Tried this out on rel12x86, works nice.
Obsolete after rP490765?
This needs more work. A bunch of .hi are being installed under /usr/local/lib/cabal/ghc-8.6.3/. Something like the Debian pandoc package, which has minimal dependencies and essentially just installs a 70 MB binary, would be nice. Although, their package is for quite an old version of pandoc. The Arch package also seems reasonable. The binary is small and the package only depends on the shared libraries, but not ghc.
Here is a new diff. I fixed style bugs found running igor, as suggested by Benedict Reuschling; then I moved the kernel compile options part to the end of the chapter, as requested by Allan Jude.
So the patch limits the max protection to the specified protection. I do not think that this is acceptable, at least not until specifically configured by user.