diff --git a/pkgs/os-specific/linux/opensnitch-ebpf/default.nix b/pkgs/os-specific/linux/opensnitch-ebpf/default.nix index 663d00ea3a83..42f214f9ea13 100644 --- a/pkgs/os-specific/linux/opensnitch-ebpf/default.nix +++ b/pkgs/os-specific/linux/opensnitch-ebpf/default.nix @@ -42,10 +42,14 @@ stdenv.mkDerivation rec { libllvm ]; - # We set -fno-stack-protector here to work around a clang regression. - # This is fine - bpf programs do not use stack protectors - # https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=opensnitch-ebpf-module&id=984b952a784eb701f691dd9f2d45dfeb8d15053b - env.NIX_CFLAGS_COMPILE = "-fno-stack-protector"; + env.NIX_CFLAGS_COMPILE = + # We set -fno-stack-protector here to work around a clang regression. + # This is fine - bpf programs do not use stack protectors + # https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=opensnitch-ebpf-module&id=984b952a784eb701f691dd9f2d45dfeb8d15053b + "-fno-stack-protector" + # clang doesn't set this, so we have to + # only relevant after 7.2 due to changes in https://github.com/torvalds/linux/commit/aef4dfa790b22d8052cfb78044eadbe03c876c39 + + lib.optionalString (lib.versionAtLeast kernel.version "7.2") " -DCC_USING_FENTRY"; env.KERNEL_VER = kernel.modDirVersion; env.KERNEL_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/source";