From a69501a936a6434fbe88fb6a0423dd425563c163 Mon Sep 17 00:00:00 2001
From: Joachim Fasting <joachifm@fastmail.fm>
Date: Mon, 2 May 2016 07:27:29 +0200
Subject: [PATCH] grsecurity: ensure that PaX ELF markings are enabled

The upstream default is to enable only xattr markings, breaking the
paxmarks facility.
---
 pkgs/build-support/grsecurity/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/build-support/grsecurity/default.nix b/pkgs/build-support/grsecurity/default.nix
index 6c2e98b9cc1..0addb1d3d45 100644
--- a/pkgs/build-support/grsecurity/default.nix
+++ b/pkgs/build-support/grsecurity/default.nix
@@ -90,6 +90,10 @@ let
         GRKERNSEC y
         ${grsecMainConfig}
 
+        # The paxmarks mechanism relies on ELF header markings, but the default
+        # grsecurity configuration only enables xattr markings
+        PAX_PT_PAX_FLAGS y
+
         ${if cfg.config.restrictProc then
             "GRKERNSEC_PROC_USER y"
           else