From e15669fa07cda958ba702edfbcd2ca78aefb63a0 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Sat, 16 Sep 2017 00:20:51 +0200 Subject: [PATCH] hardened-config: enable the randstruct plugin (cherry picked from commit 9a763f8f59e9dd03a93fa99170d16f1ad517af0f) --- pkgs/os-specific/linux/kernel/hardened-config.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix index cf2b223a8863..dda7ca6226c9 100644 --- a/pkgs/os-specific/linux/kernel/hardened-config.nix +++ b/pkgs/os-specific/linux/kernel/hardened-config.nix @@ -93,6 +93,11 @@ ${optionalString (versionAtLeast version "4.11") '' GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin ''} +${optionalString (versionAtLeast version "4.13") '' + GCC_PLUGIN_RANDSTRUCT y # A port of the PaX randstruct plugin + GCC_PLUGIN_RANDSTRUCT_PERFORMANCE y +''} + # Disable various dangerous settings ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory PROC_KCORE n # Exposes kernel text image layout