Commit graph

23921 commits

Author SHA1 Message Date
Joachim Fasting 886c03ad2e Merge pull request #16107 from joachifm/grsec-ng
Rework grsecurity support
2016-06-14 03:52:50 +02:00
Joachim Fasting 7bda8f0a8f
grsecurity: add a xen guest kernel
This is for the benefit of users who want to quickly get up and running
on a Xen host, for which the stock NixOS kernel is likely unsuitable.
2016-06-14 03:38:19 +02:00
Joachim Fasting 544b42f8f5
top-level/release.nix: remove obsolete grsec jobs 2016-06-14 03:38:19 +02:00
Tuomas Tynkkynen 7ae1e9bb6d multi_v7_defconfig: Enable AHCI_IMX 2016-06-14 01:31:57 +03:00
Joachim Fasting 75b9a7beac
grsecurity: implement a single NixOS kernel
This patch replaces the old grsecurity kernels with a single NixOS
specific grsecurity kernel.  This kernel is intended as a general
purpose kernel, tuned for casual desktop use.

Providing only a single kernel may seem like a regression compared to
offering a multitude of flavors.  It is impossible, however, to
effectively test and support that many options.  This is amplified by
the reality that very few seem to actually use grsecurity on NixOS,
meaning that bugs go unnoticed for long periods of time, simply because
those code paths end up never being exercised.  More generally, it is
hopeless to anticipate imagined needs.  It is better to start from a
solid foundation and possibly add more flavours on demand.

While the generic kernel is intended to cover a wide range of use cases,
it cannot cover everything.  For some, the configuration will be either
too restrictive or too lenient.  In those cases, the recommended
solution is to build a custom kernel --- this is *strongly* recommended
for security sensitive deployments.

Building a custom grsec kernel should be as simple as
```nix
linux_grsec_nixos.override {
  extraConfig = ''
    GRKERNSEC y
    PAX y
    # and so on ...
  '';
}
```

The generic kernel should be usable both as a KVM guest and host.  When
running as a host, the kernel assumes hardware virtualisation support.
Virtualisation systems other than KVM are *unsupported*: users of
non-KVM systems are better served by compiling a custom kernel.

Unlike previous Grsecurity kernels, this configuration disables `/proc`
restrictions in favor of `security.hideProcessInformation`.

Known incompatibilities:
- ZFS: can't load spl and zfs kernel modules; claims incompatibility
  with KERNEXEC method `or` and RAP; changing to `bts` does not fix the
  problem, which implies we'd have to disable RAP as well for ZFS to
  work
- `kexec()`: likely incompatible with KERNEXEC (unverified)
- Xen: likely incompatible with KERNEXEC and UDEREF (unverified)
- Virtualbox: likely incompatible with UDEREF (unverified)
2016-06-14 00:08:20 +02:00
Joachim Fasting bdc6690baf Merge pull request #16219 from rasendubi/cython
Cython: fix source link
2016-06-13 23:20:03 +02:00
Peter Simons bef99f11cb Add LTS Haskell 6.3. 2016-06-13 23:09:55 +02:00
Alexey Shmalko 1191149cc8
Cython: fix source link
Fixes #16218.
2016-06-13 23:13:01 +03:00
Paweł Pacana d2b58dd39a buildkite-agent: init at 2.1.8
* nixos module included
* install compiled binary
* only one platform now
* limited config options
* relies on providing ssh keys for agent
2016-06-13 17:21:08 +01:00
Moritz Ulrich edca4a1b55 Merge pull request #16159 from matthewbauer/neovim-darwin-fixes
Neovim darwin fixes
2016-06-13 10:42:20 +02:00
José Romildo Malaquias 0072cb8ff1 faba-mono-icons: init at 2016-04-30
Closes #16109.
2016-06-13 09:40:51 +02:00
José Romildo Malaquias fa447287b0 arc-icon-theme: init at 2016-06-06 2016-06-13 09:40:44 +02:00
José Romildo Malaquias 4e44a330cb moka-icon-theme: init at 2016-06-07 2016-06-13 09:40:43 +02:00
José Romildo Malaquias c33cf02337 faba-icon-theme: init at 2016-06-02 2016-06-13 09:40:43 +02:00
Matthew Bauer e0884e85cf neovim: fix build on darwin, cleanup lua paths
fixes #16152

The cmake script had trouble finding the lua paths, this sets them
using “luaPackages.getLuaPath” and “luaPackages.getLuaCPath”.
2016-06-12 21:02:09 -05:00
Matthew Bauer b331af6de6 lua-mpack: fix building with clang
clang has some things considered “warnings” that gcc doesn’t so it is
necessary to set “-Wno-error” to build under clang.
2016-06-12 21:02:04 -05:00
Rahul Gopinath 4227aa2c4f ffmpeg-sixel: init at nightly-2.3.x 2016-06-12 16:23:25 -07:00
Benno Fünfstück 96066935f2 fix build of pngcheck 2016-06-13 01:21:14 +02:00
zimbatm 4f27f28f89 Merge pull request #16137 from abbradar/parsoid
Update node packages
2016-06-13 00:19:25 +01:00
Tom Dimiduk f16171dd24 emcee: init at 2.1 2016-06-13 00:05:36 +01:00
zimbatm a95229a963 Merge pull request #15677 from womfoo/mod_auth_mellon
mod_auth_mellon: init at 0.12.0 and dependency lasso: init at 2.5.1
2016-06-12 23:38:57 +01:00
zimbatm ecdd2721da Merge pull request #16136 from vrthra/libsixel
libsixel: init at 1.6.1
2016-06-12 23:32:13 +01:00
zimbatm 04a8f4499e Merge pull request #16151 from vrthra/mlterm
mlterm: init at 3.3.8
2016-06-12 23:20:33 +01:00
zimbatm 711456c632 Merge pull request #16187 from Profpatsch/bgnet
bgnet: init at 3.0.21
2016-06-12 22:08:14 +01:00
Profpatsch 0da4bb869e bgnet: init at 3.0.21 2016-06-12 21:28:40 +02:00
Rahul Gopinath af76a52c06 libsixel: init at 1.6.1
libsixel is a library for display of graphics in console.
2016-06-12 09:58:25 -07:00
Arseniy Seroka 852e9c3096 Merge pull request #16158 from juliendehos/armadillo
armadillo: init at 7.200.1b
2016-06-12 19:13:38 +03:00
Nikolay Amiantov a7815995bf cython: 0.23.4 -> 0.24 2016-06-12 15:57:29 +03:00
Tal Walter eacc13a3e6 uif2iso: init at 0.1.7
a program for converting UIF files (Universal Image Format, used by MagicISO)
to uncompressed images depending on the input file type:
ISO, BIN/CUE, MDS/MDF, CCD/IMG/SUB and NRG.
2016-06-12 13:16:14 +03:00
Julien Dehos cb6e9e5e24 armadillo: init at 7.200.1b 2016-06-12 03:06:07 +02:00
Rahul Gopinath c0316aaf84 mlterm: init at 3.3.8
A multi-lingual terminal that supports REGIS and SIXEL graphics
2016-06-11 12:35:34 -07:00
Arseniy Seroka 5347a118c2 Merge pull request #16139 from romildo/upd.catfish
catfish: 1.4.1 -> 1.4.2
2016-06-11 22:33:02 +03:00
José Romildo Malaquias 205ec15d1e catfish: 1.4.1 -> 1.4.2 2016-06-11 15:25:59 -03:00
Rushmore Mushambi 1965bd56e6 Merge pull request #16146 from kamilchm/rework-go
all-packages references to Go packages includes all outputs
2016-06-11 19:24:35 +02:00
Nikolay Amiantov b341de88e9 Merge pull request #16030 from abbradar/fhs-refactor
Improvements for FHS user chrootenv
2016-06-11 21:04:20 +04:00
Kamil Chmielewski 7d02cc1dd5 all-packages references to Go packages includes all outputs 2016-06-11 18:57:29 +02:00
Frederik Rietdijk 9fbd5cf1bd Merge pull request #16127 from regnat/bugwarrior
pythonPackages.bugwarrior : 1.0.2 -> 1.4.0
2016-06-11 18:55:04 +02:00
Nikolay Amiantov 3b24a4b09a nodePackages: regenerate, add svgo, pin parsoid 2016-06-11 03:03:45 +03:00
Nikolay Amiantov 80b22a823c lambdabot: use LTS package set 2016-06-11 02:43:44 +03:00
Nikolay Amiantov 5f925c7e2b mueval: use LTS package set 2016-06-11 02:43:44 +03:00
Nikolay Amiantov 3ce3ff64fd pythonPackages.scfbuild: init at 1.0.3 2016-06-11 02:43:44 +03:00
Nikolay Amiantov ac30c87d01 fontforge: add to pythonPackages 2016-06-11 02:43:44 +03:00
Nikolay Amiantov 5dc116e456 julia-git: 0.4.4-pre-2016-02-08 -> 0.5.0-dev-2016-06-10 2016-06-11 02:43:44 +03:00
zimbatm ed42fa41ce Merge pull request #16123 from matthiasbeyer/update-klaus
pythonPackages.klaus: 0.6.0 -> 0.9.1
2016-06-10 18:46:50 +01:00
zimbatm 2ff58e7049 Merge pull request #16126 from joelmo/seaborn
seaborn: 0.7.0 -> 0.7.1
2016-06-10 18:46:33 +01:00
Théophane Hufschmitt c616882757 pythonPackages.bugwarrior : 1.0.2 -> 1.4.0 2016-06-10 18:35:01 +02:00
Rushmore Mushambi aa8cf825ce Merge pull request #16103 from kamilchm/go2nix
go2nix: 20160307 -> 0.1.0
2016-06-10 17:21:27 +02:00
Joel Moberg 0b30c3ab95 seaborn: 0.7.0 -> 0.7.1 2016-06-10 17:18:02 +02:00
Matthias Beyer 7537e228bc pythonPackages.klaus: 0.6.0 -> 0.9.1 2016-06-10 15:29:27 +02:00
Kamil Chmielewski d73f5d6993 icon-lang, xgeometry-select: FIX accidental remove after rebase in https://github.com/NixOS/nixpkgs/pull/16017 (#16121) 2016-06-10 14:04:46 +01:00