Merge pull request #154370 from brandonweeks/kspp

linux: enable FORTIFY_SOURCE
2022-01-30 23:34:45 +01:00
parent 6afa07cd8f fbad6464be
commit f74a2e4840
1 changed files with 2 additions and 0 deletions
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -452,6 +452,8 @@ let
    };

    security = {
+      FORTIFY_SOURCE                   = whenAtLeast "4.13" yes;
+
      # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
      DEBUG_LIST                       = yes;
      # Detect writes to read-only module pages