From 97bf56b78d978b6735d5fb4bc8a72e2e18261bb1 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 28 Sep 2026 11:26:19 +0200 Subject: [PATCH] lix: link with -z,noexecstack Defense-in-depth so a dependency cannot give lix an executable stack, like libucontext did. Signed-off-by: Raito Bezarius --- pkgs/tools/package-management/lix/common-lix.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix index 0247befc396c..a785d8cf2abc 100644 --- a/pkgs/tools/package-management/lix/common-lix.nix +++ b/pkgs/tools/package-management/lix/common-lix.nix @@ -287,6 +287,10 @@ stdenv.mkDerivation (finalAttrs: { "${finalAttrs.cargoDeps}/source-registry-0" else "lix: no `MESON_PACKAGE_CACHE_DIR`, set `cargoDeps`"; + + # Defense-in-depth: never inherit an executable stack from a dependency. + # It does happen: https://github.com/NixOS/nixpkgs/issues/567777. + NIX_LDFLAGS = "-z,noexecstack"; }; propagatedBuildInputs = [