Commit graph

1057 commits

Author SHA1 Message Date
Ricardo M. Correia f0e3775f2e linux: Add support for zram 2014-04-24 23:47:08 +02:00
Vladimír Čunát 116d52c6df linux-3.12: bump .17 -> .18 2014-04-24 20:02:34 +02:00
Ricardo M. Correia 5d5ca7b260 grsecurity: Update all patches
stable:  3.0-3.2.57-201404131252            -> 3.0-3.2.57-201404182109
test:    3.0-3.13.10-201404141717           -> 3.0-3.14.1-201404201132
vserver: 3.0-3.2.57-vs2.3.2.16-201404131253 -> 3.0-3.2.57-vs2.3.2.16-201404182110
2014-04-21 18:46:41 +02:00
Eelco Dolstra 4e8c2f0ff9 Merge branch 'systemd-update' 2014-04-20 19:31:01 +02:00
Eelco Dolstra 5da309fcaa linux: Enable SND_DYNAMIC_MINORS
This is necessary if you get:

  kernel: Too many HDMI devices
  kernel: Consider building the kernel with CONFIG_SND_DYNAMIC_MINORS=y
2014-04-18 21:50:00 +02:00
Eelco Dolstra 3f01caa89f linux: Enable transparent hugepages 2014-04-16 22:40:07 +02:00
Austin Seipp ba2f861f05 kernel: stable/longterm updates
- stable:   3.14    -> 3.14.1
 - longterm: 3.10.36 -> 3.10.37
 - longterm: 3.4.86  -> 3.4.86

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-14 19:46:39 -05:00
Ricardo M. Correia 1b113178ee grsecurity: Update test patch from 3.0-3.13.9-201404131254 -> 3.0-3.13.10-201404141717 2014-04-15 00:16:29 +02:00
Ricardo M. Correia 3a1c9a2945 linux: Update to 3.13.10 2014-04-15 00:16:29 +02:00
Eelco Dolstra 73b4b287bb linux: Don't use underscores in the timestamp 2014-04-14 21:06:04 +02:00
Austin Seipp 788d9a13fb grsecurity: stable/vserver/testing updates
- stable:  201404111812            -> 201404131252
 - vserver: vs2.3.2.16-201404111814 -> vs2.3.2.16-201404131253
 - testing: 201404111815            -> 201404131254

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-13 13:11:17 -05:00
Austin Seipp 172dc1336f nixos: add grsecurity module (#1875)
This module implements a significant refactoring in grsecurity
configuration for NixOS, making it far more usable by default and much
easier to configure.

 - New security.grsecurity NixOS attributes.
   - All grsec kernels supported
   - Allows default 'auto' grsec configuration, or custom config
   - Supports custom kernel options through kernelExtraConfig
   - Defaults to high-security - user must choose kernel, server/desktop
     mode, and any virtualisation software. That's all.
   - kptr_restrict is fixed under grsecurity (it's unwriteable)
 - grsecurity patch creation is now significantly abstracted
   - only need revision, version, and SHA1
   - kernel version requirements are asserted for sanity
   - built kernels can have the uname specify the exact grsec version
     for development or bug reports. Off by default (requires
     `security.grsecurity.config.verboseVersion = true;`)
 - grsecurity sysctl support
   - By default, disabled.
   - For people who enable it, NixOS deploys a 'grsec-lock' systemd
     service which runs at startup. You are expected to configure sysctl
     through NixOS like you regularly would, which will occur before the
     service is started. As a result, changing sysctl settings requires
     a reboot.
 - New default group: 'grsecurity'
   - Root is a member by default
   - GRKERNSEC_PROC_GID is implicitly set to the 'grsecurity' GID,
     making it possible to easily add users to this group for /proc
     access
 - AppArmor is now automatically enabled where it wasn't before, despite
   implying features.apparmor = true

The most trivial example of enabling grsecurity in your kernel is by
specifying:

    security.grsecurity.enable          = true;
    security.grsecurity.testing         = true;      # testing 3.13 kernel
    security.grsecurity.config.system   = "desktop"; # or "server"

This specifies absolutely no virtualisation support. In general, you
probably at least want KVM host support, which is a little more work.
So:

    security.grsecurity.enable = true;
    security.grsecurity.stable = true; # enable stable 3.2 kernel
    security.grsecurity.config = {
      system   = "server";
      priority = "security";
      virtualisationConfig   = "host";
      virtualisationSoftware = "kvm";
      hardwareVirtualisation = true;
    }

This module has primarily been tested on Hetzner EX40 & VQ7 servers
using NixOps.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-11 22:43:51 -05:00
Austin Seipp acbf28145c nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.

The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.

This is really just an arbitrary picking at the moment, but it should be
OK.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-11 22:39:29 -05:00
Ricardo M. Correia 5dfc6584a5 grsecurity: Update stable patch from 3.0-3.2.56-201404062126 -> 3.0-3.2.57-201404091758 2014-04-10 00:37:33 +02:00
Ricardo M. Correia c50abd0e13 linux: Update to 3.2.57 2014-04-10 00:37:33 +02:00
Austin Seipp 3ff158289a lockdep: refactor into non-kernel package
Lockdep doesn't *really* require the kernel package - just the kernel
sources. It's really a user-space tool just compiled from some portable
code within the kernel, nothing more.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-08 19:21:55 -05:00
Austin Seipp 05ec851050 kernel: longterm updates
- longterm: 3.4.85  -> 3.4.86
 - longterm: 3.10.35 -> 3.10.36
 - longterm: 3.12.15 -> 3.12.17

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-07 13:56:50 -05:00
Ricardo M. Correia 807fad571a grsecurity: Update stable and test patches
stable: 3.0-3.2.56-201404012135 -> 3.0-3.2.56-201404062126
test:   3.0-3.13.8-201404011912 -> 3.0-3.13.9-201404062127
2014-04-07 15:31:12 +02:00
Ricardo M. Correia c494289c12 linux: Update to 3.13.9 2014-04-07 15:31:12 +02:00
Alexander Kjeldaas c69eb7c2c1 Remove timestamp from the kernel. 2014-04-05 08:40:55 +02:00
Shea Levy 0c66dbaee6 Enable CC_STACKPROTECTOR_REGULAR on linux 3.14+ 2014-04-02 17:58:54 -04:00
Vladimír Čunát 8146737127 Merge #2090: add new lockdep tool from Linux 3.14 2014-04-02 20:55:30 +02:00
Ricardo M. Correia 52d233af22 grsecurity: Update stable patch from 3.0-3.2.55-201403300851 -> 3.0-3.2.56-201404012135 2014-04-02 15:11:33 +02:00
Ricardo M. Correia e8c6c60b93 linux: Update to 3.2.56 2014-04-02 15:11:32 +02:00
Ricardo M. Correia 407a6857c6 grsecurity: Update stable and test patches
stable: 3.0-3.2.55-201403252026 -> 3.0-3.2.55-201403300851
test:   3.0-3.13.7-201403252047 -> 3.0-3.13.8-201404011912
2014-04-02 02:16:59 +02:00
Austin Seipp 19bc051ca1 kernel: stable/longterm updates
- longterm: 3.4.83  -> 3.4.85
 - longterm: 3.10.33 -> 3.10.35
 - longterm: 3.12.14 -> 3.12.15
 - stable:   3.13.7  -> 3.13.8

NOTE: This will break the testing grsec kernel at the moment (there's
not a 3.13.8 patch yet), but it's destined to be upgraded to 3.14 soon
anyway.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-01 11:11:10 +02:00
Austin Seipp 7288f25bd1 kernel: stable/longterm updates
- longterm: 3.4.83  -> 3.4.85
 - longterm: 3.10.33 -> 3.10.35
 - longterm: 3.12.14 -> 3.12.15
 - stable:   3.13.7  -> 3.13.8

NOTE: This will break the testing grsec kernel at the moment (there's
not a 3.18.8 patch yet), but it's destined to be upgraded to 3.14 soon
anyway.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-01 03:03:00 -05:00
Austin Seipp 1459896be1 kernel: add myself to maintainer list
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-01 02:59:20 -05:00
Austin Seipp bdff718c5b kernel: add lockdep expression
Lockdep is the kernel's locking validation/debugging tool and has seen
heavy pro-active usage and development. In Linux 3.14, it's now
available directly to userspace for the same purpose. It comes with a
convenient utility to LD_PRELOAD a shared library for validation, or a
user-space API to link to directly.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-01 01:20:46 -05:00
Austin Seipp 9493159017 kernel: remove 3.11 series (EOL)
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-01 00:56:23 -05:00
Shea Levy 2d4ce25b5b Add linux 3.14 2014-03-31 20:54:47 -04:00
Ricardo M. Correia 911f332279 grsecurity: Update stable and test patches
stable: 3.0-3.2.55-201403202347 -> 3.0-3.2.55-201403252026
test:   3.0-3.13.6-201403202349 -> 3.0-3.13.7-201403252047
2014-03-26 23:07:57 +00:00
Ricardo M. Correia 1c73e6f9d8 linux: Update to 3.13.7 2014-03-26 23:07:57 +00:00
Ricardo M. Correia 9db587bf7d grsecurity: Update stable and test patches
stable: 3.0-3.2.55-201403172027 -> 3.0-3.2.55-201403202347
test:   3.0-3.13.6-201403172032 -> 3.0-3.13.6-201403202349
2014-03-21 15:41:32 +01:00
Vladimír Čunát 00cfc70b10 linux: update to 3.12.14 and 3.10.33 2014-03-21 15:38:52 +01:00
Shea Levy e4961c63f7 Remove sec_perm patch that was needed by AUFS
Now the kernel is unpatched by default on non-MIPS!
2014-03-21 04:37:23 -04:00
Ricardo M. Correia cc69228119 grsecurity: Update stable and test patches
stable: 3.0-3.2.55-201403142107 -> 3.0-3.2.55-201403172027
test:   3.0-3.13.6-201403142112 -> 3.0-3.13.6-201403172032
2014-03-18 16:51:25 +01:00
Eelco Dolstra c0f3f6e396 linux: Update to 3.4.83 2014-03-17 11:25:48 +01:00
Ricardo M. Correia e76c059b23 grsecurity: Fix grsec-path.patch to apply with newest patches 2014-03-15 18:01:47 +01:00
Ricardo M. Correia ceec014020 grsecurity: Update stable and test patches
stable: 3.0-3.2.55-201403122114 -> 3.0-3.2.55-201403142107
test:   3.0-3.13.6-201403122116 -> 3.0-3.13.6-201403142112
2014-03-15 04:15:28 +01:00
Shea Levy 0f72effdd9 The derivation primop doesn't play well with null outputs attribute 2014-03-13 15:05:15 -04:00
Ricardo M. Correia 86b8cf954a grsecurity: Update stable and test patches
stable: 3.0-3.2.55-201403072107 -> 3.0-3.2.55-201403122114
test:   3.0-3.13.6-201403072241 -> 3.0-3.13.6-201403122116
2014-03-13 02:28:58 +01:00
Ricardo M. Correia d999872b8d grsecurity: Update stable and test patches
stable: 3.0-3.2.55-201403022154 -> 3.0-3.2.55-201403072107
test:   3.0-3.13.5-201403031445 -> 3.0-3.13.6-201403072241
2014-03-10 17:23:17 +01:00
Ricardo M. Correia 9b650b074b linux: Update to 3.13.6 2014-03-10 17:23:17 +01:00
Austin Seipp c4d5757e29 grsecurity updates
- stable:  3.0-3.2.55-201402241936 -> 3.0-3.2.55-201403022154
  - testing: 3.0-3.13.5-201402241943 -> 3.0-3.13.5-201403031445

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-04 01:13:22 +01:00
Ricardo M. Correia 69a83ba99f grsecurity: Update stable and test patches
stable: 3.0-3.2.55-201402221305 -> 3.0-3.2.55-201402241936
test:   3.0-3.13.4-201402221308 -> 3.0-3.13.5-201402241943
2014-03-03 02:16:58 +01:00
Ricardo M. Correia 8109de905a linux: Update to 3.13.5 2014-03-03 02:16:50 +01:00
Evgeny Egorochkin 05c19ced9b linuxPackages_3_12.perf: update from 3.12.12 to 3.12.13 2014-02-26 20:49:27 +02:00
Austin Seipp 7f4b97d495 grsecurity: stable/testing updates
- stable:  3.0-3.2.55-201402201903 -> 3.0-3.2.55-201402221305
 - testing: 3.0-3.13.4-201402201908 -> 3.0-3.13.4-201402221308

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-22 20:29:25 +01:00
Austin Seipp 18f65f3640 grsecurity: stable/testing updates
- stable:  3.0-3.2.55-201402192249 -> 3.0-3.2.55-201402201903
  - testing: 3.0-3.13.3-201402192252 -> 3.0-3.13.4-201402201908

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-20 20:21:16 -06:00
Austin Seipp a1dc5ea707 kernel: stable updates
- 3.13 stable:   3.13.3  -> 3.13.4
 - 3.12 stable:   3.12.11 -> 3.12.12
 - 3.10 longterm: 3.10.30 -> 3.10.31
 - 3.4  longterm: 3.4.80  -> 3.4.81

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-20 20:21:11 -06:00
Austin Seipp 58e08a1a4f grsecurity: stable/testing updates
- stable:  3.0-3.2.55-201402152203 -> 3.0-3.2.55-201402192249
  - testing: 3.0-3.13.3-201402152204 -> 3.0-3.13.3-201402192252

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-20 04:53:19 -06:00
Austin Seipp c137015328 grsecurity updates.
- stable:  3.0-3.2.54-201402062221 -> 3.0-3.2.55-201402152203
  - testing: 3.0-3.13.3-201402132113 -> 3.0-3.13.3-201402152204

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-17 07:27:51 -06:00
Austin Seipp 8e349e721c linux: 3.2.54 -> 3.2.55
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-17 07:27:51 -06:00
William A. Kennington III 52248aa7a2 kernel: 3.12.10 -> 3.12.11 (close #1743) 2014-02-16 14:20:09 +01:00
Evgeny Egorochkin daa2827b99 grsecurity: update patch 2014-02-14 18:13:05 +02:00
Evgeny Egorochkin fc213ccfa8 linux_3_13: update from 3.13.2 to 3.13.3 2014-02-14 16:56:38 +02:00
Evgeny Egorochkin 699509db14 linux_3_10: update from 3.10.29 to 3.10.30 2014-02-14 16:55:44 +02:00
Evgeny Egorochkin ad4e2bd499 linux_3_4: update from 3.4.79 to 3.4.80 2014-02-14 16:55:44 +02:00
Evgeny Egorochkin 69f4bdac6e linux: add git repository and branch meta 2014-02-14 10:45:36 +02:00
Ricardo M. Correia b31547654d grsecurity: Update stable and test patches
stable: 3.0-3.2.54-201401191012 -> 3.0-3.2.54-201402062221
test:   3.0-3.12.8-201401191015 -> 3.0-3.13.2-201402062224
2014-02-08 16:16:58 +01:00
Ricardo M. Correia 31fa2cd52b grsecurity: Fix building grsec-3.x.0 kernels 2014-02-08 15:16:40 +00:00
Vladimír Čunát 24029ec478 linux: minor updates 3.12.10, 3.10.29, 3.4.79 2014-02-08 11:54:16 +01:00
Vladimir Still d3979b659c perf: Make build fix for 3.13 cleaner. 2014-02-07 22:53:55 +01:00
Vladimir Still 70e4f8f928 perf: Allow proceeding in build even if patch fails.
Patching fails for linux 3.13 but it builds OK.
2014-02-07 18:16:24 +01:00
William A. Kennington III 346bfc28ea kernel: Upgrade from 3.13.1 -> 3.13.2 2014-02-06 16:30:40 -06:00
William A. Kennington III f9f065a178 kernel: Upgrade from 3.13.0 -> 3.13.1 2014-01-31 15:28:50 -06:00
Eelco Dolstra b913a2eb81 linux: Update to 3.4.78 2014-01-31 18:00:13 +01:00
Vladimír Čunát 9739171cd4 Merge pull request #1567 from wizeman/u/grsec-upd-and-fix
grsecurity: Fix build and update patches
2014-01-28 03:41:05 -08:00
Vladimír Čunát a9caafa0ea linux kernel updates to 3.4.77, 3.10.28 and 3.12.9
I tested they still build on x86_64.
2014-01-26 17:07:31 +01:00
William A. Kennington III 8bc7c9f66d linux: Update from 3.12.7 -> 3.12.8 2014-01-26 15:48:18 +01:00
William A. Kennington III c47dc47083 linux: Update from 3.10.25 -> 3.10.27 2014-01-26 15:48:05 +01:00
Petr Rockai 28f0ec6540 linux-perf: Fix build (unportable shell hack broke). 2014-01-25 16:30:14 +01:00
Shea Levy cb9cc87a39 kernel.passthru: Don't include meta to be consistent with stdenv.mkDerivation
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-21 21:12:58 -05:00
Shea Levy fd999ed570 Linux: Set passthru attr to contain full passthru
This fixes #1566, thanks @wizeman

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-21 21:06:27 -05:00
Ricardo M. Correia aeda8d63b9 grsecurity: Update stable and test patches
stable: 3.0-3.2.53-201312021727 -> 3.0-3.2.54-201401191012
test:   3.0-3.12.2-201312021733 -> 3.0-3.12.8-201401191015
2014-01-22 02:14:35 +01:00
Shea Levy d18bc25b95 Rename linuxManualConfig to buildLinux
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-21 20:05:55 -05:00
Shea Levy 3ae5e801a5 Linux 3.13
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-19 22:35:24 -05:00
Ricardo M. Correia acaadd9d2a linux: Update to 3.2.54 and 3.12.7 (close #1527) 2014-01-15 20:05:53 +01:00
Eelco Dolstra 03ad7a081c linux: Update to 3.4.76 2014-01-15 10:55:53 +01:00
Eelco Dolstra c3db56527d linux: Update to 3.4.75 2014-01-07 11:08:16 +01:00
Shea Levy 053e029ee6 Some arches have multiple Makefiles
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-05 16:07:32 -05:00
Shea Levy adb57a0cc4 kernel: Fix depmod references
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-05 10:31:16 -05:00
Shea Levy ac2035287f Greatly reduce kernel closure size
Based on access analysis with strace, I determined an essentially
minimal required set of files from the kernel source that was needed to
build all current kernel packages on 3.10, which ultimately resulted in
keeping 30M of source. Generalizing from that minimal set, which
required ad-hoc specifications of which headers outside of include/ and
arch/*/include and which files in the scripts/ directory should be kept,
to a policy of keeping all non-arch-specific headers that aren't part of
the drivers/ directory and the entire scripts/ directory added an
additional 17M, but there was nothing in the analysis that indicated
that that ad-hoc specification was at all complete so I think the extra
hit is worth the likely greater compatibility.

For reference, we now keep:

* All headers that are NOT in arch/${notTargetArch}/include or drivers/
* The scripts/ directory
* Makefile
* arch/${targetArch}/Makefile

IMO the most likely cause of future problems are the headers in
drivers/, but hopefully they won't actually be needed as they add 50M
Ideally kernel packages would only use include and
arch/${targetArch}/include, but alas this is observably not the case.

master:
  * $out
    * size: 234M
    * references-closure: linux-headers, glibc, attr, acl, zlib, gcc,
      coreutils, perl, bash
merge-kernel-builds:
  * $out
    * size: 152M
    * references-closure: none
  * $dev
    * size: 57M
    * references-closure: linux-headers, glibc, zlib, gcc

So even with the non-minimal set we still beat out master. Keeping the
drivers headers would make us only slightly bigger.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-05 06:55:47 -05:00
Shea Levy a589bfae17 Update and fix kernel packages to new kernel build
In most cases, this just meant changing kernelDev (now removed from
linuxPackagesFor) to kernel.dev. Some packages needed more work (though
whether that was because of my changes or because they were already
broken, I'm not sure). Specifics:

* psmouse-alps builds on 3.4 but not 3.10, as noted in the comments that
  were already there
* blcr builds on 3.4 but not 3.10, as noted in comments that were
  already there
* open-iscsi, ati-drivers, wis-go7007, and openafsClient don't build on
  3.4 or 3.10 on this branch or on master, so they're marked broken
* A version-specific kernelHeaders package was added

The following packages were removed:

* atheros/madwifi is superceded by official ath*k modules
* aufs is no longer used by any of our kernels
* broadcom-sta v6 (which was already packaged) replaces broadcom-sta
* exmap has not been updated since 2011 and doesn't build
* iscis-target has not been updated since 2010 and doesn't build
* iwlwifi is part of mainline now and doesn't build
* nivida-x11-legacy-96 hasn't been updated since 2008 and doesn't build

Everything not specifically mentioned above builds successfully on 3.10.
I haven't yet tested on 3.4, but will before opening a pull request.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-04 21:17:04 -05:00
Shea Levy 2c38df1c5b kernel build: limit dev output footprint
This makes the disk usage footprint of building the kernel smaller in 3
ways:

1) There is no separate kernel source derivation
2) Rather than using the entire build tree, only the output of make
modules_prepare is kept in the $dev output (plus the module symbol
versioning file generated during the build)
3) Only the subset of the source tree known to be needed for external
builds is kept in $dev

Note that while 2) is supported by official kernel documentation, I
couldn't find any source describing what we need to keep for 3). I've
started with the bare minimum (the main Makefile is called by the
Makefile generated by make modules_prepare) and we can/should add more
as needed for kernelPackages.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-01 23:56:24 -05:00
Shea Levy f95d214cfd Implement generic kernel build via manual-config
This has three major benefits:

1. We no longer have two kernel build processes to maintain

2. The build process is (IMO) cleaner and cleaves more closely to
upstream. In partuclar, we use make install to install the kernel and
development source/build trees, eliminating the guesswork about which
files to copy.

3. The derivation has multiple outputs: the kernel and modules are in
the default `out' output, while the build and source trees are in a
`dev' output. This makes it possible for the full source and build tree
to be kept (which is expected by out-of-tree modules) without bloating
the closure of the system derivation.

In addition, if a solution for how to handle queries in the presence of
imports from derivations ever makes it into nix, a framework for
querying the full configuration of the kernel in nix expressions is
already in place.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-01 09:21:25 -05:00
Shea Levy a87b1f36e0 manual-config: Fully general cross-compiling
In the most general case, the cross and native kernel may differ in
patches and configuration file as well as architecture, kernel target,
etc. It's probably overkill to support that case, but since it was
doable without much duplication and it will make integrating with the
existing cross-compilation support in the generic kernel I decided to
implement it anyway.

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-31 23:09:42 -05:00
Shea Levy 784c6d320c manual-config: Put `source' before the version in the sourceRoot name
nix's version parsing treats the previous name as a package named
`linux' with version `${version}-source', when we really want a package
named `linux-source' with version `${version}'

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-31 22:50:41 -05:00
Shea Levy 0c5776bc0f manual-config: Patch conf.c for generate-config.pl
This only affects the `oldaskconfig' make target, so it shouldn't really
affect current manual-config users, but it does make it more
straightforward to implement the generic kernel build on top of
manual-config.

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-31 22:49:12 -05:00
Shea Levy fe185f0a18 manual-config: Always add config query functions
If the config attrset is manually specified, we still want isYes,
isModule, etc. to work. But we let the passed in config attrset take
precedence, if for some reason the caller wants to provide their own
implementation of one or more of these functions.

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-31 22:46:43 -05:00
Shea Levy 008992619f linux/manual-config: Cross-compiling support
With this, I was able to successfully compile a defconfig kernel for the
sheevaplug, though I didn't actually try to run it (not having a
sheevaplug myself).

For native compiles, the most significant difference is that the
platform's kernel target is built directly rather than hoping the
default make target will pull it in.

Also some stylistic improvements along the way.

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-31 22:38:06 -05:00
William A. Kennington III 211b9a5016 linux: Update 3.10.18 -> 3.10.25 2013-12-29 07:53:23 -06:00
William A. Kennington III 811d88e94d linux: Update 3.11.8 -> 3.11.10 2013-12-29 07:53:19 -06:00
Shea Levy 76da6e6ed3 Linux 3.12.6
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-20 13:45:45 -05:00
Shea Levy 01a051292f Linux 3.12.5
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-18 12:35:07 -05:00
Eelco Dolstra 82f39bd19e linux: Fix hash 2013-12-17 13:27:03 +01:00
Eelco Dolstra acac786868 linux: Update to 3.4.74 2013-12-16 14:46:21 +01:00
Eelco Dolstra f74ca42ba6 linux: Update to 3.4.73 2013-12-11 14:28:37 +01:00
Shea Levy 9131b45db4 Linux 3.12.4
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-09 12:01:37 -05:00
Vladimír Čunát 3d3b19d767 Merge #1325: linux-3.2 and grsecurity updates 2013-12-05 23:20:18 +01:00
Shea Levy bb9caf40dd Linux 3.12.3
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-12-05 10:21:06 -05:00
Ricardo M. Correia 61adb5962c grsecurity: Update to 3.0-3.2.53-201312021727 and 3.0-3.12.2-201312021733 2013-12-04 15:28:21 +01:00
Ricardo M. Correia 60ced497f6 linux: Update to 3.2.53 2013-12-04 15:28:20 +01:00
Eelco Dolstra 3b94410d86 linux: Update to 3.4.71 2013-12-01 18:20:39 -05:00
Shea Levy c06361a1fc Linux 3.12: Bump
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-11-30 14:29:49 -05:00
Michael Raskin 0851ed23d8 Merge pull request #1282 from wizeman/grsec-upd
grsecurity: Update to latest version and add patch for kernel 3.12
2013-11-28 21:42:27 -08:00
Ricardo M. Correia 89789e4719 linux: Update to 3.12.1 (close #1281) 2013-11-27 21:52:51 +01:00
Ricardo M. Correia 2106191003 grsecurity: Fix module loading during boot due to path restrictions 2013-11-27 01:32:50 +01:00
Ricardo M. Correia 36955aa721 grsecurity: Update to 3.0-3.2.52-201311261307 and add patch for 3.12 2013-11-27 01:32:14 +01:00
Eelco Dolstra 139c5b5069 linux: Update to 3.4.70 2013-11-26 11:46:41 +01:00
cillianderoiste d0ce0f836f Merge pull request #1268 from cillianderoiste/tuxonice
TuxOnIce: Add a 3.10 linux kernel with the TuxOnIce hibernation patch
2013-11-23 08:33:36 -08:00
Cillian de Róiste a34354ef81 TuxOnIce: Add a 3.10 linux kernel with the TuxOnIce hibernation patch 2013-11-23 17:21:19 +01:00
Ricardo M. Correia a65ecb6382 linux: Update to 3.11.8 (close #1243) 2013-11-20 22:48:12 +01:00
Eelco Dolstra af7162b7a3 linux: Update to 3.4.69 2013-11-13 17:33:58 +01:00
Ricardo M. Correia e8361c3523 linux: Update to 3.11.7 2013-11-09 18:46:29 +01:00
Eelco Dolstra 5098d53db1 linux: Update to 3.10.18 2013-11-06 10:31:53 +01:00
Eelco Dolstra 07ccfe6af8 linux: Update to 3.4.68 2013-11-06 10:29:27 +01:00
Shea Levy d2de64cc66 Fix broken meta.platforms for manual-config kernel
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-11-05 07:19:38 -05:00
Eelco Dolstra c88055e1a2 Set meta.hydraPlatforms instead of meta.platforms for some packages 2013-11-05 00:06:10 +01:00
Eelco Dolstra a2cbc77e4f Only show/build a package on the platforms listed in meta.platforms
The function ‘mkDerivation’ now checks whether the current platform
type is included in a package's meta.platform field.  If not, it
throws an exception:

  $ nix-build -A linux --argstr system x86_64-darwin
  error: user-thrown exception: the package ‘linux-3.10.15’ is not supported on ‘x86_64-darwin’

These packages also no longer show up in ‘nix-env -qa’ output.  This
means, for instance, that the number of packages shown on
x86_64-freebsd has dropped from 9268 to 4764.

Since meta.platforms was also used to prevent Hydra from building some
packages, there now is a new attribute meta.hydraPlatforms listing the
platforms on which Hydra should build the package (which defaults to
meta.platforms).
2013-11-05 00:06:10 +01:00
Shea Levy 268bb64b68 Linux 3.12 release
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-11-03 20:14:48 -05:00
Shea Levy 504ea7662c Remove EOL'd kernels
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-11-01 11:10:05 -04:00
Ricardo M. Correia 57e9fd8bcf grsecurity: Update to 2.9.1-3.2.52-201310271550 2013-10-29 13:32:53 +01:00
Ricardo M. Correia 69513d1480 linux: Update to 3.2.52 2013-10-29 13:32:53 +01:00
Eelco Dolstra 8c65a2a181 linux: Update to 3.4.67 2013-10-24 14:52:09 +02:00
Aristid Breitkreuz 81ef604ae0 linux 3.11.6 2013-10-20 11:42:37 +02:00
Ricardo M. Correia d32636dac4 grsecurity: Update to 2.9.1-3.2.51-201309281102 2013-10-20 08:14:28 +03:00
Ricardo M. Correia 90a2341300 grsecurity: generate linuxPackages and declare that apparmor is included 2013-10-20 08:14:28 +03:00
Evgeny Egorochkin 73449533ba linux 3.12: fix url to match hash 2013-10-19 10:52:16 +03:00
Eelco Dolstra fc593e719d linux: Update to 3.4.66
CVE-2013-2015
2013-10-14 12:52:22 +02:00
Mathijs Kwik ab94b3b863 linux-3.0: upgrade to 3.0.99 2013-10-06 20:17:02 +02:00
Mathijs Kwik c242863da8 linux-3.4: upgrade to 3.4.65 2013-10-06 20:17:01 +02:00
Mathijs Kwik 07fd8c87ab linux-3.10: upgrade to 3.10.15 2013-10-06 20:17:01 +02:00
Mathijs Kwik 2af2f26034 linux-3.11: upgrade to 3.11.4 2013-10-06 20:17:01 +02:00
Mathijs Kwik 40826e309f linux-3.12: upgrade to 3.12-rc3 2013-10-06 20:17:01 +02:00
Mathijs Kwik 6c9a267745 linux-3.10: upgrade to 3.10.14 2013-10-04 09:07:45 +02:00
Mathijs Kwik 126403132d linux-3.11: upgrade to 3.11.3 2013-10-04 09:07:45 +02:00
Eelco Dolstra 02c11554d7 linux: Update to 3.4.63 2013-09-30 11:29:27 +02:00
Mathijs Kwik 9e76aa91b1 linux-3.11: upgrade to 3.11.2 2013-09-28 22:25:41 +02:00
Eelco Dolstra 8a182718ca splashutils: Remove 2013-09-26 18:03:43 +02:00
aszlig 2e89b40634
Merge pull request #1010 from offlinehacker.
Although this is a release canidate version of kernel 3.12, there are
reasons for merging this anyway, as discussed in #1010 and #1006.

Thanks to @offlinehacker for this and the initial pull request.
2013-09-25 14:05:33 +02:00
Jaka Hudoklin 69f30432dd kernel: add linux 3.12-rc2 2013-09-25 12:49:49 +02:00
Mathijs Kwik 1751f77b6a linux-3.11: upgrade to 3.11.1 2013-09-18 14:37:38 +02:00
Eelco Dolstra 7856ba881a linux: Enable proper blkio controller support
Having BLK_CGROUP is not enough, you need BLK_DEV_THROTTLING or
CFQ_GROUP_IOSCHED to do anything useful.
2013-09-17 16:00:36 +02:00
Eelco Dolstra 2d14789920 linux: Update to 3.4.62 2013-09-16 17:51:18 +02:00
Ricardo M. Correia 342fcfc82f grsecurity: Update to 2.9.1-3.2.51-201309101928 2013-09-13 05:13:25 +02:00
Ricardo M. Correia 72f49af65b linux: Update to 3.2.51 2013-09-13 05:13:18 +02:00
Eelco Dolstra 89fa23c43d linux: Update to 3.4.61 2013-09-12 10:38:38 +02:00
Eelco Dolstra 207aa56201 linux: Update to 3.4.60 2013-09-05 11:11:02 +02:00
Mathijs Kwik 27a810346a Revert "linux: really provide /proc/config.gz"
This reverts commit 68ce9e91e1.

/proc/config.gz is available after "modprobe configs"
and in
/run/booted-system/kernel-modules/config
2013-09-04 09:29:00 +02:00
Mathijs Kwik 03c9a1fb33 linux 3.11
works fine for me, but nvidia binary driver fails once again
2013-09-04 09:29:00 +02:00
Mathijs Kwik 927f32e87c linux-3.10: upgrade to 3.10.10 2013-08-31 12:09:17 +02:00
Rickard Nilsson c44d8970ea raspberrypi-kernel: Updated to latest version as of 20130826 (rev 7849605f5a) 2013-08-27 12:30:47 +02:00
Eelco Dolstra a1c74c5603 linux: Update to 3.4.59 2013-08-26 22:55:54 +02:00
Mathijs Kwik b9fff8a34b linux-3.10: upgrade to 3.10.9 2013-08-21 11:22:33 +02:00
Mathijs Kwik 273689bcbd linux-3.10: remove the btrfs send patch
it helps, but is incomplete.
more fixes are coming, but including these would change too much
generic btrfs code, which might cause trouble for others.

so the best advice is not to use btrfs send yet and wait for 3.11 or 3.12
2013-08-19 07:04:18 +02:00
Bjørn Forsman 68ce9e91e1 linux: really provide /proc/config.gz
Currently there is no /proc/config.gz, even though the configuration
indicates it. This fixes it.
2013-08-16 23:12:07 +02:00
Eelco Dolstra 5cb688eb52 linux: Update to 3.4.58 2013-08-16 12:05:42 +02:00
Mathijs Kwik b85984d840 linux-3.10: upgrade to 3.10.7 2013-08-15 14:06:27 +02:00
Evgeny Egorochkin 339e1d94c6 Turning off PAE support which makes kernel unbootable on older hardware causes CRASH_DUMP option to
disappear, so make it optional.
2013-08-12 05:32:11 +03:00
Evgeny Egorochkin 27dcd771c3 Merge pull request #802 from wizeman/kernel_update
Kernel update
2013-08-11 15:08:45 -07:00
Mathijs Kwik 59025453e7 linux-3.10: backport a fix for "btrfs send"
It has been submitted for inclusion in mainline, so it will probably
make it into 3.11 (or 3.12 as 3.11 is fairly close to release).

It is very local, only affecting people who use the "send" feature.
Without it, send is unstable/unsafe to use incrementally.

It can probably be applied to 3.9 and 3.8 as well, but as I only
tested it against 3.10, so I didn't bother.
2013-08-10 13:53:17 +02:00
Eelco Dolstra d9a4706f73 linux: Use kmod instead of module-init-tools 2013-08-09 18:48:51 +02:00
Eelco Dolstra 912146d764 linux: Update to 3.4.56, 3.10.5 2013-08-06 12:40:48 +02:00
Eelco Dolstra 3a4ef26397 Remove Linux 3.8 (EOL) 2013-08-06 12:39:50 +02:00
Ricardo M. Correia 36c2711f8b linux: update grsecurity patch 2013-08-06 02:21:00 +00:00
Ricardo M. Correia 97056a0620 linux: properly parse config choice when it's new 2013-08-06 02:20:48 +00:00
Ricardo M. Correia 2208c360ac linux: Update to 3.2.50 2013-08-05 18:19:48 +00:00
Eelco Dolstra f155a35d7d Move kernelExtraConfig to common-config.nix (for x86)
It's bad to have the kernel config scattered across two places.  (This
should also be done for the other architectures.)

Also, restore Xen and KVM guest support in Linux 3.10.
2013-08-01 14:35:31 +02:00
Eelco Dolstra 14ca9c0bf1 linux: Include "NixOS" in "uname -v" 2013-08-01 01:40:41 +02:00
Eelco Dolstra d1de0e2d6d linux: Enable detection of hung tasks 2013-08-01 01:40:41 +02:00
Eelco Dolstra f2f00c56e4 linux: Enable stack protector
This may prevent exploitation of buffer overflows.
2013-08-01 01:40:41 +02:00
Eelco Dolstra c564d012f8 Style fix 2013-08-01 01:40:41 +02:00
Eelco Dolstra b976e00ff2 linux: Remove obsolete AUFS 3.7 patch 2013-08-01 01:40:40 +02:00
Eelco Dolstra ff99631753 linux: Remove CIFS timeout patch
We longer use CIFS in the VM tests so we don't need this anymore.
2013-08-01 01:40:40 +02:00
Eelco Dolstra 956d71f843 linux: Remove some unused patches 2013-08-01 01:40:40 +02:00
Eelco Dolstra bc8186be1e linux: Disable /dev/kmem
See e.g.
  https://wiki.ubuntu.com/Security/Features#A.2BAC8-dev.2BAC8-kmem_disabled
2013-08-01 01:40:40 +02:00
Eelco Dolstra 7ce325f3e0 Unify the Linux kernel configurations
Having N different copies of the NixOS kernel configuration is bad
because these copies tend to diverge.  For instance, our 3.10 config
lacked some modules that were enabled in older configs, probably
because the 3.10 config had been copied off an earlier version of some
older kernel config.

So now there is a single kernel config in common-config.nix.  It has a
few conditionals to deal with new/removed kernel options, but
otherwise it's pretty straightforward.

Also, a lot of cut&paste boilerplate between the kernel Nix
expressions is gone (such as preConfigure).
2013-08-01 01:40:40 +02:00
Eelco Dolstra dccbdcf520 linux: Don't put the kernel version in meta 2013-08-01 01:40:40 +02:00
Eelco Dolstra 3c462ded97 linux: Update to 3.2.49, 3.4.55 2013-07-30 16:52:12 +02:00
Shea Levy 2e57a16219 Linux 3.10.4
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-07-28 20:16:16 -04:00
Mathijs Kwik ac91adf4e3 linux-3.10: upgrade to 3.10.3 2013-07-26 07:18:39 +02:00
Eelco Dolstra 1386036457 linux: Update to 3.4.54 2013-07-23 22:35:49 +02:00
Rob Vermaas af2a127551 Add linux 3.2.48 with grsecurity patches 2013-07-22 21:44:31 +02:00
Ricardo M. Correia 22689567ed apparmor: Update to kernel 3.4 series (the current default) 2013-07-22 18:03:26 +02:00
Aristid Breitkreuz 38a2056f70 fix bug in perf-linux installation, oops 2013-07-21 19:25:05 +02:00
Eelco Dolstra 4cc4ed6d2d linux-3.7: Remove
It's EOL.
2013-07-16 13:45:23 +02:00
Mathijs Kwik 5dbe2627a2 linux-3.9: upgrade to 3.9.10 (EOL) 2013-07-15 17:25:13 +02:00
Eelco Dolstra 66b2ff1074 linux: Update to 3.4.53 2013-07-15 14:33:27 +02:00
Shea Levy e820a54431 Linux 3.10.1
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-07-13 15:15:50 -04:00
Mathijs Kwik ad8a3b86ab linux-3.10: forward-port 9p speedup from 3.9 2013-07-07 22:50:12 +02:00
Mathijs Kwik f43003237a linux-3.9: upgrade to 3.9.9 2013-07-07 22:46:47 +02:00
Eelco Dolstra 0e386d0c13 VM builds: Use 9p/virtfs instead of CIFS
9p (with caching enabled) is much faster than CIFS and doesn't require
Samba or virtual networking.  For instance, building GNU Hello with
CIFS takes ~323s on my laptop, but with 9p it takes 54s.

More measurements will be needed to see if "cache=fscache" is really
faster than "cache=loose" (the former seems to be a little bit
faster).
2013-07-05 00:17:04 +02:00
Aristid Breitkreuz c222c31745 do not patch non-existent bash_completion for old kernels 2013-07-04 20:13:52 +02:00
Aristid Breitkreuz f925c5ae7f fix bash completion for perf 2013-07-04 20:13:52 +02:00
Eelco Dolstra ebe81d17d7 linux: Update to 3.2.48, 3.4.51 2013-07-02 14:40:08 +02:00
Shea Levy 61fef700ee On linux-3.10, build in #! script support
Starting with 3.10, #! script handling can be built modularly (or not
at all). By default the nixpkgs builder sets everything modular, but
since our initird init is a #! script this creates a chicken-and-egg
problem on NixOS.

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-07-01 14:53:56 -04:00
Mathijs Kwik fc8c97f5d9 linux-3.9: upgrade to 3.9.8 2013-07-01 07:52:14 +02:00
Shea Levy 0d8025c612 Linux 3.10
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-06-30 20:55:21 -04:00