Commit graph

7441 commits

Author SHA1 Message Date
Jörg Thalheim 361314ca71
nixos-prepare-root: force symlink at /run
Otherwise a reinstall will fail.
2017-05-01 16:10:58 +02:00
Michael Raskin 938fbf6873 Merge pull request #25116 from rvl/gogs
Gogs service password handling improvements
2017-05-01 14:26:22 +02:00
Michael Raskin b28e2788e2 Merge pull request #25009 from dermetfan/fix-znapzend-service
znapzend service: fix reload
2017-05-01 13:24:24 +02:00
Michael Raskin 98a36b2847 Merge pull request #23709 from lheckemann/xserver-layout-existence
xserver: check that selected layout exists
2017-05-01 12:16:59 +02:00
Jörg Thalheim 036e0f114a gogs: improve cookieSecure documentation 2017-05-01 11:37:12 +02:00
Michael Raskin 4d2f7b63e0 Merge pull request #24803 from pajowu/master
browserpass: init at 1.0.2
2017-05-01 11:27:17 +02:00
Peter Marheine fd1f1aca9e release notes: incompatible flexget upgrade 2017-05-01 10:10:34 +02:00
Michael Raskin 7e19fcddcc Merge pull request #24366 from rvl/longview-password-file
longview service: don't write passwords to nix store
2017-05-01 09:39:35 +02:00
Michael Raskin 90ce1aa28a Merge branch 'master' into clickhouse 2017-05-01 07:33:31 +02:00
Michael Raskin 01ba1a40d3 Merge pull request #24341 from LumiGuide/cadviser-storageDriverPasswordFile
cadviser: add storageDriverPasswordFile option
2017-05-01 02:01:49 +02:00
Michael Raskin 6b31de49cf Merge pull request #24005 from ambrop72/xcursor-path
nixos: Define XCURSOR_PATH environment variable.
2017-04-30 23:01:57 +02:00
Michael Raskin 1c8d388201 Merge pull request #23865 from volth/xrdp-tests
xrdp: init at 0.9.2
2017-04-30 22:35:48 +02:00
Michael Raskin d5ec7bc748 Merge pull request #23697 from sargon/master
sshguard + service: init at 2.0.0
2017-04-30 21:43:12 +02:00
Bjørn Forsman c282de7103 nixos/munin: remove duplicated /run/current-system/sw/bin path
A side effect of commit ff21171921
("Fix references to current-system/sw/sbin"). It changed "sbin" to "bin"
but didn't check for duplicates.
2017-04-30 21:04:51 +02:00
Michael Raskin eedc0f0a78 Merge pull request #23333 from romildo/upd.qt5ct
qt5ct: 0.24 -> 0.30
2017-04-30 19:42:31 +02:00
Michael Raskin 929ae39dbe Merge pull request #22683 from aneeshusa/add-nixos-test-for-radicale
Add nixos test for radicale
2017-04-30 18:51:46 +02:00
Michael Raskin a5d36429dc Merge pull request #22489 from avnik/nixos-locales
nixos:  allow supply customized locale package
2017-04-30 18:19:31 +02:00
Joachim Fasting 56e1133d75
nixos/lock-kernel-modules: fix typo in unitConfig
I managed to miss this one somehow ... meh
2017-04-30 15:17:29 +02:00
Joachim Fasting a1678269f9
nixos/hardened profile: disable user namespaces at runtime 2017-04-30 15:17:27 +02:00
Thomas Tuegel 4e0d21edd1 Merge pull request #25285 from ttuegel/qt--fix-plugin-paths
Qt: purify plugin paths, unify Linux and Darwin builders
2017-04-30 07:33:50 -05:00
Vladimír Čunát eb4792a03f
nixos manual: add a note about "nofail" FS option
Close #1858, as I think the points have been well resolved.
2017-04-30 14:10:30 +02:00
Michael Raskin 689916b98f Merge pull request #25337 from benley/nm-dnsmasq
nixos: optional NetworkManager dnsmasq integration
2017-04-30 12:18:34 +02:00
Joachim Fasting 1dd3ba924b
nixos/hardened profile: disable hibernation
Recommended by KSPP
2017-04-30 12:06:11 +02:00
Joachim Fasting ffa83edf4a
nixos/tests: add tests for exercising various hardening features
This test exercises the linux_hardened kernel along with the various
hardening features (enabled via the hardened profile).

Move hidepid test from misc, so that misc can go back to testing a vanilla
configuration.
2017-04-30 12:05:42 +02:00
Joachim Fasting ab4fa1cce4
tree-wide: prune some dead grsec leaves
The beginning of pruning grsecurity/PaX from the tree.
2017-04-30 12:05:41 +02:00
Joachim Fasting 8c98e8ca2f
nixos/hardened profile: use the linux_hardened kernel 2017-04-30 12:05:40 +02:00
Joachim Fasting 6a5a5728ee
nixos/hardened profile: lock kernel modules 2017-04-30 12:05:38 +02:00
Joachim Fasting 878ad1ce6e
nixos: add option to lock kernel modules
Adds an option `security.lockKernelModules` that, when enabled, disables
kernel module loading once the system reaches its normal operating state.

The rationale for this over simply setting the sysctl knob is to allow
some legitmate kernel module loading to occur; the naive solution breaks
too much to be useful.

The benefit to the user is to help ensure the integrity of the kernel
runtime: only code loaded as part of normal system initialization will be
available in the kernel for the duration of the boot session.  This helps
prevent injection of malicious code or unexpected loading of legitimate
but normally unused modules that have exploitable bugs (e.g., DCCP use
after free CVE-2017-6074, n_hldc CVE-2017-2636, XFRM framework
CVE-2017-7184, L2TPv3 CVE-2016-10200).

From an aestethic point of view, enabling this option helps make the
configuration more "declarative".

Closes https://github.com/NixOS/nixpkgs/pull/24681
2017-04-30 12:05:37 +02:00
Jörg Thalheim fa5196e47e Merge pull request #25005 from Lassulus/copytoram
nixos/stage1: add copytoram support
2017-04-30 11:22:45 +02:00
Benjamin Staffin 9827d5f95c
nixos: optional NetworkManager dnsmasq integration 2017-04-30 00:44:19 -07:00
Volth 5e8ad49de8 do not create non-deterministic file (rsakeys.ini) in nixstore 2017-04-29 17:23:35 +00:00
volth dad760061e xrdp: init at 0.9.1 2017-04-29 17:23:35 +00:00
Michael Weiss 852813689a desktop-managers: Use a black BG as fallback
Use a solid black background when no background image (via
~/.background-image) is provided. In my case this fixes the really
strange behaviour when i3 without a desktop manager starts with the SDDM
login screen as background image.
2017-04-29 19:03:30 +02:00
Joachim Fasting 63433537ce
nixos/hardened profile: disable legacy virtual syscalls
This eliminates a theoretical risk of ASLR bypass due to the fixed address
mapping used by the legacy vsyscall mechanism.  Modern glibc use vdso(7)
instead so there is no loss of functionality, but some programs may fail
to run in this configuration.  Programs that fail to run because vsyscall
has been disabled will be logged to dmesg.

For background on virtual syscalls see https://lwn.net/Articles/446528/

Closes https://github.com/NixOS/nixpkgs/pull/25289
2017-04-29 17:27:11 +02:00
Jörg Thalheim ffdc1b0ab0 Merge pull request #25310 from jerith666/command-not-found-is-a-dir
fix 'command-not-found: is a directory' error
2017-04-29 11:41:22 +02:00
Robin Gloster edb1ea055e
confluence module: needs bash for health checks 2017-04-29 11:15:59 +02:00
Matt McHenry 48a3e1a88d fix 'command-not-found: is a directory' error 2017-04-28 23:11:21 -04:00
Michael Weiss 1273f414a7 display-managers: Fix the xsession parameters
The xsession script was called with inconsistent (depending on the
display managers) and wrong parameters. The main reason for this where
the spaces the parameter syntax. In order to fix this the old syntax:
$1 = '<desktop-manager> + <window-manager>'
Will be replaced with a new syntax:
$1 = "<desktop-manager>+<window-manager>"

This assumes that neither "<desktop-manager>" nor "<window-manager>"
contain the "+" character but this shouldn't be a problem.

This patch also fixes the quoting by using double quotes (") instead of
single quotes (') [0].

Last but not least this'll add some comments for the better
understanding of the script.

[0]: https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s06.html
2017-04-28 22:00:14 +02:00
lassulus 87a4615e27 nixos/stage1: add copytoram support 2017-04-28 20:48:09 +02:00
Pascal Wittmann c03d1df5b8 Merge pull request #25110 from iSma/fix/trackpoint-scrolling-etps-elantech
Add Elantech ETPS/2 Trackpoint (ThinkPad Yoga 260)
2017-04-28 15:46:39 +02:00
Domen Kožar 330e800496
nixos: hydra: sync with upstream hydra module 2017-04-28 14:51:25 +02:00
Joachim F 38c98d1072 Merge pull request #25128 from jb55/fix/plex-startup
plex: fix startup issue
2017-04-28 12:48:55 +01:00
Joachim F 0c40ea7340 Merge pull request #21227 from lheckemann/vgaswitcheroo
amd-hybrid-graphics: fix race condition
2017-04-28 12:47:00 +01:00
Thomas Tuegel b70837e054
nixos/plasma5: set system-wide QT_PLUGIN_PATH 2017-04-28 05:54:18 -05:00
Joachim Fasting 32b8512e54
grsecurity: discontinue support
Upstream has decided to make -testing patches private, effectively ceasing
free support for grsecurity/PaX [1].  Consequently, we can no longer
responsibly support grsecurity on NixOS.

This patch turns the kernel and patch expressions into build errors and
adds a warning to the manual, but retains most of the infrastructure, in
an effort to make the transition smoother.  For 17.09 all of it should
probably be pruned.

[1]: https://grsecurity.net/passing_the_baton.php
2017-04-28 12:35:15 +02:00
Alexey Shmalko a012b15f87 Merge pull request #25181 from indiscipline/aria2.service
Implement aria2 service for controlling a daemon via rpc.
2017-04-28 12:37:06 +03:00
Judson Lester 0d72629570 nixos/display-managers: Quote "$vars" (#25199) 2017-04-27 18:01:48 +02:00
Franz Pletz dab5f92ed5 Merge pull request #25210 from Ma27/zsh/refactor-syntax-highlighting
programs.zsh.syntax-highlighting: refactor `highlighters` option for proper validation
2017-04-27 17:37:43 +02:00
Andrew Martin e289b94fbe graphite service: no recursive chown when starting (#24442)
Fixes #24444
2017-04-27 17:33:42 +02:00
Kirill 64a7be7f3c Merge branch 'master' into aria2.service 2017-04-27 17:50:13 +03:00