Commit graph

82957 commits

Author SHA1 Message Date
Svein Ove Aas 3d8f9a6937 ckan: Add curl to runtime libraries 2016-05-06 18:04:01 +01:00
zimbatm 4ba7767d91 Merge pull request #14722 from puffnfresh/bug/dockertools-postmount
dockerTools: only add "/nix" if it exists
2016-05-06 17:40:23 +01:00
Lluís Batlle i Rossell 53a4582552 Adding vmlinux to linux kernel 'dev' derivation.
It takes some extra 13MB (and in dev, not out), but allows perf to show kernel
symbols when profiling. I think it is worth it.

In my NixOS, I refer to it in the system derivation, for easy telling to perf
through /run/booted-system/vmlinux:

  system.extraSystemBuilderCmds = ''
    ln -s ${config.boot.kernelPackages.kernel.dev}/vmlinux $out/vmlinux
  '';
2016-05-06 18:11:03 +02:00
Joachim Fasting 5a0cde6c19 Merge pull request #15277 from NeQuissimus/kernel453
kernel: 4.5.2 -> 4.5.3
2016-05-06 17:20:27 +02:00
Tim Steinbach 02d94d335a
kernel: 4.5.2 -> 4.5.3 2016-05-06 11:12:04 -04:00
Joachim Fasting e341771fc8 Merge pull request #15273 from NeQuissimus/gradle213
gradle: 2.12 -> 2.13
2016-05-06 17:04:39 +02:00
aszlig eb6e366446
nixos/release-combined: Add boot-stage1 test
We don't want to push out a channel update whenever this test fails,
because that might have unexpected and confused side effects and it
*really* means that stage 1 of our boot up is broken.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-06 16:56:54 +02:00
aszlig 4f796c28d5
nixos/tests: Add a test for boot stage 1
We already have a small regression test for #15226 within the swraid
installer test. Unfortunately, we only check there whether the md
kthread got signalled but not whether other rampaging processes are
still alive that *should* have been killed.

So in order to do this we provide multiple canary processes which are
checked after the system has booted up:

 * canary1: It's a simple forking daemon which just sleeps until it's
            going to be killed. Of course we expect this process to not
            be alive anymore after boot up.
 * canary2: Similar to canary1, but tries to mimick a kthread to make
            sure that it's going to be properly killed at the end of
            stage 1.
 * canary3: Like canary2, but this time using a @ in front of its
            command name to actually prevent it from being killed.
 * kcanary: This one is a real kthread and it runs until killed, which
            shouldn't be the case.

Tested with and without 67223ee and everything works as expected, at
least on my machine.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-06 16:56:43 +02:00
Tim Steinbach a17c90dcd1
gradle: 2.12 -> 2.13 2016-05-06 10:52:25 -04:00
aszlig dc6d003011
nixos/tests/installer/swraid: Check for safemode
This is a regression test for #15226, so that the test will fail once we
accidentally kill one or more of the md kthreads (aka: if safe mode is
enabled).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-06 16:51:38 +02:00
Joachim Fasting 50d915c758
grsecurity: optionally disable features for redistributed kernels 2016-05-06 16:37:25 +02:00
Joachim Fasting 27061905bd
linuxPackages_grsec_4_5: 3.1-4.5.2-201604290633 -> 3.1-4.5.3-201605060852 2016-05-06 16:37:25 +02:00
aszlig 67223ee205
nixos/stage-1: Don't kill kernel threads
Unfortunately, pkill doesn't distinguish between kernel and user space
processes, so we need to make sure we don't accidentally kill kernel
threads.

Normally, a kernel thread ignores all signals, but there are a few that
do. A quick grep on the kernel source tree (as of kernel 4.6.0) shows
the following source files which use allow_signal():

  drivers/isdn/mISDN/l1oip_core.c
  drivers/md/md.c
  drivers/misc/mic/cosm/cosm_scif_server.c
  drivers/misc/mic/cosm_client/cosm_scif_client.c
  drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
  drivers/staging/rtl8188eu/core/rtw_cmd.c
  drivers/staging/rtl8712/rtl8712_cmd.c
  drivers/target/iscsi/iscsi_target.c
  drivers/target/iscsi/iscsi_target_login.c
  drivers/target/iscsi/iscsi_target_nego.c
  drivers/usb/atm/usbatm.c
  drivers/usb/gadget/function/f_mass_storage.c
  fs/jffs2/background.c
  fs/lockd/clntlock.c
  fs/lockd/svc.c
  fs/nfs/nfs4state.c
  fs/nfsd/nfssvc.c

While not all of these are necessarily kthreads and some functionality
may still be unimpeded, it's still quite harmful and can cause
unexpected side-effects, especially because some of these kthreads are
storage-related (which we obviously don't want to kill during bootup).

During discussion at #15226, @dezgeg suggested the following
implementation:

for pid in $(pgrep -v -f '@'); do
    if [ "$(cat /proc/$pid/cmdline)" != "" ]; then
        kill -9 "$pid"
    fi
done

This has a few downsides:

 * User space processes which use an empty string in their command line
   won't be killed.
 * It results in errors during bootup because some shell-related
   processes are already terminated (maybe it's pgrep itself, haven't
   checked).
 * The @ is searched within the full command line, not just at the
   beginning of the string. Of course, we already had this until now, so
   it's not a problem of his implementation.

I posted an alternative implementation which doesn't suffer from the
first point, but even that one wasn't sufficient:

for pid in $(pgrep -v -f '^@'); do
    readlink "/proc/$pid/exe" &> /dev/null || continue
    echo "$pid"
done | xargs kill -9

This one spawns a subshell, which would be included in the processes to
kill and actually kills itself during the process.

So what we have now is even checking whether the shell process itself is
in the list to kill and avoids killing it just to be sure.

Also, we don't spawn a subshell anymore and use /proc/$pid/exe to
distinguish between user space and kernel processes like in the comments
of the following StackOverflow answer:

http://stackoverflow.com/a/12231039

We don't need to take care of terminating processes, because what we
actually want IS to terminate the processes.

The only point where this (and any previous) approach falls short if we
have processes that act like fork bombs, because they might spawn
additional processes between the pgrep and the killing. We can only
address this with process/control groups and this still won't save us
because the root user can escape from that as well.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #15226
2016-05-06 16:24:42 +02:00
Tobias Geerinckx-Rice ab6e0861d4
nginx: restore .upstream files
07d9de713a
2016-05-06 15:37:22 +02:00
Lluís Batlle i Rossell 2f35e223b1 Adding libuuid (libblkid) to lvm2.
It wants it to detect if there are filesystems present in block devices, in
case of pvcreate. Otherwise it complaints "lvm built without blkid support" and
lacks the feature of detecting/wiping.
2016-05-06 15:09:49 +02:00
Lluís Batlle i Rossell 9f6afb7d78 Fixing nfsd service, wait on local-fs.
Otherwise, mountd was started exporting directories before local-fs was ready,
and it failed to start nfsd on missing fs.
2016-05-06 15:03:30 +02:00
Robert Helgesson 1a5b5593d6 eclipse-plugin-scala: 4.4.0 -> 4.4.1 2016-05-06 13:59:01 +02:00
Bart Brouns f43265657d faustCompressors: init at 0.1.1, update other magnetophon-dsp to use lv2 gui 2016-05-06 13:56:40 +02:00
Tobias Geerinckx-Rice 273e160a12
jfbview: split out jfbpdf (jfbview w/o imlib2) 2016-05-06 13:47:50 +02:00
Tobias Geerinckx-Rice e7cfdd6c14
jfbview: 0.5.1 -> 0.5.2 2016-05-06 13:47:49 +02:00
Tobias Geerinckx-Rice 982f83d310
zpaq: 7.12 -> 7.13 2016-05-06 13:47:48 +02:00
Tobias Geerinckx-Rice b0f8349d95
nginxUnstable: alias to nginx until next unstable release 2016-05-06 13:47:36 +02:00
Tobias Geerinckx-Rice 07d9de713a
nginx: remove .upstream files 2016-05-06 13:47:12 +02:00
Frederik Rietdijk 8729bd8bb9 pythonPackages.boto3: enable tests, fixes #14985
I've modified #14985 by @adnelson to take into account the update in
b68f09a520
2016-05-06 12:49:10 +02:00
zimbatm e8803166ef elixir: 1.2.4 -> 1.2.5 2016-05-06 11:23:10 +02:00
zimbatm 9e04279006 Merge branch 'pr/14743'
Closes #14743
2016-05-06 10:07:11 +01:00
ft 8ddddbfe43 added berkeley upc 2016-05-06 10:06:08 +01:00
Vladimír Čunát 25960a52c3 tested job: fix evaluation of chromium tests
It's a bit inconsistent now, but I want mainly unblock the channel.
/cc maintainer @aszlig.
2016-05-06 10:56:17 +02:00
Joachim Fasting 5812642025 Merge pull request #15260 from couchemar/hub-2.2.3
hub: 2.2.2 -> 2.2.3
2016-05-06 10:19:05 +02:00
Peter Simons 71c736e34d Merge pull request #14898 from peti/remove-dovecot-package-option
nixos: remove redundant services.dovecot2.package option
2016-05-06 10:11:45 +02:00
Peter Simons d270604117 nixos: remove redundant services.dovecot2.package option
Instead of using this option, please modify the dovecot package by means of an
override. For example:

  nixpkgs.config.packageOverrides = super: {
    dovecot = super.dovecot.override { withPgSQL = true; };
  };

Closes https://github.com/NixOS/nixpkgs/issues/14097.
2016-05-06 10:10:06 +02:00
Damien Cassou 4e7e1a8fb6 Merge pull request #15261 from DamienCassou/pharo-vm5-2016.05.04
pharo-vm5: 2016.04.04 -> 2016.05.04
2016-05-06 10:04:36 +02:00
Damien Cassou 7e3f222e7d pharo-vm5: 2016.04.04 -> 2016.05.04 2016-05-06 10:03:02 +02:00
Andrey Pavlov f5668437ab hub: 2.2.2 -> 2.2.3 2016-05-06 10:39:29 +03:00
Damien Cassou a06e3b96f8 Merge pull request #15258 from DamienCassou/pharo-vm-PharoV50.sources
pharo-vm: add PharoV50.sources
2016-05-06 09:31:22 +02:00
Damien Cassou 8f1fb8de5b pharo-vm: add PharoV50.sources 2016-05-06 09:29:29 +02:00
Joachim Fasting cb7f378e9c Merge pull request #15246 from joachifm/bittorrentSync-generic
Bittorrent sync: refactor & update
2016-05-06 08:31:27 +02:00
Franz Pletz 5c49790be5 Merge pull request #15198 from groxxda/bump/iptables
iptables: 1.4.21 -> 1.6.0
2016-05-06 03:18:32 +02:00
Franz Pletz e478b63b27 Merge pull request #14835 from groxxda/libcap
libcap: 2.24 -> 2.25, replace old split with multi-output
2016-05-06 03:15:16 +02:00
Alexander Ried aae11b1781 iproute2: 4.3.0 -> 4.5.0 (#15193) 2016-05-06 03:09:47 +02:00
Joachim Fasting 715e42dc76
dnscrypt-proxy: minor refactor 2016-05-06 01:57:08 +02:00
Joachim Fasting aa478b5021
bittorrentSync: factor out common parts 2016-05-06 01:03:04 +02:00
Joachim Fasting e4bd66c8f0
bittorrentSync20: 2.3.6 -> 2.3.7 2016-05-06 00:42:31 +02:00
Anthony Cowley d87e3b2a55 libsndfile: pass AudioToolbox framework on darwin
The libsndfile build system wants this framework when building on
darwin.
2016-05-05 18:39:58 -04:00
zimbatm 249dcabb33 Merge pull request #14679 from aneeshusa/add-gnome-shell-extensions
Add gnome shell extensions
2016-05-05 23:07:37 +01:00
Joachim Fasting 29ddb150c8 Merge pull request #15247 from uralbash/flamerobin
flamerobin: init at 0.9.3.1
2016-05-05 23:56:54 +02:00
zimbatm bfe001e210 pythonPackages.ipyparallel: 5.0.0 -> 5.0.1 2016-05-05 22:55:02 +01:00
zimbatm 6f9645e426 pythonPackages.notebook: 4.1.0 -> 4.2.0 2016-05-05 22:55:02 +01:00
zimbatm 5cf3ad9f4b pythonPackages.ipykernel: 4.3.0 -> 4.3.1 2016-05-05 22:55:02 +01:00
zimbatm b3eaac6d83 pythonPackages.jupyer_client: 4.1.1 -> 4.2.2 2016-05-05 22:55:02 +01:00