[staging-next] Reapply "onnxruntime,python3.pkgs.onnxruntime: fix runtime w/ glibc-2.42"

This reverts commit a2f23245d9.

pkgs/by-name/on/onnxruntime/package.nix

@@ -317,26 +317,28 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL_CK_TILE" false)
   ];
 
-  env =
-    lib.optionalAttrs rocmSupport {
-      MIOPEN_PATH = rocmPackages.miopen;
-      # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
-      # fatal error: 'rocrand/rocrand.h' file not found
-      HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
-        rocmPackages.hipblas
-        rocmPackages.hipcub
-        rocmPackages.hiprand
-        rocmPackages.hipsparse
-        rocmPackages.rocblas
-        rocmPackages.rocprim
-        rocmPackages.rocrand
-        rocmPackages.rocthrust
-      ];
-    }
-    // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
-      NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
-      GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
-    };
+  env = {
+    NIX_LDFLAGS = "-z,noexecstack";
+  }
+  // lib.optionalAttrs rocmSupport {
+    MIOPEN_PATH = rocmPackages.miopen;
+    # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
+    # fatal error: 'rocrand/rocrand.h' file not found
+    HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
+      rocmPackages.hipblas
+      rocmPackages.hipcub
+      rocmPackages.hiprand
+      rocmPackages.hipsparse
+      rocmPackages.rocblas
+      rocmPackages.rocprim
+      rocmPackages.rocrand
+      rocmPackages.rocthrust
+    ];
+  }
+  // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
+    NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
+    GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
+  };
 
   doCheck =
     !(

pkgs/development/python-modules/onnxruntime/default.nix

@@ -38,6 +38,10 @@ buildPythonPackage {
     chmod +w dist
   '';
 
+  env = {
+    NIX_LDFLAGS = "-z,noexecstack";
+  };
+
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   # This project requires fairly large dependencies such as sympy which we really don't always need.