Commit graph

1352 commits

Author SHA1 Message Date
Eelco Dolstra 058bf4ccc4 Create a udev rule for /dev/root
In the installation CD, this ensures that systemd will see a proper
udev node for /dev/root.

Fixes #4399.

Borrowed from

  http://lists.freedesktop.org/archives/systemd-devel/2014-July/020988.html
2014-10-10 17:18:04 +02:00
Eelco Dolstra a85dcf4a00 Merge remote-tracking branch 'origin/master' into staging
Conflicts:
	pkgs/development/libraries/libav/default.nix
	pkgs/shells/bash/bash-4.2-patches.nix
	pkgs/stdenv/generic/default.nix
2014-10-07 00:09:37 +02:00
Eelco Dolstra 97220c973f Replace hasAttr/getAttr calls with the ? and . operators
For NixOS evaluation, this gives a ~21% reduction in the number of
values allocated and a ~4% speedup. It's also more readable.
2014-10-05 01:11:06 +02:00
Franz Pletz 30690d05bc Add cryptodisk support for Grub
Closes #4193
2014-09-24 21:48:55 +01:00
Eelco Dolstra 38d57b4a94 Merge pull request #4244 from abbradar/resume
Replace resumeDevice with autodetection of hibernation partition
2014-09-24 18:05:53 +02:00
Nikolay Amiantov ba31749458 stage-1: Use udevadm instead of blkid 2014-09-24 20:00:51 +04:00
Nikolay Amiantov 18bd9917ed stage-1: autodetect resume swap partitions 2014-09-24 18:51:44 +04:00
William A. Kennington III 13ca3708b5 Fix #4236 2014-09-23 10:18:05 -07:00
Rickard Nilsson 5be23fe888 nixos/install-grub: Don't run GrubFs(/nix/store) if copyKernels is true 2014-09-23 14:34:44 +02:00
Eelco Dolstra 91ec6e0d90 Merge remote-tracking branch 'origin/master' into staging 2014-09-18 22:28:35 +02:00
William A. Kennington III 4d193b7262 systemd: Support reload scripts 2014-09-15 20:04:49 -07:00
Eelco Dolstra 152ae27aac Merge remote-tracking branch 'origin/systemd-216' into staging 2014-09-08 13:53:33 +02:00
Luca Bruno dfa6f03ea3 Do not assert absolute path for nodev grub device. Closes #3996 2014-09-08 12:00:34 +02:00
Thomas Tuegel 53fa517176 Merge pull request #3961 from wkennington/master.grub
nixos/install-grub: Read correct mountpoints
2014-09-05 20:01:08 -05:00
Luca Bruno 718106e958 Fix initrd after recent busybox upgrades 2014-09-05 18:42:53 +02:00
William A. Kennington III c6bd6d6d89 nixos/grub: Assert devices should be absolute paths 2014-09-04 10:31:39 -07:00
William A. Kennington III f73f7ccc6e nixos/install-grub: Read correct mountpoints 2014-09-04 10:31:39 -07:00
Michael Raskin 1a0d437bf3 Merge pull request #3944 from joshcartwright/gummiboot-timeout-fix
gummiboot/builder: fix timeout setting when unset
2014-09-04 20:17:44 +04:00
William A. Kennington III eee8fd89b3 nixos/install-grub: Correct store path for search 2014-09-03 10:01:00 -07:00
Josh Cartwright 626a666da5 gummiboot/builder: fix timeout setting when unset
The gummiboot-builder.py script is expecting the @timeout@ metavar to be
substituted for either an empty string (in the case where a user has
left the timeout unset) or the actual value set in the system
configuration.

However, the config.boot.loader.gummiboot.timeout option defaults to
'null', and due to the way pkgs.substituteAll works, the substitution
for '@timeout@' is _never_ set to the empty string.  This causes the
builder script to put a bogus line into /boot/loader/loader.conf:

   timeout @timeout@

Fix this by explicitly setting 'timeout' to the empty string when it's
unset in the system configuration.

Signed-off-by: Josh Cartwright <joshc@eso.teric.us>
2014-09-03 05:36:45 +02:00
William A. Kennington III ccc758f414 nixos/install-grub: Fix typo 2014-09-02 18:56:53 -07:00
William A. Kennington III 961e9867b3 nixos/generate-config: Only add store search path when kernels are not copied 2014-09-02 09:16:13 -07:00
William A. Kennington III 9467937639 nixos/install-grub: Only check for /nix to be the mountPoint for the store 2014-09-02 09:16:13 -07:00
William A. Kennington III 61908bdd80 nixos/install-grub: Always copy kernels for different devices 2014-09-02 09:16:13 -07:00
William A. Kennington III 01ab1d57a3 nixos/install-grub: Detect nested btrfs subvolumes 2014-09-02 09:16:13 -07:00
William A. Kennington III 0b66483c9a nixos/install-grub: Store path should be /nix/store not /nix 2014-09-02 09:16:13 -07:00
William A. Kennington III 36614ff3e2 Revert "Revert "Merge pull request #2449 from wkennington/master.grub""
This reverts commit 94205f5f21.

Conflicts:
	nixos/modules/system/boot/loader/grub/install-grub.pl
2014-09-02 09:16:13 -07:00
Eelco Dolstra 3d821c068a Merge remote-tracking branch 'origin/master' into systemd-216 2014-09-02 14:43:27 +02:00
Michael Raskin fa55a99701 Load EHCI befor OHCI and UHCI; from patch by Mathnerd314 2014-09-02 02:12:46 +04:00
Longrin Wischnewski 196c6260be grub: fix grub merge error 2014-08-31 12:29:13 +02:00
Michael Raskin 94205f5f21 Revert "Merge pull request #2449 from wkennington/master.grub"
This reverts commit 469f22d717, reversing
changes made to 0078bc5d8f.

Conflicts:
	nixos/modules/installer/tools/nixos-generate-config.pl
	nixos/modules/system/boot/loader/grub/install-grub.pl
	nixos/release.nix
	nixos/tests/installer.nix

I tried to keep apparently-safe code in conflicts.
2014-08-31 12:58:37 +04:00
Nicolas B. Pierron a5d6219897 Merge pull request #3864 from nbp/useless-submodules
Remove useless use of undocumented submodules.
2014-08-30 18:21:17 +02:00
William A. Kennington III 7d16a429f0 nixos/install-grub: Fix Indentation 2014-08-29 12:19:13 -07:00
Nicolas Pierron 8c19690d99 Remove useless use of optionSet. 2014-08-29 18:43:03 +02:00
William A. Kennington III cf7f7a5107 nixos/install-grub: Check /boot against /nix/store instead of /nix 2014-08-28 13:35:37 -07:00
William A. Kennington III 0f6079d999 nixos/grub: Fix spacing and correct subvolume detection 2014-08-28 13:35:36 -07:00
William A. Kennington III 4f096c044f nixos/grub: Simplify detection of labels / uuids for provided device names 2014-08-28 13:35:36 -07:00
William A. Kennington III c02bc3a9de nixos/grub: Fix regex for getting subvolume name in btrfs 2014-08-28 13:35:36 -07:00
William A. Kennington III 3bf22679b3 nixos/grub: Kernels don't need to be copied if we can read the nix store 2014-08-28 13:35:36 -07:00
William A. Kennington III 87d5e457fe nixos/grub: Grub detection is much simpler using subvol show 2014-08-28 13:35:36 -07:00
William A. Kennington III d4a9645ef0 nixos/grub: Needs mount so add utillinux to bin 2014-08-28 13:35:35 -07:00
William A. Kennington III 8329d12b79 grub: Change fsIdentifier to str from string 2014-08-28 13:35:35 -07:00
William A. Kennington III 769d2dc6bf nixos/grub: Catch errors from command execution 2014-08-28 13:35:35 -07:00
William A. Kennington III d4e2040099 nixos/grub: Refactor install-grub.pl and correct perl syntax 2014-08-28 13:35:35 -07:00
William A. Kennington III 99b4792554 nixos/grub: Refactor perl script to remove the Switch module 2014-08-28 13:35:35 -07:00
William A. Kennington III 525acb4d4f nixos/grub: Fix typo 2014-08-28 13:35:35 -07:00
William A. Kennington III 70c11772a6 nixos/grub: Fix some silly perl struct accesses 2014-08-28 13:35:35 -07:00
William A. Kennington III a6e6c85f06 grub: Add support for detecting btrfs subvolumes 2014-08-28 13:35:35 -07:00
William A. Kennington III fba9f641a8 grub: Add support for forcing devices to be identified with labels or UUIDs 2014-08-28 13:35:35 -07:00
William A. Kennington III c5bdb469ce Update the grub configuration script to handle more complex filesystem layouts including full zfs / and /boot 2014-08-28 13:35:35 -07:00
William A. Kennington III 02ab48d0ee Enable grub zfsSupport if zfs is built into the initrd 2014-08-28 13:35:34 -07:00
William A. Kennington III 3c6e2fbba9 Add optional zfsSupport to the nixos grub configuration 2014-08-28 13:35:34 -07:00
William A. Kennington III 4f832b5217 Revert "grub: Allow setting the boot root explicitly"
This reverts commit e4630c1d41.
2014-08-28 13:35:34 -07:00
Shea Levy 4061c18c98 Revert "grub: removed orphaned mkOption configurationName"
The configurationName option value is still used by NixOS, this removal
breaks grub users.

This reverts commit bd811d32b4.
2014-08-27 03:26:40 -04:00
Eelco Dolstra f6b4214567 /dev/sda1 -> "/dev/sda1"
Otherwise Nix might try to copy /dev/sda1 under certain circumstances
:-)
2014-08-26 19:30:45 +02:00
Joachim Schiele bd811d32b4 grub: removed orphaned mkOption configurationName 2014-08-26 19:14:47 +02:00
aszlig 4a4c051a95
nixos: Remove modprobe.d/nixos.conf from initrd.
For example in VM tests, this causes firmware to be included in the
initrd. So until we have a better fix for adding early-stage module
options, I'll remove this.

Fixes a regression introduced by 0aa2c1d and closes #3764.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-08-24 18:19:56 +02:00
Eelco Dolstra c23bf4ec74 systemd: Update to 216 2014-08-23 23:28:03 +02:00
Michael Raskin 0d95c5c647 Merge pull request #3553 from vcunat/p/keyboards
initrd.availableKernelModules: add support for keyboards
2014-08-23 12:49:04 +04:00
Michael Raskin 4a56121d8e Merge pull request #3505 from Shados/fix-initrd-modprobe
initrd: Fixed to include/use modprobe config files
2014-08-23 12:46:28 +04:00
Eelco Dolstra a7a08188bf Containers: Don't remount / 2014-08-18 17:14:43 +02:00
Eelco Dolstra 7c4591d010 Don't barf if /var/log doesn't support ACLs
http://hydra.nixos.org/build/13462892
2014-08-18 14:21:45 +02:00
Vladimír Čunát 02cb604fd6 initrd.availableKernelModules: add support for keyboards
As explained in #2169, some keyboards need special drivers,
so these are always added, both on installation and normal systems.
2014-08-12 20:00:01 +02:00
Alexei Robyn 0aa2c1dc46 initrd: Fixed to include/use modprobe config files 2014-08-09 22:14:52 +10:00
Peter Simons 9226fbf56a Merge remote-tracking branch 'origin/master' into staging. 2014-08-08 09:51:01 +02:00
Eelco Dolstra 0d3b3bd01b systemd: Use the default log target ("journal-or-kmsg")
This ensures that early systemd messages end up in the journal (via
the kmsg buffer).
2014-08-06 14:15:12 +02:00
William A. Kennington III beddd36c95 nixos/stage-1: Don't check resilient filesystems 2014-08-05 21:06:51 +02:00
Peter Simons 2d326e5032 Merge remote-tracking branch 'origin/master' into staging.
Conflicts:
	pkgs/desktops/e18/enlightenment.nix
2014-08-04 16:51:47 +02:00
Eelco Dolstra 549855113b modprobe.nix: Use modern environment.etc syntax 2014-07-31 22:09:51 +02:00
Emery Hemingway 63d259df32 nixos: tmp on tmpfs option
/tmp cleaning is done by systemd rather than stage-2-init
enableEmergencyMode moved from systemd to seperate module
new option to mount tmp on tmpfs
new option to enable additional units shipped with systemd
2014-07-30 16:19:26 +02:00
Eelco Dolstra 39a6750362 Shut up a warning in stage 2 2014-07-30 16:07:09 +02:00
Eelco Dolstra e68b0c7f5f Mount unionfs-fuse filesystems using the normal fileSystems option 2014-07-30 16:04:15 +02:00
Eelco Dolstra d45dcf348e Really fix NixOS/nixos#287 2014-07-30 16:04:15 +02:00
Eelco Dolstra b7c543136a Move CIFS support into a separate module 2014-07-30 12:39:35 +02:00
Eelco Dolstra 9956b97b2f Check for systemd environment variables that are too long
Issue #3403. For the case of $PATH being too long, we could call
buildEnv automatically.
2014-07-30 10:28:05 +02:00
Eelco Dolstra cb7b871bd6 initrd: Include filesystem support for /nix, /var etc. 2014-07-28 22:31:18 +02:00
Eelco Dolstra 7f410ef923 Merge remote-tracking branch 'origin/master' into staging
Conflicts:
	pkgs/misc/vim-plugins/default.nix
2014-07-22 11:00:00 +02:00
Eelco Dolstra 1a1442db74 Don't restart systemd-journal-flush
It only needs to be started during boot. Starting it at other times
shouldn't hurt, except that if systemd-journald is restarting at the
same time, the latter might not have a SIGUSR1 signal handler
installed yet, so it might be killed by systemd-journal-flush. (At
least that's my theory about the dead systemd-journald instances in
the build farm...)
2014-07-17 21:01:25 +02:00
Eelco Dolstra ff97b7dbe6 Merge remote-tracking branch 'origin/master' into staging 2014-07-14 17:04:55 +02:00
Eelco Dolstra 3b2609deec Don't restart systemd-remount-fs
It's only needed during early boot (in fact, it's probably not needed
at all on NixOS). Restarting it is expensive because it does a sync()
of the root file system.
2014-07-11 23:34:58 +02:00
Eelco Dolstra 40f7b0f9df Another attempt to eradicate ensureDir
See c556a6ea46.
2014-06-30 14:56:10 +02:00
Paul Colomiets 11e25f1a3e Implement per-user socket units 2014-06-20 17:41:14 -04:00
Evgeny Egorochkin b415876bdb systemd service: fix issues with escaping when unit name contains '-'
systemd escaping rules translate this into a string containing '\'
which is treated by some code paths as quoted, and by others as unquoted
causing the affected units to fail.
2014-06-11 04:08:13 +03:00
Eelco Dolstra 906aa9ccb1 Make pseudo-filesystems show up as "tmpfs" etc. rather than "none" in df 2014-06-05 13:39:17 +02:00
Shea Levy 57ed344917 Fix /run/keys permissions 2014-05-27 17:22:25 -04:00
Eelco Dolstra c54eb79063 Don't kill unionfs-fuse during shutdown
Killing the daemon backing /nix/store prevents a clean shutdown.  See
http://www.freedesktop.org/wiki/Software/systemd/RootStorageDaemons/
2014-05-21 15:55:50 +02:00
Eelco Dolstra 5e364503d5 NixOS ISO: Don't use a unionfs for /
We don't need a unionfs on /, we only need a tmpfs.
2014-05-21 15:55:50 +02:00
Eelco Dolstra bddd10d75c switch-to-configuration: Don't restart instances of user@.service
Restarting user@ instances is bad because it causes all user services
(such as ssh-agent.service) to be restarted. Maybe one day we can have
switch-to-configuration restart user units in a fine-grained way, but
for now we should just ignore user systemd instances.

Backport: 14.04
2014-05-20 11:12:56 +02:00
Emery Hemingway c96d5fe170 nixos: f2fs filesystem module support (close #2085) 2014-05-11 13:53:26 +02:00
Eelco Dolstra 5bfe944907 Don't run hwclock if /dev/rtc doesn't exist
E.g. on EC2 instances.

Backport: 14.04
2014-05-05 16:47:51 +02:00
Shea Levy e4630c1d41 grub: Allow setting the boot root explicitly
If /boot is a btrfs subvolume, it will be on a different device than /
but not be at the root from grub's perspective. This should be fixed in
a nicer way by #2449, but that can't go into 14.04.
2014-05-01 10:56:55 -04:00
Eelco Dolstra 728d3476ba systemd: Require some more kernel features 2014-04-30 13:53:12 +02:00
Eelco Dolstra 9bb209a3bd gummiboot: Automatically disable GRUB 2014-04-30 11:47:18 +02:00
Eelco Dolstra d621300665 Revert "Don't mount /sys/fs/fuse/connections and /sys/kernel/config"
This reverts commit 6eaced3582. Doesn't
work very well, e.g. if you actually have the FUSE module loaded. And
in any case it's already fixed in NixOps.
2014-04-28 09:19:01 +02:00
Eelco Dolstra 6eaced3582 Don't mount /sys/fs/fuse/connections and /sys/kernel/config
These fail to mount if you don't have the appropriate kernel support,
and this confuses NixOps' ‘check’ command. We should teach NixOps not
to complain about non-essential mount points, but in the meantime it's
better to turn them off.
2014-04-28 08:16:27 +02:00
Eelco Dolstra da444ff26f Turn assertion about oneshot services into a warning 2014-04-22 23:53:21 +02:00
Eelco Dolstra fa3826dcf4 Ignore *.wants in systemd.packages for now 2014-04-22 17:38:53 +02:00
Shea Levy 1c5d3c7883 Merge branch 'modulesfix' of git://github.com/kirelagin/nixpkgs
ohci_pci is required in initrd since kernel 3.11
2014-04-21 07:51:31 -04:00
Kirill Elagin ca7978a09d ohci_pci is required in initrd since kernel 3.11 2014-04-21 15:42:05 +04:00
Eelco Dolstra cf53152902 Fix GRUB 2 example
Fixes #1891.
2014-04-20 19:41:15 +02:00
Eelco Dolstra 9f1c9404da Put /var/setuid-wrappers on a tmpfs
This allows all other filesystems to be mounted without the suid
option.
2014-04-19 12:40:09 +02:00
Eelco Dolstra 2a64b0a91b Shut up warning about resolv.conf missing 2014-04-19 12:34:59 +02:00
Mathijs Kwik bf841cd892 Revert "systemd: oneshot units should be allowed to restart on failure/abort"
This reverts commit c1e638abb6.

As pointed out by wkennington, upstream disallows all cases as of v207
2014-04-18 21:42:22 +02:00
Eelco Dolstra febb15f722 systemd: Enable keeping backlight / rfkill state across reboots 2014-04-18 19:37:15 +02:00
Eelco Dolstra 48d90cf3b6 Revert "Put /nix/var/nix/{temproots,userpool} on a tmpfs"
This reverts commit dd49094a25. Nix
barfs if /nix/var/nix/temproots is a symlink :-(
2014-04-18 18:37:07 +02:00
Eelco Dolstra 1e540af43b Fix broken upstream user unit symlinks 2014-04-18 17:38:06 +02:00
Eelco Dolstra dd49094a25 Put /nix/var/nix/{temproots,userpool} on a tmpfs 2014-04-18 16:56:20 +02:00
Eelco Dolstra c13cede19d Remove long-obsolete /nix/var/nix/chroots directory 2014-04-18 16:50:37 +02:00
Eelco Dolstra 21573af9fb Containers: Use /etc/resolv.conf supplied by the host
This used to work with systemd-nspawn 203, because it bind-mounted
/etc/resolv.conf (so openresolv couldn't overwrite it). Now it's just
copied, so we need some special handling.
2014-04-18 16:48:11 +02:00
Eelco Dolstra 359935a1ef kmod-static-nodes: Drop superfluous wantedBy 2014-04-18 14:51:18 +02:00
Eelco Dolstra 64b968f81f Remove debug line 2014-04-18 02:31:10 +02:00
Eelco Dolstra 12f06ae499 Doh 2014-04-18 01:36:43 +02:00
Eelco Dolstra e34a1589fe Add support for user units
With ‘systemd.user.units’ and ‘systemd.user.services’, you can specify
units used by per-user systemd instances.  For example,

  systemd.user.services.foo =
    { description = "foo";
      wantedBy = [ "default.target" ];
      serviceConfig.ExecStart = "${pkgs.foo}/bin/foo";
    };

declares a unit ‘foo.service’ that gets started automatically when the
user systemd instance starts, and is stopped when the user systemd
instance stops.

Note that there is at most one systemd instance per user: it's created
when a user logs in and there is no systemd instance for that user
yet, and it's removed when the user fully logs out (i.e. has no
sessions anymore). So if you're simultaneously logged in via X11 and a
virtual console, you get only one copy of foo.
2014-04-18 00:38:40 +02:00
Eelco Dolstra 073351a5cf Refactor unit option declarations
This gets rid of some duplication.
2014-04-17 23:35:05 +02:00
Eelco Dolstra 2ad6933a22 Remove special handling of systemd-journal-gatewayd 2014-04-17 19:05:29 +02:00
Eelco Dolstra 179acfb664 Allow upstream systemd units to be extended
If you define a unit, and either systemd or a package in
systemd.packages already provides that unit, then we now generate a
file /etc/systemd/system/<unit>.d/overrides.conf. This makes it
possible to use upstream units, while allowing them to be customised
from the NixOS configuration. For instance, the module nix-daemon.nix
now uses the units provided by the Nix package. And all unit
definitions that duplicated upstream systemd units are finally gone.

This makes the baseUnit option unnecessary, so I've removed it.
2014-04-17 18:52:31 +02:00
Eelco Dolstra 560a1103ad Add option ‘systemd.tmpfiles.rules’
This allows specifying rules for systemd-tmpfiles.

Also, enable systemd-tmpfiles-clean.timer so that stuff is cleaned up
automatically 15 minutes after boot and every day, *if* you have the
appropriate cleanup rules (which we don't have by default).
2014-04-17 16:14:56 +02:00
Eelco Dolstra bb9304e280 Remove creation of /tmp/.ICE-unix
This is now done by tmpfiles.
2014-04-17 16:14:56 +02:00
Mathijs Kwik c1e638abb6 systemd: oneshot units should be allowed to restart on failure/abort 2014-04-17 15:20:39 +02:00
Eelco Dolstra 7ea51b1c6c Enable kmod-static-nodes.service
This creates static device nodes such as /dev/fuse or
/dev/snd/seq. The kernel modules for these devices will be loaded on
demand when the device node is opened.
2014-04-17 14:35:05 +02:00
Eelco Dolstra 317a81ada2 Enable systemd-tmpfiles 2014-04-17 13:23:06 +02:00
Eelco Dolstra 518f710547 Fix module loading in systemd-udevd 2014-04-17 12:26:12 +02:00
Eelco Dolstra 89155dbc01 systemd: Enable user systemd instances 2014-04-17 12:03:04 +02:00
Eelco Dolstra e8af68d2dc Make machinectl work 2014-04-16 10:48:14 +02:00
Eelco Dolstra 566a5c33e8 Set MODULE_DIR in systemd-load-modules.service 2014-04-16 10:43:33 +02:00
William A. Kennington III 85e9ad1b2f stage1: Systemd libraries were renamed 2014-04-16 01:49:42 +02:00
Eelco Dolstra 2fc520d699 Simplify assertion 2014-04-16 01:08:14 +02:00
William A. Kennington III eda854d50f systemd: Add an assertion to guarantee oneshot units do not have restart set
This prevents insidious errors once systemd begins handling the unit. If
the unit is loaded at boot, any errors of this nature are logged to the
console before the journal service is running. This makes it very hard
to diagnose the issue. Therefore, this assertion helps guarantee the
mistake is not made.
2014-04-16 01:05:56 +02:00
Eelco Dolstra ee9c068b0c systemd: Update to 212
Note that systemd no longer depends on dbus, so we're rid of the
cyclic dependency problem between systemd and dbus.

This commit incorporates from wkennington's systemd branch
(203dcff45002a63f6be75c65f1017021318cc839,
1f842558a95947261ece66f707bfa24faf5a9d88).
2014-04-16 00:59:26 +02:00
William A. Kennington III d2ee6e6a24 stage 1: Remove scsi_wait_scan as it is not supported after kernel 3.7 2014-04-15 14:59:39 +02:00
Eelco Dolstra 29027fd1e1 Rewrite ‘with pkgs.lib’ -> ‘with lib’
Using pkgs.lib on the spine of module evaluation is problematic
because the pkgs argument depends on the result of module
evaluation. To prevent an infinite recursion, pkgs and some of the
modules are evaluated twice, which is inefficient. Using ‘with lib’
prevents this problem.
2014-04-14 16:26:48 +02:00
Eelco Dolstra d2155649af Merge branch 'containers'
Fixes #2105.
2014-04-10 15:55:51 +02:00
aszlig 9d8a8126e9
systemd: Add support for path units.
This allows to define systemd.path(5) units, for example like this:

{
  systemd = let
    description = "Set Key Permissions for xyz.key";
  in {
    paths.set-key-perms = {
      inherit description;
      before = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      pathConfig.PathChanged = "/run/keys/xyz.key";
    };

    services.set-key-perms = {
      inherit description;
      serviceConfig.Type = "oneshot";
      script = "chown myspecialkeyuser /run/keys/xyz.key";
    };
  };
}

The example here is actually useful in order to set permissions for the
NixOps keys target to ensure those permisisons aren't reset whenever the
key file is reuploaded.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-03-31 12:33:25 +02:00
Shea Levy 77181be713 Set /run/keys ownership based on numerical ids
See comments on 4ab5646417
2014-03-19 05:18:24 -04:00
Eelco Dolstra 7d8fea797a Run hwclock --hctosys to initialize the system time 2014-03-18 23:14:34 +01:00
Eelco Dolstra 08095f97ce Typo 2014-03-18 22:40:39 +01:00
Eelco Dolstra 511b86d22d Add an option to reload rather than restart changed units 2014-03-17 15:02:53 +01:00
Shea Levy 0c12dd3ded Merge branch 'pkgs/systemd/journald_http_gateway' of git://github.com/offlinehacker/nixpkgs
systemd: python support & journal http gateway

Conflicts:
	nixos/modules/misc/ids.nix
2014-03-14 19:16:59 -04:00
Shea Levy 59a060523e Don't override the baseUnit's PATH by default 2014-03-12 20:03:14 -04:00
Eelco Dolstra e1984f029d autovt@.service really has to be a symlink 2014-03-13 00:19:10 +01:00
Eelco Dolstra f198c40608 Don't depend on the text of disabled units
This prevents pulling in unnecessary dependencies.
2014-03-12 18:52:11 +01:00
Eelco Dolstra 207c881df9 Don't include superfluous lines in generated units 2014-03-12 18:52:11 +01:00
Eelco Dolstra 691c0cd72e systemd: Allow customisation of upstream units
You can now say:

  systemd.services.foo.baseUnit = "${pkgs.foo}/.../foo.service";

This will cause NixOS' generated foo.service file to include
foo.service from the foo package.  You can then apply local
customization in the usual way:

  systemd.services.foo.serviceConfig.MemoryLimit = "512M";

Note however that overriding options in the original unit may not
work.  For instance, you cannot override ExecStart.

It's also possible to customize instances of template units:

  systemd.services."getty@tty4" =
    { baseUnit = "/etc/systemd/system/getty@.service";
      serviceConfig.MemoryLimit = "512M";
    };

This replaces the unit options linkTarget (which didn't allow
customisation) and extraConfig (which did allow customisation, but in
a non-standard way).
2014-03-12 18:52:10 +01:00
Ellis Whitehead 9af5d4731d typo: occured -> occurred 2014-03-07 19:39:55 +01:00
Eelco Dolstra 6572708d39 Always load the "configs" kernel module
We used to have the configuration of the kernel available in a
somewhat convenient place (/run/booted-system/kernel-modules/config)
but that has disappeared.  So instead just make /proc/configs.gz
available.  It only eats a few kilobytes.
2014-03-05 15:22:32 +01:00
Shea Levy 32470621d5 Restart keys.target on reconfiguration 2014-02-26 13:35:04 -05:00
Eelco Dolstra d2aa2ac494 memtest.nix: Use toString 2014-02-18 19:13:07 +01:00
Petr Rockai 42ce480a52 nixos: Try harder to get LVM-hosted filesystems up in stage1. 2014-02-15 12:57:17 +01:00
Shea Levy 4ab5646417 Add a keys group with read access to /run/keys
This allows processes running as unprivileged users access to keys they might need
2014-02-11 07:00:10 -05:00
Bjørn Forsman 48851fa749 nixos/memtest: use docbook formatting
Without this the HTML manual and manpage is quite unreadable (newlines
are squashed so it doesn't look like a list anymore).

(Unfortunately, this makes the source unreadable.)
2014-02-09 13:56:09 +01:00
Ricardo M. Correia cba2444d11 nixos/memtest: Allow user to specify memtest86 boot parameters 2014-02-09 13:55:37 +01:00
Petr Rockai 12315a278c Merge branch 'yubikey' of git://github.com/Calrama/nixpkgs 2014-02-08 16:01:22 +01:00
Moritz Maxeiner 09f9af17b4 Update to the Yubikey PBA
Security-relevant changes:
 * No (salted) passphrase hash send to the yubikey, only hash of the salt (as it was in the original implementation).
 * Derive $k_luks with PBKDF2 from the yubikey $response (as the PBKDF2 salt) and the passphrase $k_user
   (as the PBKDF2 password), so that if two-factor authentication is enabled
   (a) a USB-MITM attack on the yubikey itself is not enough to break the system
   (b) the potentially low-entropy $k_user is better protected against brute-force attacks
 * Instead of using uuidgen, gather the salt (previously random uuid / uuid_r) directly from /dev/random.
 * Length of the new salt in byte added as the parameter "saltLength", defaults to 16 byte.
   Note: Length of the challenge is 64 byte, so saltLength > 64 may have no benefit over saltLengh = 64.
 * Length of $k_luks derived with PBKDF2 in byte added as the parameter "keyLength", defaults to 64 byte.
   Example: For a luks device with a 512-bit key, keyLength should be 64.
 * Increase of the PBKDF2 iteration count per successful authentication added as the
   parameter "iterationStep", defaults to 0.

Other changes:
 * Add optional grace period before trying to find the yubikey, defaults to 2 seconds.

Full overview of the yubikey authentication process:

  (1) Read $salt and $iterations from unencrypted device (UD).
  (2) Calculate the $challenge from the $salt with a hash function.
      Chosen instantiation: SHA-512($salt).
  (3) Challenge the yubikey with the $challenge and receive the $response.
  (4) Repeat three times:
    (a) Prompt for the passphrase $k_user.
    (b) Derive the key $k_luks for the luks device with a key derivation function from $k_user and $response.
        Chosen instantiation: PBKDF2(HMAC-SHA-512, $k_user, $response, $iterations, keyLength).
    (c) Try to open the luks device with $k_luks and escape loop (4) only on success.
  (5) Proceed only if luks device was opened successfully, fail otherwise.

  (6) Gather $new_salt from a cryptographically secure pseudorandom number generator
      Chosen instantiation: /dev/random
  (7) Calculate the $new_challenge from the $new_salt with the same hash function as (2).
  (8) Challenge the yubikey with the $new_challenge and receive the $new_response.
  (9) Derive the new key $new_k_luks for the luks device in the same manner as in (4) (b),
      but with more iterations as given by iterationStep.
 (10) Try to change the luks device's key $k_luks to $new_k_luks.
 (11) If (10) was successful, write the $new_salt and the $new_iterations to the UD.
      Note: $new_iterations = $iterations + iterationStep

Known (software) attack vectors:

 * A MITM attack on the keyboard can recover $k_user. This, combined with a USB-MITM
   attack on the yubikey for the $response (1) or the $new_response (2) will result in
   (1) $k_luks being recovered,
   (2) $new_k_luks being recovered.
 * Any attacker with access to the RAM state of stage-1 at mid- or post-authentication
   can recover $k_user, $k_luks, and  $new_k_luks
 * If an attacker has recovered $response or $new_response, he can perform a brute-force
   attack on $k_user with it without the Yubikey needing to be present (using cryptsetup's
   "luksOpen --verify-passphrase" oracle. He could even make a copy of the luks device's
   luks header and run the brute-force attack without further access to the system.
 * A USB-MITM attack on the yubikey will allow an attacker to attempt to brute-force
   the yubikey's internal key ("shared secret") without it needing to be present anymore.

Credits:

 * Florian Klien,
   for the original concept and the reference implementation over at
   https://github.com/flowolf/initramfs_ykfde
 * Anthony Thysse,
   for the reference implementation of accessing OpenSSL's PBKDF2 over at
   http://www.ict.griffith.edu.au/anthony/software/pbkdf2.c
2014-02-08 14:59:52 +01:00
Jaka Hudoklin 616b4b5b0e nixos/systemd: add journal http gateway support 2014-02-06 16:21:19 +01:00
Shea Levy bfc682ea37 Mount a ramfs on /run/keys for safe key storage for nixops
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-05 08:00:19 -05:00
Shea Levy 1e0352f801 Fix gummiboot builder
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-05 07:54:11 -05:00
Shea Levy 5e72e36f95 gummiboot-builder.py: Remove old entries before adding new ones
Fixes #1483

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-03 17:41:31 -05:00
Moritz Maxeiner 8e74e1fded Replace the current Yubikey PBA implementation with the previous one.
Rationale:
  * The main reason for choosing to implement the PBA in accordance
    with the Yubico documentation was to prevent a MITM-USB-attack
    successfully recovering the new LUKS key.
  * However, a MITM-USB-attacker can read user id and password when
    they were entered for PBA, which allows him to recover the new
    challenge after the PBA is complete, with which he can challenge
    the Yubikey, decrypt the new AES blob and recover the LUKS key.
  * Additionally, since the Yubikey shared secret is stored in the
    same AES blob, after such an attack not only is the LUKS device
    compromised, the Yubikey is as well, since the shared secret
    has also been recovered by the attacker.
  * Furthermore, with this method an attacker could also bruteforce
    the AES blob, if he has access to the unencrypted device, which
    would again compromise the Yubikey, should he be successful.
  * Finally, with this method, once the LUKS key has been recovered
    once, the encryption is permanently broken, while with the previous
    system, the LUKS key itself it changed at every successful boot,
    so recovering it once will not necessarily result in a permanent
    breakage and will also not compromise the Yubikey itself (since
    its secret is never stored anywhere but on the Yubikey itself).

Summary:
The current implementation opens up up vulnerability to brute-forcing
the AES blob, while retaining the current MITM-USB attack, additionally
making the consequences of this attack permanent and extending it to
the Yubikey itself.
2014-02-03 22:50:17 +01:00
Vladimír Čunát b5a32b3944 Merge #1618: use ubuntu module blacklists by default 2014-02-02 15:51:07 +01:00
Moritz Maxeiner 7bf94cadad Add library dependencies explicitly 2014-01-29 18:49:26 +01:00
Moritz Maxeiner e96f58ef5c Implement muli-user authentication for yubikey pba, i.e. multiple users can now share a single luks keyslot.
This is achieved by having multiple lines per storage file, one for each user (if the feature is enabled); each of these
lines has the same format as would be the case for the userless authentication, except that they are prepended with a
SHA-512 of the user's id.
2014-01-29 17:20:05 +01:00
Moritz Maxeiner 20cfaf0faa Change the crypt-storage file to be hex encoded instead of raw binary. To update from the previous configuration, convert your crypt-storage file from raw binary to hex. 2014-01-29 13:58:35 +01:00
Moritz Maxeiner cce9712331 Enable two-factor authentication by default. Add proper descriptions to attributes. 2014-01-29 12:55:32 +01:00
Moritz Maxeiner 45b1ffb8db Cosmetic change to yubikey detection 2014-01-28 20:39:46 +01:00
Vladimír Čunát 5acaa980a5 pull module blacklist from Ubuntu and use it by default
People often have serious problems due to bogus modules like *fb.
2014-01-28 12:52:36 +01:00
Moritz Maxeiner 407a770161 Rewrite as a pre-boot authentication module (mostly) comforming to the design specification of
'YubiKey Integration for Full Disk Encryption Pre-Boot Authentication (Copyright) Yubico, 2011 Version: 1.1'.

Used binaries:
  * uuidgen - for generation of random sequence numbers
  * ykchalresp - for challenging a Yubikey
  * ykinfo - to check if a Yubikey is plugged in at boot (fallback to passphrase authentication otherwise)
  * openssl - for calculation of SHA-1, HMAC-SHA-1, as well as AES-256-CTR (de/en)cryption

Main differences to the specification mentioned above:
  * No user management (yet), only one password+yubikey per LUKS device
  * SHA-512 instead of CRC-16 for checksum

Main differences to the previous implementation:
  * Instead of changing the key slot of the LUKS device each boot,
    the actual key for the LUKS device will be encrypted itself
  * Since the response for the new challenge is now calculated
    locally with openssl, the MITM-USB-attack with which previously
    an attacker could obtain the new response (that was used as the new
    encryption key for the LUKS device) by listening to the
    Yubikey has ideally become useless (as long as uuidgen can
    successfuly generate new random sequence numbers).

Remarks:
  * This is not downwards compatible to the previous implementation
2014-01-28 04:02:51 +01:00
Moritz Maxeiner 333f5caaf9 Implement authentication for a LUKS device with a yubikey (HMAC-SHA1); supports simple challenge-response and two-factor authentication 2014-01-25 03:33:09 +01:00
Shea Levy ca7805be94 systemd: Enable specifying extra config files for a unit
This will allow overriding package-provided units, or overriding only a
specific instance of a unit template.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-18 11:10:39 -05:00
Shea Levy 48daf624c5 Add module to use kmscon instead of linux-console for VTs
This required some changes to systemd unit handling:

* Add an option to specify that a unit is just a symlink
* Allow specified units to overwrite systemd-provided ones
* Have gettys.target require autovt@1.service instead of getty@1.service

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Shea Levy b0000b29af gummiboot module: Don't use obsolete environment.nix option
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-05 15:53:39 -05:00
Lluís Batlle i Rossell 152da7671c nixos initrd: load atkbd, not xtkbd
I don't think anyone has a XT keyboard in a computer running nixos.
2013-12-23 09:01:45 +01:00
Song Wenwu c4885173b6 systemd: add services.journald.extraConfig option 2013-11-30 22:42:01 +01:00
Eelco Dolstra 9ee30cd9b5 Add support for lightweight NixOS containers
You can now say:

  systemd.containers.foo.config =
    { services.openssh.enable = true;
      services.openssh.ports = [ 2022 ];
      users.extraUsers.root.openssh.authorizedKeys.keys = [ "ssh-dss ..." ];
    };

which defines a NixOS instance with the given configuration running
inside a lightweight container.

You can also manage the configuration of the container independently
from the host:

  systemd.containers.foo.path = "/nix/var/nix/profiles/containers/foo";

where "path" is a NixOS system profile.  It can be created/updated by
doing:

  $ nix-env --set -p /nix/var/nix/profiles/containers/foo \
      -f '<nixos>' -A system -I nixos-config=foo.nix

The container configuration (foo.nix) should define

  boot.isContainer = true;

to optimise away the building of a kernel and initrd.  This is done
automatically when using the "config" route.

On the host, a lightweight container appears as the service
"container-<name>.service".  The container is like a regular NixOS
(virtual) machine, except that it doesn't have its own kernel.  It has
its own root file system (by default /var/lib/containers/<name>), but
shares the Nix store of the host (as a read-only bind mount).  It also
has access to the network devices of the host.

Currently, if the configuration of the container changes, running
"nixos-rebuild switch" on the host will cause the container to be
rebooted.  In the future we may want to send some message to the
container so that it can activate the new container configuration
without rebooting.

Containers are not perfectly isolated yet.  In particular, the host's
/sys/fs/cgroup is mounted (writable!) in the guest.
2013-11-27 17:14:10 +01:00
Eelco Dolstra 953f12995b nscd: Fix LD_LIBRARY_PATH
This ensures that nscd can find the NSS modules.

Fixes #1248.
2013-11-26 18:38:22 +01:00
Eelco Dolstra 14cd8bc248 Allow services to specify a pre-stop script 2013-11-26 18:24:55 +01:00
Eelco Dolstra 2b1f212494 Disable various services when running inside a container 2013-11-26 18:19:45 +01:00
Eelco Dolstra dc87f8e080 Check whether fileSystems defines the root FS 2013-11-18 18:04:16 +01:00
Eelco Dolstra 8951be2d80 Allow overrides to work for unit options 2013-11-18 18:04:16 +01:00
Eelco Dolstra 33cb0bbb4b Use types.lines for script/preStart/postStart/postStop 2013-11-18 18:04:16 +01:00
Eelco Dolstra 5620e69b5d Apply better type checking to unitConfig/serviceConfig/...
In particular, complain if two modules define the same systemd option.
2013-11-18 18:04:16 +01:00
Eelco Dolstra f8a034172a Fix broken Conflicts options 2013-11-18 18:04:16 +01:00
Eelco Dolstra 08a85c2152 Allow building/testing individual systemd units 2013-11-18 18:04:16 +01:00
Ricardo M. Correia 36a05c7b15 systemd: Add systemd.extraConfig option for /etc/systemd/system.conf 2013-11-16 16:50:59 +01:00
Ricardo M. Correia e0171ef026 systemd: Change services.logind.extraConfig type to types.lines 2013-11-16 16:50:59 +01:00
Eelco Dolstra 4cada34b7f Properly handle unit names with dashes in them
We ended up with files in /etc/systemd/system called
"bigx2ddata.mount.wants" rather than "big\x2ddata.mount.wants".
2013-11-12 16:58:36 +01:00
Eelco Dolstra 408b8b5725 Add lots of missing option types 2013-10-30 18:47:43 +01:00
Eelco Dolstra d882e19662 Shut up "failed to resume" warning if there is no resume device 2013-10-30 18:47:43 +01:00
Eelco Dolstra be5d3a59dd Clean up some option examples 2013-10-30 18:47:43 +01:00
Eelco Dolstra 70a2c54527 Strictly check the arguments to mkOption
And fix various instances of bad arguments.
2013-10-30 15:35:09 +01:00
Eelco Dolstra 4680af6a93 Add some option types 2013-10-30 14:57:42 +01:00
Eelco Dolstra 862e3dd977 Substitute "types.uniq types.string" -> "types.str" 2013-10-30 14:57:42 +01:00
Eelco Dolstra 9a8516438e Fix NixOps evaluation 2013-10-28 22:45:57 +01:00
Eelco Dolstra d5047faede Remove uses of the "merge" option attribute
It's redundant because you can (and should) specify an option type, or
an apply function.
2013-10-28 22:45:56 +01:00
Eelco Dolstra a40583e7e4 Fix bogus mkOption types
Among others, systemd unit options were not being type-checked because
of this.  mkOption should really check its arguments better...
2013-10-28 22:45:56 +01:00
Eelco Dolstra 1408ac51a4 Add missing types 2013-10-28 22:45:56 +01:00
Eelco Dolstra 4b1a9dd00b Remove uses of mkFixStrictness
mkFixStrictness is no longer needed, woohoo!
2013-10-28 22:45:55 +01:00
Eelco Dolstra c4149c7b56 Fix evaluation error in the ISOs 2013-10-24 02:03:10 +02:00
Eelco Dolstra a3777ba4f9 Remove dependencies on the Nixpkgs location 2013-10-23 20:08:23 +02:00
Eelco Dolstra 8f4c5b05d5 Add a way to define obsolete options that have no replacement 2013-10-23 20:08:22 +02:00
Eelco Dolstra b33657df03 grub: Make assertion lazier 2013-10-17 13:30:49 +02:00
Shea Levy a63b4dc555 Remove old efi boot stub bootloader
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-10 10:54:35 -04:00
Eelco Dolstra 5c1f8cbc70 Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00