hardened-config: ensure STRICT_KERNEL_RWX

This is y in the default config, but enable it explicitly here to catch situations where it has been disabled (explicitly or implicitly).
2019-01-05 13:43:42 +01:00 · 2019-01-05 13:43:42 +01:00 · dfd77a046d
commit dfd77a046d
parent 1801aad7b8
1 changed files with 3 additions and 0 deletions
--- a/pkgs/os-specific/linux/kernel/hardened-config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened-config.nix
@ -66,6 +66,9 @@ ${optionalString (versionAtLeast version "4.12") ''
 ''}

 DEBUG_WX y # boot-time warning on RWX mappings
+${optionalString (versionAtLeast version "4.11") ''
+  STRICT_KERNEL_RWX y
+''}

 # Stricter /dev/mem
 STRICT_DEVMEM? y