Issue description
It would be good for the security of NixOS to compile user-space with -fstack-clash-protection. It should probably be added either as a new hardening flag or perhaps included as part of the stackprotector flag.
Motivation
CVE-2018-16864 and CVE-2018-16865 describe new vulnerabilities and exploits in systemd which -fstack-clash-protection can mitigate, according to the linked advisory:
SUSE Linux Enterprise 15, openSUSE Leap 15.0, and Fedora
28 and 29 are not exploitable because their user space is compiled with
GCC's -fstack-clash-protection
However, since NixOS doesn't compile user-space with -fstack-clash-protection, it's likely to be vulnerable.
Issue description
It would be good for the security of NixOS to compile user-space with
-fstack-clash-protection. It should probably be added either as a new hardening flag or perhaps included as part of thestackprotectorflag.Motivation
CVE-2018-16864 and CVE-2018-16865 describe new vulnerabilities and exploits in systemd which
-fstack-clash-protectioncan mitigate, according to the linked advisory:However, since NixOS doesn't compile user-space with
-fstack-clash-protection, it's likely to be vulnerable.