Commit graph

545 commits

Author SHA1 Message Date
Domen Kožar 068c0aa219 Merge pull request #1833 from coreyoconnor/fix-synaptics-config
correct tapButtons in synaptics config.
2014-03-07 13:10:31 +01:00
Shea Levy 4b28d9d934 Merge branch 'desktopmanager-fix' of git://github.com/pSub/nixpkgs
Use feh only as a fallback if the xserver is actually enabled.
2014-03-07 04:39:25 -05:00
Gergely Risko 322b7124a8 Allow ntpq locally 2014-03-06 11:54:02 +01:00
Eelco Dolstra 6572708d39 Always load the "configs" kernel module
We used to have the configuration of the kernel available in a
somewhat convenient place (/run/booted-system/kernel-modules/config)
but that has disappeared.  So instead just make /proc/configs.gz
available.  It only eats a few kilobytes.
2014-03-05 15:22:32 +01:00
Ricardo M. Correia 02e2431661 zfs: Don't look for devices only in /dev
If we don't give out a directory to 'zpool import', it will use libblkid
to automatically find all existing ZFS devices.
2014-03-04 12:58:11 +01:00
Pascal Wittmann c2fcf07f06 Use feh only as a fallback if the xserver is actually enabled.
Otherwise feh is installed even though no xserver is available.
2014-03-04 09:10:23 +01:00
Eelco Dolstra 6a9168ad06 Get rid of services.mesa.* message 2014-03-03 13:57:08 +01:00
Eelco Dolstra 497997cc38 Move generation of coverage reports from nixos/lib/testing to releaseTools
Also, turn some stdenv adapters into setup hooks.
2014-03-03 13:57:08 +01:00
Eelco Dolstra ad7c518e45 Sync /tmp/xchg to ensure that the coverage data is flushed 2014-03-03 13:57:08 +01:00
Vladimír Čunát d9cc648d6c Merge pull request #1791 from wizeman/u/nixos-gen
nixos-generate-config: improve filesystem generation
2014-03-02 11:27:43 +01:00
Shea Levy 1425fa5b3b Disable efi tests again
OVMF sucks
2014-03-01 09:51:28 -05:00
Eelco Dolstra 1d9cd24d0b Fix mysql-replication test 2014-02-28 16:18:31 +01:00
Eelco Dolstra da2a336a3c Remove tabs 2014-02-28 16:18:31 +01:00
Domen Kožar b792394119 nixos-manual: show manual on tty8 by default 2014-02-28 13:32:19 +01:00
Shea Levy 691f6c4c59 Fix mysql test evaluation 2014-02-28 06:16:57 -05:00
Domen Kožar e9f3199973 add gstreamer 1.0 setup-hook and use it where appropriate 2014-02-28 02:03:07 +01:00
Domen Kožar 4e957b075e Merge pull request #1841 from pSub/patch-1
Fixed link to the installation instructions
2014-02-27 15:08:32 +01:00
Pascal Wittmann 991b23c382 Added a static identifier to the installing nixos chapter 2014-02-27 14:56:13 +01:00
Domen Kožar ab0aae42a4 couchdb: remove redundant customConfigFile 2014-02-27 14:34:19 +01:00
Domen Kožar d6a3cada9b couchdb: stricter types 2014-02-27 14:33:50 +01:00
Domen Kožar 9d55a4c513 couchdb: add ids 2014-02-27 14:33:30 +01:00
Rok Garbas 0bebcd7d1f folders of pidFile and uriFile should be writable by couchdb user/group 2014-02-27 13:34:11 +01:00
Rok Garbas 55cff93f04 couchdb(nixos): removing whitespace and line that was commented 2014-02-27 13:34:11 +01:00
Rok Garbas 62438c09f7 update couchdb to 1.5.0(current latest) and add service for it 2014-02-27 13:34:11 +01:00
Domen Kožar 97a0dd9eb9 nixos: set all package options to have type package 2014-02-27 13:22:29 +01:00
Shea Levy f7c04b1e6b mediawiki: Don't rewrite /images if uploads are enabled 2014-02-27 07:17:10 -05:00
Shea Levy 1e7300ad67 mediawiki rewrite rules only needed with no urlPrefix 2014-02-27 07:17:10 -05:00
Shea Levy 32470621d5 Restart keys.target on reconfiguration 2014-02-26 13:35:04 -05:00
Shea Levy 69b6b939ef rename.nix: Handle renaming of a whole set of options
mkIf was pushed down, making the obsoleted argument unconditionally evaluated

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-26 10:06:28 -05:00
Shea Levy efb18d9aa5 D'oh 2014-02-26 08:49:21 -05:00
Shea Levy c9f9835dda Document mysql changes 2014-02-26 07:56:59 -05:00
Shea Levy 1ce6fff4e2 Merge mysql55 module into mysql
This also removes the default for services.mysql.package, as this should
not generally be updated automatically if we change the mysql attribute
2014-02-26 07:54:12 -05:00
Shea Levy 793328e1ee Mediawiki: Add some needed rewrites 2014-02-25 09:13:40 -05:00
Shea Levy 0d4a9e3aa6 Allow httpd subservices to set the document root
Only the main service OR one of the subservices can set the document
root. This is used by mediawiki when it is hosted at the root of the
vhost.
2014-02-25 07:44:45 -05:00
Corey O'Connor 20567eba1f correct tapButtons in synaptics config. Dont rely on the X11 input settings to take the last option. 2014-02-24 16:03:47 -08:00
Rickard Nilsson d5211b0e0e Make initialRootPassword overrideable in all virtualisation modules, not just virtualbox. 2014-02-24 18:05:26 +01:00
Austin Seipp dc700e0925 etc: uid/gid support for copied files
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-23 18:00:47 -06:00
Austin Seipp fc9022bea1 firewall: add support for TCP/UDP port ranges
This is useful for packages like mosh, which use a wide UDP port range
by default for incoming connections.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-22 18:19:22 +01:00
Petr Rockai f21abed131 nixos: Assign uid/gid to dictd's service user. 2014-02-22 12:00:08 +01:00
Shea Levy 95a77ea39f Unconditionally add ssh to nix-daemon's path for the ssh substitituer 2014-02-20 14:17:30 -05:00
Shea Levy 17f88453f6 Don't complain if HOME isn't writable 2014-02-20 13:40:56 -05:00
Shea Levy fefc0d9917 Add module to enable the server for the ssh substituter 2014-02-20 13:40:51 -05:00
Shea Levy 2b92e90f91 opensmtpd: Add sendmail to systemPackages 2014-02-20 06:17:15 -05:00
Ricardo M. Correia a146fdab80 nixos-generate-config: Don't generate filesystem options
We don't want to hardcode configuration options that the current kernel chose
for us when mounting the filesystem, since the defaults can change in the
future.
2014-02-19 17:18:50 +01:00
Ricardo M. Correia cea9a1a242 nixos-generate-config: Don't generate /var/lib/nfs/rpc_pipefs filesystem
It's automatically mounted if the system has support for NFS.
2014-02-19 17:18:49 +01:00
Domen Kožar ad0732313d gnome3: typo 2014-02-19 16:53:08 +01:00
Domen Kožar 746c42d10f gnome3: add some default core packages to be installed 2014-02-19 16:38:42 +01:00
Domen Kožar 189273af38 add gnome3.vino 2014-02-19 16:38:41 +01:00
Eelco Dolstra c7aedd5805 Add missing file 2014-02-19 10:38:44 +01:00
Pascal Wittmann ff7e234fb4 Removed obsolete option services.xserver.videoDriver 2014-02-18 23:13:00 +01:00
Pascal Wittmann 516cdc25a4 Renamed obsolete option services.xserver.videoDrivers to hardware.opengl.videoDrivers 2014-02-18 23:11:49 +01:00
Eelco Dolstra ca70ccb5c1 Start of 14.02 release notes 2014-02-18 19:13:07 +01:00
Eelco Dolstra d2aa2ac494 memtest.nix: Use toString 2014-02-18 19:13:07 +01:00
Moritz Ulrich 958df8b9d1 i18n.consoleKeyMap: Accept string or path.
i18n.consoleKeyMap maps to KEYMAP=... in vconsole.conf and `loadkeymap'
in stage1. Both of these accept paths to a keymap file in addition to
a string containing the name of the keymap.

With this commit, it's possible to use your own keymap via:

i18n.consoleKeyMap = ./path/to/something.kmap
2014-02-17 20:46:33 +01:00
Domen Kožar 4b201b27bf gnome3: correctly place GIO_EXTRA_MODULES 2014-02-17 00:24:13 +01:00
Domen Kožar e24b01f615 desktop-manager.gnome3: add dconf support 2014-02-16 21:37:18 +01:00
Domen Kožar 0b5d523b84 redshift: default to string type for option brightness 2014-02-16 14:22:49 +01:00
Shea Levy abf901484c Allow directly setting hashedPassword for root 2014-02-16 07:33:07 -05:00
Petr Rockai 01d7e79eaf nixos: Make serial agetty's bitrates configurable. 2014-02-15 12:57:27 +01:00
Petr Rockai 42ce480a52 nixos: Try harder to get LVM-hosted filesystems up in stage1. 2014-02-15 12:57:17 +01:00
Domen Kožar 77750efc7e Merge pull request #1739 from ttonelli/master
Improvements to RedShift service
2014-02-15 10:33:45 +01:00
Thiago Tonelli Bartolomei 2dcf933817 adding wantedBy graphical.target 2014-02-14 09:48:19 -05:00
Shea Levy 48b8118f2c virtualbox-image.nix: initialRootPassword setting should be easily overrideable 2014-02-14 09:06:26 -05:00
Oliver Charles 2ea7c90839 postgresql module: Use the default superuser username
PostgreSQL defaults to having 'postgres' as the superuser. NixOS should
use this default name to provide a less surprising result to people who
enable services.postgres.
2014-02-13 18:52:59 +00:00
Shea Levy c8f1a6ac1e Revert "Add nixosSubmodule option type"
Moving recent types work to a separate branch for now

This reverts commit ca1c5cfa8f.
2014-02-13 12:10:50 -05:00
Shea Levy 220654e205 Revert "Add heterogeneousAttrsOf option type"
Moving recent types work to a separate branch for now

This reverts commit 3f70dabad3.
2014-02-13 12:10:50 -05:00
Rickard Nilsson fc90a739ba networkmanager module: No need to start ModemManager explicitly, done by NM 2014-02-13 18:05:04 +01:00
Thiago Tonelli Bartolomei b5d17fe873 - adding brightness options
- setting options to be uniq
- using proper systemd exec service
2014-02-13 11:11:14 -05:00
Domen Kožar 85d38d1436 nginx: add appendConfig option with types.lines 2014-02-12 19:13:36 +01:00
Domen Kožar a49fbca134 Merge pull request #1730 from pSub/logcheck-uid
nixos: add uid for logcheck and only create a user for the default user
2014-02-12 16:10:35 +01:00
Shea Levy 8e97e38677 Reenable efi tests 2014-02-12 07:13:37 -05:00
Oliver Charles 625b42838a NetworkManager: Fix aliases and dependencies
There are two fixes in this commit.

Firstly, I am creating proper symlinks for the Alias= definitions in the
.service files. This achieves the same result as `systemctl enable`, and
I think is preferred over `mv`.

Secondly, `networkmanager-init` now wants `NetworkManager.service`,
along with `ModemManager.service`. ModemManager does not depend on
NetworkManager (according to `systemctl list-dependencies ModemManager`),
thus NetworkManager never got started on boot.
2014-02-12 11:32:49 +00:00
Shea Levy 3f70dabad3 Add heterogeneousAttrsOf option type
It is parameterized by a function that takes a name and evaluates to the
option type for the attribute of that name. Together with
submoduleWithExtraArgs, this subsumes nixosSubmodule.
2014-02-11 14:59:24 -05:00
Shea Levy ca1c5cfa8f Add nixosSubmodule option type
Since NixOS modules expect special arguments, use a hack to provide them
2014-02-11 14:21:34 -05:00
Eelco Dolstra 9c616e3bf4 Remove /etc/ca-bundle.crt
Applications should use /etc/ssl/certs/ca-bundle.crt instead.
2014-02-11 17:13:36 +01:00
Pascal Wittmann 884190a238 nixos: add uid for logcheck and only create a user for the default user 2014-02-11 14:19:06 +01:00
Rob Vermaas 61eae53709 Add all AWS regions to EBS AMI creation script. 2014-02-11 13:26:46 +01:00
Shea Levy 4ab5646417 Add a keys group with read access to /run/keys
This allows processes running as unprivileged users access to keys they might need
2014-02-11 07:00:10 -05:00
Michael Raskin 91b5aa7e10 Add some packages needed by some generic HP PCL drivers 2014-02-11 01:34:19 +04:00
Michael Raskin 4c9c7f6ba4 Add an option to change vsftpd anonymos write umask. 2014-02-11 01:34:19 +04:00
Shea Levy 80cc2697b1 user-groups: Sidestep all password escaping issues
Now passwords are written to a file first
2014-02-10 10:12:34 -05:00
Thomas Tuegel 3dc6168b31 Properly escape passwords sent to chpasswd
The mutableUsers feature uses `chpasswd` to set users passwords.
Passwords and their hashes were being piped into the program using
double quotes ("") to escape. This causes any `$` characters to be
expanded as shell variables. This is a serious problem because all the
password hash methods besides DES use multiple `$` in the hashes. Single
quotes ('') should be used instead to prevent shell variable expansion.
2014-02-10 08:16:22 -06:00
Shea Levy 6a8cc9ab11 mediawiki: Fix some references to /bin/bash 2014-02-10 09:14:30 -05:00
Shea Levy 42df6fcee9 mediawiki: Run update script after initializing the database 2014-02-10 08:56:16 -05:00
Shea Levy 258c7536be Force a rebuild 2014-02-09 11:59:02 -05:00
Tomasz Kontusz fe38031168 Upgrade bumblebee and add nixos module
* Bump bumblebee to 3.2.1
 * Remove config.patch - options it added can be passed to ./configure now
 * Remove the provided xorg.conf
   Provided xorg.conf was causing problems for some users,
   and Bumblebee provides its own default configuration anyway.
 * Make secondary X11 log to /var/log/X.bumblebee.log
 * Add a module for bumblebee
2014-02-09 15:09:41 +01:00
Bjørn Forsman 48851fa749 nixos/memtest: use docbook formatting
Without this the HTML manual and manpage is quite unreadable (newlines
are squashed so it doesn't look like a list anymore).

(Unfortunately, this makes the source unreadable.)
2014-02-09 13:56:09 +01:00
Ricardo M. Correia cba2444d11 nixos/memtest: Allow user to specify memtest86 boot parameters 2014-02-09 13:55:37 +01:00
Domen Kožar 028379be28 nixos: add most basic gnome3 test and take a screenshot 2014-02-08 21:47:39 +01:00
Domen Kožar ee14f8da9a remove references to isSystemUser and fix eval of tested job 2014-02-08 21:10:00 +01:00
Shea Levy dea562b6b9 services.mesa -> hardware.opengl
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-08 14:45:37 -05:00
Domen Kožar b17edbac57 ModemManager: 0.5.4.0 -> 0.7.991 2014-02-08 20:17:00 +01:00
Petr Rockai 12315a278c Merge branch 'yubikey' of git://github.com/Calrama/nixpkgs 2014-02-08 16:01:22 +01:00
Moritz Maxeiner 09f9af17b4 Update to the Yubikey PBA
Security-relevant changes:
 * No (salted) passphrase hash send to the yubikey, only hash of the salt (as it was in the original implementation).
 * Derive $k_luks with PBKDF2 from the yubikey $response (as the PBKDF2 salt) and the passphrase $k_user
   (as the PBKDF2 password), so that if two-factor authentication is enabled
   (a) a USB-MITM attack on the yubikey itself is not enough to break the system
   (b) the potentially low-entropy $k_user is better protected against brute-force attacks
 * Instead of using uuidgen, gather the salt (previously random uuid / uuid_r) directly from /dev/random.
 * Length of the new salt in byte added as the parameter "saltLength", defaults to 16 byte.
   Note: Length of the challenge is 64 byte, so saltLength > 64 may have no benefit over saltLengh = 64.
 * Length of $k_luks derived with PBKDF2 in byte added as the parameter "keyLength", defaults to 64 byte.
   Example: For a luks device with a 512-bit key, keyLength should be 64.
 * Increase of the PBKDF2 iteration count per successful authentication added as the
   parameter "iterationStep", defaults to 0.

Other changes:
 * Add optional grace period before trying to find the yubikey, defaults to 2 seconds.

Full overview of the yubikey authentication process:

  (1) Read $salt and $iterations from unencrypted device (UD).
  (2) Calculate the $challenge from the $salt with a hash function.
      Chosen instantiation: SHA-512($salt).
  (3) Challenge the yubikey with the $challenge and receive the $response.
  (4) Repeat three times:
    (a) Prompt for the passphrase $k_user.
    (b) Derive the key $k_luks for the luks device with a key derivation function from $k_user and $response.
        Chosen instantiation: PBKDF2(HMAC-SHA-512, $k_user, $response, $iterations, keyLength).
    (c) Try to open the luks device with $k_luks and escape loop (4) only on success.
  (5) Proceed only if luks device was opened successfully, fail otherwise.

  (6) Gather $new_salt from a cryptographically secure pseudorandom number generator
      Chosen instantiation: /dev/random
  (7) Calculate the $new_challenge from the $new_salt with the same hash function as (2).
  (8) Challenge the yubikey with the $new_challenge and receive the $new_response.
  (9) Derive the new key $new_k_luks for the luks device in the same manner as in (4) (b),
      but with more iterations as given by iterationStep.
 (10) Try to change the luks device's key $k_luks to $new_k_luks.
 (11) If (10) was successful, write the $new_salt and the $new_iterations to the UD.
      Note: $new_iterations = $iterations + iterationStep

Known (software) attack vectors:

 * A MITM attack on the keyboard can recover $k_user. This, combined with a USB-MITM
   attack on the yubikey for the $response (1) or the $new_response (2) will result in
   (1) $k_luks being recovered,
   (2) $new_k_luks being recovered.
 * Any attacker with access to the RAM state of stage-1 at mid- or post-authentication
   can recover $k_user, $k_luks, and  $new_k_luks
 * If an attacker has recovered $response or $new_response, he can perform a brute-force
   attack on $k_user with it without the Yubikey needing to be present (using cryptsetup's
   "luksOpen --verify-passphrase" oracle. He could even make a copy of the luks device's
   luks header and run the brute-force attack without further access to the system.
 * A USB-MITM attack on the yubikey will allow an attacker to attempt to brute-force
   the yubikey's internal key ("shared secret") without it needing to be present anymore.

Credits:

 * Florian Klien,
   for the original concept and the reference implementation over at
   https://github.com/flowolf/initramfs_ykfde
 * Anthony Thysse,
   for the reference implementation of accessing OpenSSL's PBKDF2 over at
   http://www.ict.griffith.edu.au/anthony/software/pbkdf2.c
2014-02-08 14:59:52 +01:00
Domen Kožar 5ffab7710d gnome3.gnome_control_center: build and fix runtime deps 2014-02-08 12:30:23 +01:00
Bjørn Forsman db12d783ff nixos: add uid/gid for munin
To be compatible with eb2f44c18c (Generate
/etc/passwd and /etc/group at build time). Without this you'll get this:

  $ nixos-rebuild build
  [...]
  user-thrown exception: The option `users.extraGroups.unnamed-9.1.gid' is used but not defined.
2014-02-07 23:08:15 +01:00
Shea Levy e058de1642 Add option to enforce uniqueness of uids/gids (on by default)
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-07 09:57:28 -05:00
Domen Kožar 506a030b91 gnome3: add missing files 2014-02-07 00:37:17 +01:00
Domen Kožar 65a28e8b73 Add gnome3 desktop manager. Very experimental.
Currently very basic gnome-shell launches on my laptop. Quite some
services won't start yet, most notable is gnome-control-center.

GTK3 apps still don't have theming applied and for example launching
chromium results in horrible red windows.
2014-02-07 00:31:29 +01:00
Domen Kožar 15fb296b43 xfce: partially add gtk3 support 2014-02-07 00:30:21 +01:00