diff --git a/pkgs/development/compilers/openjdk/bootstrap.nix b/pkgs/development/compilers/openjdk/bootstrap.nix index 01ed43069b6..222ab010c26 100644 --- a/pkgs/development/compilers/openjdk/bootstrap.nix +++ b/pkgs/development/compilers/openjdk/bootstrap.nix @@ -1,4 +1,4 @@ -{ runCommand, glibc, fetchurl }: +{ stdenv, runCommand, glibc, fetchurl, file }: let # !!! These should be on nixos.org @@ -18,4 +18,12 @@ in runCommand "openjdk-bootstrap" {} '' xz -dc ${src} | sed "s/e*-glibc-[^/]*/$(basename ${glibc})/g" | tar xv mv openjdk-bootstrap $out + + # Temporarily, while NixOS's OpenJDK bootstrap tarball doesn't have PaX markings: + exes=$(${file}/bin/file $out/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//') + for file in $exes; do + paxmark m "$file" + # On x86 for heap sizes over 700MB disable SEGMEXEC and PAGEEXEC as well. + ${stdenv.lib.optionalString stdenv.isi686 ''paxmark msp "$file"''} + done ''