100
Subject: [PATCH] envoy: build with noexecstack

---
 pkgs/servers/http/envoy/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index aed6a36be1d7..4a219a9cfb05 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -149,6 +149,7 @@ buildBazelPackage rec {
     "--spawn_strategy=standalone"
     "--noexperimental_strict_action_env"
     "--cxxopt=-Wno-error"
+    "--linkopt=-Wl,-z,noexecstack"
 
     # Force use of system Java.
     "--extra_toolchains=@local_jdk//:all"