My nixpkgs mirror for patching things.
Go to file
Franz Pletz 4150f5e8ba
cc-wrapper: add stackcheck hardening (stack clash)
This fixes the Stack Clash issue rediscovered by Qualys. See
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
for more information on the topic, specifically section III.

We don't have the kernel mitigation available because it is a Grsecurity
feature which we don't support anymore. Other distributions like Gentoo
Hardened and Arch already have `-fstack-check` enabled by default.

See the Gentoo page on Stack Clash for more information on this solution:
https://wiki.gentoo.org/wiki/Hardened/Gentoo_Hardened_and_Stack_Clash

This unfortunately doesn't apply to clang because `-fstack-check` is a
noop there. Note that the GCC implementation also has problems that could
be exploited to circumvent these checks but it is still better than
keeping it disabled.
2017-06-22 00:41:53 +02:00
.github github issue template: add sandboxing info 2017-05-01 15:38:11 +03:00
doc Merge pull request #26345 from vcunat/p/doc-override-phases 2017-06-19 09:48:01 +02:00
lib add zx2c4 to lib/maintainers.nix 2017-06-13 18:09:16 +01:00
maintainers/scripts Python: improve update script 2017-06-06 17:20:32 +02:00
nixos Merge pull request #26736 from grahamc/improve-nixos-test-debug 2017-06-21 17:26:18 -04:00
pkgs cc-wrapper: add stackcheck hardening (stack clash) 2017-06-22 00:41:53 +02:00
.editorconfig Do not trim trailing whitespace in patch files 2017-01-12 23:44:26 +01:00
.gitignore kde5: consolidate packages into desktops/kde-5 2016-03-01 10:36:00 -06:00
.mention-bot Remove bbenoist from maintainers 2017-03-23 03:03:04 +01:00
.travis.yml Actually disable travis emails 2017-06-03 12:13:29 -04:00
.version version: it's 17.09 not 17.10 2017-02-27 20:46:35 +01:00
COPYING Time passing by 2017-01-01 21:35:52 +01:00
default.nix default.nix: Provide correct instructions how to upgrade Nix 2017-03-18 21:04:07 +02:00
README.md docs: 16.09 -> 17.03 2017-03-30 17:36:44 +02:00

logo

Build Status Code Triagers Badge

Nixpkgs is a collection of packages for the Nix package manager. It is periodically built and tested by the hydra build daemon as so-called channels. To get channel information via git, add nixpkgs-channels as a remote:

% git remote add channels git://github.com/NixOS/nixpkgs-channels.git

For stability and maximum binary package support, it is recommended to maintain custom changes on top of one of the channels, e.g. nixos-17.03 for the latest release and nixos-unstable for the latest successful build of master:

% git remote update channels
% git rebase channels/nixos-17.03

For pull-requests, please rebase onto nixpkgs master.

NixOS linux distribution source code is located inside nixos/ folder.

Communication: