Commit graph

326 commits

Author SHA1 Message Date
Jaka Hudoklin eee1bb5ae5 docker: update to 1.6.0 2015-04-25 15:46:35 +02:00
aszlig b0e3d7c4b5
virtualbox: Update to version 4.3.26.
Upstream changelog:

 * GUI: in the snapshots pane, protect the age of snapshots against
        wrong host time
 * NAT Network: fixed a bug which prevented to propagate any DNS name
                server / domain / search string information to the NAT
                network (4.3.24 regression)
 * NAT Network: don't delay the shutdown of VBoxSVC on Windows hosts
 * Mouse support: the mouse could not be moved under rare conditions if
                  no Guest Additions are installed (4.3.24 regression)
 * Storage: if the guest ejects a virtual CD/DVD medium, make the change
            permanent
 * VGA: made saving secondary screen sizes possible in X11 guests
 * SDK: fixed the VirtualBox.tlb file (4.3.20 regression)
 * rdesktop-vrdp: make it work with USB devices again (4.3.14
                  regression)
 * USB: fixed a possible BSOD on Windows hosts under rare conditions
 * iPXE: enable the HTTP download protocol on non-Linux hosts
 * Mac OS X hosts: don't panic on hosts with activated SMAP (Broadwell
                   and later)
 * Linux hosts: don't crash Linux 4.0 hosts

The same with bug IDs can be found at:

https://www.virtualbox.org/wiki/Changelog

Tested on my machine using the virtualbox NixOS VM test.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-04-04 17:09:15 +02:00
aszlig 416545a57b
virtualbox: Remove group check on /nix/store.
This is espacially cruicial when it comes to Nix 1.9, where we even have
a more restrictive /nix/store. In any event, VirtualBox in hardenend
mode doesn't have to check the /nix/store path, because it's read-only
on NixOS systems. So this check would not introduce more security but
more hurdles, thus I'm removing it (of course _only_ for /nix/store).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-04-04 17:09:15 +02:00
William A. Kennington III 53d5b564d4 qemu: 2.2.0 -> 2.2.1 2015-03-26 14:54:00 -07:00
aszlig 54a8e13f2a
virtualbox: Update to new upstream version 4.3.24.
New maintenance release, changes:

 * VMM: emulation fix for the ENTER instruction under certain
   conditions; fixes Solaris 10 guests (VT-x without unrestricted guest
   execution)
 * VMM: fix for handling NMIs on Linux hosts with X2APIC enabled
 * NAT/NAT Network: fix connection drops when the host's DHCP lease was
   renewed (4.3.22 regression; Windows hosts only)
 * NAT: don't crash on an empty domain list when switching the DNS host
   configuration (4.3.22 regression; Mac OS X hosts only)
 * PXE: re-enable it on Windows hosts (4.3.22 regression; Windows hosts
   only)
 * Shared Folders: fixed a problem with Windows guests (4.3.22
   regression)
 * Audio: improved record quality when using the DirectSound audio
   backend
 * VBoxManage: when executing the controlvm command take care that the
   corresponding VM runtime changes are saved permanently
 * Windows Installer: properly install the 32-bit version of VBoxRes.dll
   on 32-bit hosts
 * Linux hosts / guests: Linux 4.0 fixes
 * OS/2 Additions: fixed mouse integration (4.3.22 regression)
 * X11 Additions: fixed a sporadic failure to deactivate virtual screens

Full changelog with bug IDs can be found at:

https://www.virtualbox.org/wiki/Changelog

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-03-04 15:14:16 +01:00
Tobias Geerinckx-Rice 39ff896253 virtualbox 4.3.20 -> 4.3.22 2015-03-02 21:52:14 +01:00
Jaka Hudoklin ef291d2c66 Merge pull request #6586 from offlinehacker/pkgs/docker/update
docker: update to 1.5.0
2015-02-28 03:54:25 +01:00
Jaka Hudoklin 6944b2bde7 docker: update to 1.5.0 2015-02-27 13:53:38 +01:00
Thomas Strobel 6ad73af7a2 Fix: Build Xen only for x86_64 Linux platforms. 2015-02-27 08:13:05 +01:00
Bjørn Forsman 34f8d2597c Fix eval (xen: bridge_utils => bridge-utils) 2015-02-26 20:49:33 +01:00
Eelco Dolstra 6177710ac7 Merge pull request #6046 from ts468/xen
Update: Xen 4.5 + NixOS Xen modules
2015-02-26 10:15:05 +01:00
Thomas Strobel 3d4fbb874c Update: add new Xen versions + update NixOS Xen modules
Versions of XEN:
- Xen 4.5
- Xen 4.5 + XenServer patches
- Xen 4.4.1
2015-02-25 23:30:44 +01:00
Nathaniel Baxter e0cefbca65 virt-viewer: update from 1.0 to 2.0 2015-02-21 16:29:50 +11:00
Nathaniel Baxter ce7449f68b virt-manager: update from 1.0.1 to 1.1.0 2015-02-21 16:29:50 +11:00
Bjørn Forsman 97875ac175 bridge-utils: align attrname with pkgname 2015-02-20 22:30:51 +01:00
William A. Kennington III d847059c55 Merge pull request #6380 from codyopel/docker-fix
docker: fix shebangs, closes #6368
2015-02-16 19:01:27 -08:00
codyopel 6d3fee045a docker: fix shebangs, closes #6368 2015-02-16 21:41:46 -05:00
James Cook 6daf9aa922 Merge pull request #5995 from ts468/qemu-vm
Update QEMU Nixos Virtual Machine
2015-02-16 13:13:26 -08:00
Thomas Strobel 80afabd5b5 Update QEMU Nixos Virtual Machine
The Nixos Qemu VM that are used for VM tests can now start without
boot menu even when using a bootloader.
The Nixos Qemu VM with bootloader can emulate a EFI boot now.
2015-02-16 20:07:42 +01:00
Vladimír Čunát dbae4f109f Merge branch 'master' into staging
Conflicts (relatively simple):
	pkgs/applications/audio/spotify/default.nix
	pkgs/build-support/cc-wrapper/default.nix
	pkgs/development/compilers/cryptol/1.8.x.nix
2015-01-31 19:34:57 +01:00
Brian McKenna a26b8bcb5d Upgrade to Docker 1.4 2015-01-20 19:49:10 -07:00
Eric Seidel f3c6827373 rename all occurrences of stdenv.cc.gcc to stdenv.cc.cc 2015-01-14 20:27:55 -08:00
Eelco Dolstra 8281ef1231 Merge pull request #5425 from ts468/xen
Update: Xen: 4.0.3 -> 4.4.1
2015-01-02 12:01:40 +01:00
John Wiegley 28b6fb61e6 Change occurrences of gcc to the more general cc
This is done for the sake of Yosemite, which does not have gcc, and yet
this change is also compatible with Linux.
2014-12-26 11:06:21 -06:00
vbgl e553cbee5a Merge pull request #5446 from nckx/remotebox-squashed
Add RemoteBox, a (you guessed it) remote VirtualBox client
2014-12-25 23:32:51 +01:00
Domen Kožar 2af2d5a38c Merge pull request #3835 from wkennington/master.qemu
qemu: 2.0.0 -> 2.2.0
2014-12-24 16:34:56 +01:00
Tobias Geerinckx-Rice bc5938b07d Add remotebox: VirtualBox client with remote management 2014-12-23 16:22:07 +01:00
Thomas Strobel 732c303bb8 Update: Xen -> 4.4.1 2014-12-22 09:51:27 +01:00
Pascal Wittmann f94580da69 Fix license attribute of many bsd-like licensed packages 2014-12-21 00:00:35 +01:00
aszlig ac603e208c
virtualbox: Fix runtime paths in hardening mode.
Because we have to rely on setuid wrappers on NixOS, we can't easily
hardcode the executable paths and set it 4755. So for all calls, we need
to change the runtime path executable directory to /var/setuid-wrappers/
and for verification we need to retain the executable directory.

Also note, that usually VBoxNetAdpCtl, VBoxNetDHCP, VBoxNetNAT, VBoxSDL
and VBoxVolInfo don't reside in directories that are commonly in PATH,
but in /usr/lib/virtualbox in most mainstream distros. But because the
names of these executables are distinctive enough to not cause
collisions with other setuid programs, I'll leave it like that and not
patch up setuid-wrappers.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-12-18 14:06:13 +01:00
aszlig b69ac6c159
virtualbox: Allow to easily change the build type.
Not really changes anything in functionality, but makes it easier to
change the build type to "debug", for example.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-12-18 14:06:12 +01:00
aszlig 14ef3446e1
virtualbox: Fix hardcoded /sbin/ifconfig path.
Just accidentally found this while debugging and it's needed for
fetching a few interface details, not sure however whether because of
this anything has been broken so far.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-12-18 14:06:12 +01:00
aszlig 5a8c5d2768
virtualbox: Explicitly excempt src during install.
Instead of coping it to $out and later deleting it, we now exclude the
src directory during copy. Also, we no longer cd into the release
directory during installPhase, which should make sure that we are
constantly in $sourceRoot.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-12-18 14:06:12 +01:00
Rob Vermaas 90c3dc79c5 docker: update from 1.3.1 to 1.3.3, potentially fixes CVE-2014-6407, CVE-2014-6408 2014-12-17 15:47:56 +01:00
Bjørn Forsman a2bb84a936 virt-viewer: fix missing schema error
Fixes this error, as seen when trying to open a guest VM when
virt-viewer is accessed over ssh with X forwarding:

  GLib-GIO-ERROR **: Settings schema 'org.gnome.system.proxy' is not installed

A similar issue was fixed for virt-manager in commit
fb8a2b3be7 ("virt-manager: fix missing
schema error")
2014-12-16 14:07:02 +01:00
aszlig eb561f0798
virtualbox: Fix extension pack without hardening.
We divert to the $out/share/virtualbox directory only if we have
hardening enabled, so let's put the extension pack into
$out/libexec/virtualbox instead if we're compiling without hardening.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-12-16 11:24:55 +01:00
Bjørn Forsman 477bc03568 virt-viewer: fix SPICE support
* Add missing dependency on 'spice_protocol'

* Fix new build error which came now that ./configure enables SPICE support:

  building virt-viewer
    CCLD     virt-viewer
  /nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/ld: cannot find -lgdbm
  /nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/ld: cannot find -lcap
  collect2: error: ld returned 1 exit status

  Fix by adding gddbm and libcap as inputs. Yes, libcap is needed
  _in addition_ to libcap_ng (I tested removing libcap_ng, it failed).

Without this change, virt-viewer cannot be used with guests machines
that uses SPICE.
2014-12-16 10:48:40 +01:00
Eelco Dolstra d9ce3ae57f virtualbox: Get tid of runtime dependency on linux.dev 2014-12-15 17:54:06 +01:00
aszlig a199eedfce
virtualbox package: Disable hardening by default.
Yes, this is only on the package level, so it's possible to use
VirtualBox for example installed by nix-env -i, which of course doesn't
have access to the functionality provided by the various VirtualBox
kernel modules.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-12-15 17:52:18 +01:00
Michael Raskin a199693cab Update/Fix OVMF 2014-12-11 08:46:13 +03:00
William A. Kennington III 63ae630c6c qemu: 2.0.0 -> 2.2.0
Additionally, add support for more external features as well as more
sound system types.
2014-12-10 15:18:54 -08:00
aszlig 2b58a6ab0d
virtualbox: Fix extension pack installation.
With hardening, we need to go a bit further rather than just allowing
/nix/store being world-writable. We now use fakeroot to make sure the
VBoxExtPackHelperApp won't moan that the files are not owned by root.

They are, but only outside of the chrooted build process.

Another issue with using fakeroot is that it doesn't seem to cope well
with arguments that contain spaces. That's why I've piped the call into
${stdenv.shell}.

Now, the really gory and confusing part is the introduction of
VBOX_PATH_APP_PRIVATE_ARCH_TOP and the change of VBOX_PATH_APP_PRIVATE.

The VBOX_PATH_APP_PRIVATE_ARCH is *only* for modules and is checked by
the hardened implementation against whether things like VMMR0.r0 or
VBoxVMM.so reside in that directory. As a side note: I admit that the
whole libexec directory is quite polluted with stuff that shouldn't be
there, but for now we've broken enough things and will tear apart the
whole structure at some day in the future[TM].

For the confusing part we have VBOX_PATH_APP_PRIVATE_ARCH_TOP, which
_should_ be the same as VBOX_PATH_APP_PRIVATE_ARCH but unfortunately,
the hardened implementation is checking against this directory (in
IsValidBaseDir) for the extension pack(why!?).

Of course, we could put even that into the libexec directory, somewhat
similar as the official package, but after all, let's at least *try* to
separate things.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-12-01 03:32:55 +01:00
aszlig 318fbb34e7
virtualbox: Allow /nix/store being world-writable.
We are already checking whether /nix/store has the sticky bit set, so if
it is world-writable as well it doesn't mean that the actual store path
is writable. Let alone the fact that it is only writable during the
build process.

This should fix installing the extension pack when enableExtensionPack
is used.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-30 18:23:19 +01:00
aszlig 017e6b72c1
virtualbox: Update to upstream version 4.3.20.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-30 06:25:50 +01:00
aszlig 3e49487c1a
virtualbox: Enable hardening by default.
VirtualBox with hardening support requires the main binaries to be
setuid root. Using VBOX_WITH_RUNPATH, we ensure that the RPATHs are
pointing to the libexec directory and we also need to unset
VBOX_WITH_ORIGIN to make sure that the build system is actually setting
those RPATHs.

The hardened.patch implements two things:

 * Set the binary directory to the setuid-wrappers dir so that
   VboxSVC calls them instead of the binaries from the store path. The
   reason behind this is because nothing in the Nix store can have the
   setuid flag.
 * Excempt /nix/store from the group permission check, because while it
   is group-writeable indeed it also has the sticky bit set (and also
   the whole store is mounted read-only on most NixOS systems), so we're
   checking on that as well.

Right now, the hardened.patch uses /nix/store and /var/setuid-wrappers
directly, so someone would ever want to change those on a NixOS system,
please provide a patch to set those paths on build time. However, for
simplicity, it's best to do it when we _really_ need it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-29 19:21:46 +01:00
aszlig deec767efa
virtualbox: Disable depmod only where necessary.
Traversing the full source tree is unneccessary, because the calls are
only done within make files. Hence we only substitute make files now.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-29 19:21:46 +01:00
Rob Vermaas f54c852a36 docker: update from 1.3.0 to 1.3.1, potentially fixes CVE-2014-5277 2014-11-18 16:06:36 +01:00
AndersonTorres c7d83e5ee0 Bochs: upgrade to 2.6.7
Now, with SDL2 upgrade!
2014-11-18 10:53:40 -02:00
Jonathan Rudenberg 29d708176c virtualbox: 4.3.16 -> 4.3.18 2014-11-03 21:47:59 +01:00
Michael Raskin 830af476eb Update virtviewer 2014-11-03 16:54:38 +03:00