Commit graph

106396 commits

Author SHA1 Message Date
Joachim Fasting 878ad1ce6e
nixos: add option to lock kernel modules
Adds an option `security.lockKernelModules` that, when enabled, disables
kernel module loading once the system reaches its normal operating state.

The rationale for this over simply setting the sysctl knob is to allow
some legitmate kernel module loading to occur; the naive solution breaks
too much to be useful.

The benefit to the user is to help ensure the integrity of the kernel
runtime: only code loaded as part of normal system initialization will be
available in the kernel for the duration of the boot session.  This helps
prevent injection of malicious code or unexpected loading of legitimate
but normally unused modules that have exploitable bugs (e.g., DCCP use
after free CVE-2017-6074, n_hldc CVE-2017-2636, XFRM framework
CVE-2017-7184, L2TPv3 CVE-2016-10200).

From an aestethic point of view, enabling this option helps make the
configuration more "declarative".

Closes https://github.com/NixOS/nixpkgs/pull/24681
2017-04-30 12:05:37 +02:00
Vladimír Čunát 7ee05dff30
Merge: efl: 1.18.x -> 1.19.0 (close #25095)
I used a setupHook instead of patching expressions for individual
reverse dependencies (four were broken).
2017-04-30 11:36:36 +02:00
Vladimír Čunát 18a7f7d4a5
efl: set $HOME for reverse dependencies 2017-04-30 11:35:59 +02:00
Vladimír Čunát aa044dd105
efl: wrap the first line
It was >400 chars long!
2017-04-30 11:35:30 +02:00
Jörg Thalheim fa5196e47e Merge pull request #25005 from Lassulus/copytoram
nixos/stage1: add copytoram support
2017-04-30 11:22:45 +02:00
Frederik Rietdijk dce7ebbd9b pythonPackages.basemap: build wheel, fixes #24621 2017-04-30 10:37:04 +02:00
Frederik Rietdijk a4aaf5adfd pyside: fix on Python 3.x, closes #25328
Pyside requires several tools that do not provide Python modules. They
therefore do not need to be build Python-version dependent and so we
move them out of `python-packages.nix`.

Furthermore, shiboken needs libxml2 and libxslt libraries but not their
Python bindings.
2017-04-30 10:33:19 +02:00
Michael Raskin d729a25a3e Merge pull request #21321 from rardiol/worldengine
Worldengine
2017-04-30 10:28:40 +02:00
Alexey Lebedeff 4ae18e0463 apitrace: 7.1 -> git (#24829)
After upgrade `qapitrace` have working "Buffers" tab where the data
can be inspected (it was always empty before).

There is no tags after `7.1`, but I think that fixing pretty important
piece of functionality warrants an upgrade to current `master` tip.
2017-04-30 10:27:17 +02:00
Frederik Rietdijk 3425c37ac6 Merge pull request #25336 from matthewbauer/nix-bundle
nix-bundle: v0.1.1 -> v0.1.3
2017-04-30 09:58:18 +02:00
Matthew Bauer 8b5854e260 nix-bundle: 0.1.2 -> 0.1.3 2017-04-30 02:23:31 -05:00
Peter Hoeg 03f939ebf7 kirigami2: 1.90.0 -> 2.1.0
Also use a generic builder.
2017-04-30 14:07:45 +08:00
Guillaume Maudoux 92f53af64d factorio-demo: init at 0.14.23 (#25265) 2017-04-30 02:51:07 +01:00
Shea Levy 99c28df9e5 hackage-packages.nix: automatic Haskell package set update
This update was generated by hackage2nix v2.1.1-8-g19ebdb9 from Hackage revision
3fcb79c182.
2017-04-29 21:31:34 -04:00
Michael Raskin 9031c35b6c julia_05: 0.5.0 -> 0.5.1 2017-04-30 01:13:44 +02:00
John Ericson f71456ac24 Merge pull request #25301 from matthewbauer/impure-cross
impure.nix: add crossSystem as arg
2017-04-29 23:19:52 +01:00
Jan Malakhovski 48ec680ddb torbrowser: rename to tor-browser-bundle-bin 2017-04-30 00:08:21 +02:00
SLNOS 00a0b8a574 firefoxPackages: tor-browser: init at 6.5.2 2017-04-30 00:08:19 +02:00
Jan Malakhovski 2f35ab5960 firefoxPackages: implement privacySupport option 2017-04-30 00:08:18 +02:00
Jan Malakhovski f0f572ff46 firefox: refactor into firefoxPackages, add more options 2017-04-30 00:08:16 +02:00
Jan Malakhovski 1d407173b0 firefox: rename default.nix -> common.nix 2017-04-30 00:08:16 +02:00
Michael Weiss 8c9b60a830 pykde4: Remove kde4.pykde4
This package is broken since 0a3b7f994e
(python-sip: 4.18.1 -> 4.19.1). Removing it seems reasonable since we're
dropping KDE4 anyway.

Fixes #24548.
2017-04-29 23:10:07 +02:00
Joachim F f15dae36fe Merge pull request #25295 from mguentner/youtubedl_170428
youtube-dl: 2017.04.17 -> 2017.04.28
2017-04-29 22:06:50 +01:00
Matthew Bauer 5c7815a388
impure.nix: add crossSystem as arg 2017-04-29 15:22:33 -05:00
Michael Weiss 852813689a desktop-managers: Use a black BG as fallback
Use a solid black background when no background image (via
~/.background-image) is provided. In my case this fixes the really
strange behaviour when i3 without a desktop manager starts with the SDDM
login screen as background image.
2017-04-29 19:03:30 +02:00
Joachim Fasting 63433537ce
nixos/hardened profile: disable legacy virtual syscalls
This eliminates a theoretical risk of ASLR bypass due to the fixed address
mapping used by the legacy vsyscall mechanism.  Modern glibc use vdso(7)
instead so there is no loss of functionality, but some programs may fail
to run in this configuration.  Programs that fail to run because vsyscall
has been disabled will be logged to dmesg.

For background on virtual syscalls see https://lwn.net/Articles/446528/

Closes https://github.com/NixOS/nixpkgs/pull/25289
2017-04-29 17:27:11 +02:00
Michael Raskin f1c7d5a6ba gimpPlugins.resynthesizer2: fix build 2017-04-29 16:51:25 +02:00
Maximilian Bosch b12f76ddd3 geogebra: 5-0-350-0 -> 5-0-355-0 (#25324) 2017-04-29 14:34:57 +01:00
Jörg Thalheim e715283dca Merge pull request #25306 from NickHu/teamviewer
teamviewer: 12.0.71510 -> 12.0.76279
2017-04-29 15:26:36 +02:00
Michael Raskin f44165f484 Merge pull request #25303 from tohl/master
sbcl updates
2017-04-29 13:31:14 +02:00
Michael Raskin 4a207b1dd8 gimpPlugins.resynthesizer: fix build 2017-04-29 12:41:31 +02:00
Michael Raskin 316d0ff7c7 libsamplerate: update license information (in effect since 0.1.9) 2017-04-29 12:34:11 +02:00
Michael Raskin adadf7e5ce androidsdk: meta.url to meta.homepage 2017-04-29 12:26:16 +02:00
Franz Pletz bd27594bc6
promtheus-node-exporter: 0.13.0 -> 0.14.0 2017-04-29 11:44:39 +02:00
Robin Gloster 154dacde20
grafana: 4.1.2 -> 4.2.0 2017-04-29 11:43:17 +02:00
Jörg Thalheim ffdc1b0ab0 Merge pull request #25310 from jerith666/command-not-found-is-a-dir
fix 'command-not-found: is a directory' error
2017-04-29 11:41:22 +02:00
Robin Gloster edb1ea055e
confluence module: needs bash for health checks 2017-04-29 11:15:59 +02:00
Jörg Thalheim fddeacfe4c Merge pull request #25316 from ericsagnes/pkg-update/ibus-mozc
ibus-engines.mozc:  2.17.2313.102 -> 2.20.2673.102
2017-04-29 11:14:00 +02:00
Jörg Thalheim 6af952fac8
rtkit: fix meta attr 2017-04-29 10:49:12 +02:00
Jörg Thalheim 6318a0c64c Merge pull request #25318 from ericsagnes/feat/stdenv-metacheck
stdenv-generic: add meta attributes checks
2017-04-29 10:48:00 +02:00
Peter Simons d1008a9a5f Merge pull request #25299 from ahmedtd/fix-wrap-gapps-hook
wrapGAppsHook: Correct `wrapProgram` invocations
2017-04-29 10:33:52 +02:00
Jaka Hudoklin 85d16bd7af Merge pull request #25312 from calvertvl/update-xpra-2_0_2
xpra: 2.0.1 -> 2.0.2
2017-04-29 10:33:32 +02:00
Eric Sagnes 7004919243 stdenv-generic: add meta attributes checks 2017-04-29 17:07:01 +09:00
Eric Sagnes 424f175546 ibus-engines.mozc: 2.17.2313.102 -> 2.20.2673.102 2017-04-29 15:26:22 +09:00
Dan Peebles 90b9719f4f treewide: fix the remaining issues with meta attributes 2017-04-29 04:24:34 +00:00
Victor Calvert 5539f8acfa xpra: 2.0.1 -> 2.0.2 2017-04-28 23:39:19 -04:00
Matt McHenry 48a3e1a88d fix 'command-not-found: is a directory' error 2017-04-28 23:11:21 -04:00
Dan Peebles 1a4ca220e1 treewide: fix assorted issues revealed by the meta checker
Turns out a couple of the licenses were wrong, as well as being strings.
2017-04-28 23:07:42 -04:00
Daniel Peebles 76137a801d Merge pull request #25304 from copumpkin/check-meta
stdenv-generic: add meta attribute checking
2017-04-28 21:55:30 -04:00
Nick Hu 90c5bf8c58 teamviewer: 12.0.71510 -> 12.0.76279 2017-04-29 00:29:18 +01:00