| Commit message (Expand) | Author | Age | Files | Lines |
|---|
| * | Refactor grsecurity support.•••Nota bene: this probably does not work! Caveat emptor, etc.
This inverts the grsecurity builder, making it much simpler. Instead,
users just give a full description of the type of kernel they want to
build, and the result is an attribute set containing kernel and
kernelPackages results.
Now, in order to build a custom grsecurity kernel, you do something more
like:
let
kver = "4.0.4";
grver = "3.1-${kver}-201505222222";
kernel = rec
{ version = kver;
localver = "-grsec";
src = fetchurl rec {
name = "linux-${kver}.tar.xz";
url = "mirror://kernel/linux/kernel/v4.x/${name}.tar.xz";
sha256 = "1j5l87z6gd05cqzg680id0x1nk38kd6sjffd2lifl0fz5k6iqr9h";
};
};
patches =
[ fetchurl rec {
name = "grsecurity-${grver}.patch";
url = "https://grsecurity.net/test/grsecurity-${grver}.patch";
sha256 = "0ampby10y3kr36f7rvzm5fdk9f2gcfmcdgkzf67b5kj78y52ypfz";
}
];
customGrsecKern = customGrsecKernelPackages { inherit kernel patches; };
in
{
...
boot.kernelPackages = customGrsecKern.kernelPackages;
}
Which is far more flexible and easier to think about; plus, it gives
full control over the kernel localver and modDirVer, as well as support
for other patches (because you may have other patches to apply on-top of
grsec, or you may bundle grsec with some other distribution, and still
need the builder support.) It also gives you full control of the kernel
tarball, in case you want to use e.g. libre-linux.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
origin/nixos/hardened | Austin Seipp | 2015-05-25 | 4 | -188/+67 |
| * | nixpkgs: stop building grsec packages•••They're useless right now.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 1 | -45/+0 |
| * | nixpkgs: dramatically simplify kernel expression•••This patch does a lot of cleanup on the kernel expressions to make them
easier to maintain and streamline them for the future.
Really, we shouldn't have 30 different kernels under the sun with 20
various versions of each and random patches for them all. We should
officially have, like, a handful of versions, at best, with supported
configurations and guidelines. Ideally, simply the latest
mainline/testing as well as the most recent -stable branch - which is
exactly what this patch does. Including any needed patches.
The writing was pretty much on the wall for this one, honestly. Post
kernel 4.1, we're likely to move to kdbus, which will quickly mean
dropping support for older kernels in systemd. Plus, there really
*isn't* a need for things like the 3.2 or 3.4 kernel, even if they're
technically still mainline. These were part of old NixOS releases months
ago; there's little reason to hang on.
Finally, random experiments in the tree (MIPS FPU patches, TuxOnIce,
xsave, etc) are fun to commit, but ultimately not very fun to maintain
as very few people are going to test them at all, they're probably
broken with newer kernels (several of these were commited 2-3 years
ago), and it's unclear what benefit we get from building them when
nobody (or like 2 people, which is below epsilon) uses it.
Now, if we include our own patches that *users are likely to use*, *are
on by default* and *broadly useful*, that's probably a different story.
For example, I have a WIP patch to add a switch to randomize MAC
addresses via a kernel patch when an interface goes online, without the
need for macchanger. You can simply flip it on and off. This patch isn't
upstream, and its value in the default build is arguable - but is still
probably more useful to NixOS users than what we have now. Another
example is the BFQ scheduler patches, which could be broadly useful.
This dramatically simplifies keeping the kernels up to date, relieves
Hydra of a lot of packages it otherwise needed to build, and makes the
world a more pleasurable place to live.
In detail:
- Get rid of all old -stable kernels, including 3.{2,4,10,12,14}.
- Remove apparmor patches, as they're no longer needed post 3.6+.
- Remove xsave, crc-regression, TuxOnIce and MIPS patches.
- Tighten up patches.nix, and put patches back under a ./patches dir.
- Drop old perf patches, and old linux.upstream.template
If anyone wants to recover these features, they can do so: by adding
them to their own system derivations or forks, which is where a lot of
this belonged in the first place.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 26 | -3914/+39 |
| * | nixpkgs: systemd - add some more dependencies•••Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 1 | -6/+7 |
| * | nixpkgs: apparmor - remove dbus dependency•••This was untested and didn't function without a dbus patch which wasn't
applied to the system dbus package, so it wasn't used at all.
Also, it creates a weird cyclic dependency if we want systemd to depend
on libapparmor (for AppArmorProfiles= support), because libapparmor then
wants dbus, and dbus wants systemd. Oof.
Luckily, this feature and whatnot will probably all be irrelevant in the
glorious kdbus-based future, and the dbus patches aren't even upstream I
think. So we can just drop it.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 1 | -2/+1 |
| * | nixos: uptimed - rewrite and harden a bit (#7220)•••Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 1 | -48/+36 |
| * | nixos: update-locatedb - harden via systemd (#7220)•••Also, use systemd timers as well.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 2 | -30/+34 |
| * | nixos: transmission - remove needless apparmor boilerplate (#7220)•••Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 1 | -5/+4 |
| * | nixos: dnscrypt-proxy - remove needless apparmor boilerplate (#7220)•••Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 1 | -5/+3 |
| * | nixos: enable AppArmor by default (#7220)•••Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 1 | -1/+1 |
| * | nixpkgs: default to apparmor 2.9 (#7220)•••Signed-off-by: Austin Seipp <aseipp@pobox.com>
| Austin Seipp | 2015-04-13 | 4 | -288/+168 |
| * | ceph: 0.94 -> 0.94.1 | William A. Kennington III | 2015-04-13 | 1 | -2/+2 |
| * | gnupg: 2.1.2 -> 2.1.3 | William A. Kennington III | 2015-04-13 | 1 | -2/+2 |
| * | pinentry: 0.9.0 -> 0.9.1 | William A. Kennington III | 2015-04-13 | 1 | -2/+2 |
| * | libksba: 1.3.2 -> 1.3.3 | William A. Kennington III | 2015-04-13 | 1 | -2/+2 |
| * | libgpg-error: 1.18 -> 1.19 | William A. Kennington III | 2015-04-13 | 1 | -2/+2 |
| * | Merge pull request #7186 from arno01/checksecfix•••checksec: use binutils instead of elfutils | Austin Seipp | 2015-04-13 | 1 | -4/+6 |
| |\ |
|
| | * | checksec: use binutils instead of elfutils•••readelf which makes most of checks should come from binutils package instead of elfutils
E.g. the PIE check from checksec, different readelf gives different result:
(elfutils)
$ /nix/store/rgrji20513g19ci0sa6jydm86gpf4j42-elfutils-0.158/bin/readelf -d /nix/store/q1sbn93v4k3166s091s9biygv9srv8qa-nginx-1.6.2/bin/nginx
2>/dev/null |grep -q '(DEBUG)' ; echo $?
1
(binutils)
$ /nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/readelf -d /nix/store/q1sbn93v4k3166s091s9biygv9srv8qa-nginx-1.6.2/bin/nginx
2>/dev/null | grep -q '(DEBUG)' ; echo $?
0
| Andrey Arapov | 2015-04-05 | 1 | -4/+6 |
| * | | Merge pull request #7149 from joachifm/grsec-gradm-optional•••grsecurity module: configure gradm iff RBAC is enabled | Austin Seipp | 2015-04-13 | 1 | -13/+12 |
| |\ \ |
|
| | * | | grsecurity module: configure gradm iff RBAC is enabled | Joachim Fasting | 2015-04-03 | 1 | -13/+12 |
| * | | | Merge pull request #7148 from joachifm/grsec-trivial•••grsecurity module: trivial improvements | Austin Seipp | 2015-04-13 | 1 | -8/+2 |
| |\ \ \ |
|
| | * | | | grsecurity module: simplify assertion | Joachim Fasting | 2015-04-03 | 1 | -5/+2 |
| | * | | | grsecurity module: remove reference to systemd-sysctl•••First, that's not what the service is called, and secondly it's
most likely irrelevant to the user.
| Joachim Fasting | 2015-04-03 | 1 | -3/+0 |
| | |/ / |
|
| * | | | Merge pull request #7163 from joachifm/tarsnap-bandwidth-options•••tarsnap module: add options for controlling bandwidth | Austin Seipp | 2015-04-13 | 1 | -3/+31 |
| |\ \ \ |
|
| | * | | | tarsnap module: add options for controlling bandwidth•••Annoyingly, these do not appear to accept SI prefixes.
| Joachim Fasting | 2015-04-04 | 1 | -0/+30 |
| | * | | | tarsnap module: inline optionalNullStr | Joachim Fasting | 2015-04-04 | 1 | -3/+1 |
| | |/ / |
|
| * | | | mailcore2: update to version 0.5.1 | Charles Strahan | 2015-04-13 | 1 | -2/+2 |
| * | | | make libtidy an alias for html-tidy•••I accidentally introduced the libtidy attr in 7e4ca1cc7
| Charles Strahan | 2015-04-13 | 1 | -2/+1 |
| * | | | Merge pull request #6770 from kirelagin/cups-browsed-avahi•••cups-browsed: build with Avahi | Jascha Geerds | 2015-04-13 | 1 | -7/+3 |
| |\ \ \ |
|
| | * | | | cups-browsed: build with Avahi•••Fixes 5409.
| Kirill Elagin | 2015-04-13 | 1 | -2/+2 |
| | * | | | cups-filters: fix build on non-NixOS | Kirill Elagin | 2015-04-13 | 1 | -5/+1 |
| |/ / / |
|
| * | | | Merge pull request #7365 from k0ral/synergy•••synergy: 1.6.2 -> 1.6.3 | Arseniy Seroka | 2015-04-13 | 1 | -2/+2 |
| |\ \ \ |
|
| | * | | | synergy: 1.6.2 -> 1.6.3 | koral | 2015-04-13 | 1 | -2/+2 |
| * | | | | Merge pull request #7359 from 1126/bump-pamixer•••pamixer: update to 1.2.1 | Arseniy Seroka | 2015-04-13 | 1 | -7/+6 |
| |\ \ \ \ |
|
| | * | | | | pamixer: update to 1.2.1•••This commit also switches from fetchgit to fetchurl.
| _1126 | 2015-04-13 | 1 | -7/+6 |
| * | | | | | Merge pull request #7362 from k0ral/abcde•••abcde: 2.5.4 -> 2.6 | lethalman | 2015-04-13 | 1 | -2/+2 |
| |\ \ \ \ \
| |_|/ / /
|/| | | | |
|
| | * | | | | abcde: 2.5.4 -> 2.6 | koral | 2015-04-13 | 1 | -2/+2 |
| |/ / / / |
|
| * | | | | Merge pull request #7027 from ecraven/apache-sslchain•••apache-httpd: adding support for sslServerChain | Eelco Dolstra | 2015-04-13 | 2 | -0/+9 |
| |\ \ \ \ |
|
| | * | | | | fixing documentation | Peter Feigl | 2015-04-13 | 1 | -1/+1 |
| | * | | | | apache-httpd: adding support for sslServerChain | Peter Feigl | 2015-04-13 | 2 | -0/+9 |
| * | | | | | Merge pull request #6962 from ecraven/moodle-master•••apache-httpd: adding subservice moodle | Eelco Dolstra | 2015-04-13 | 1 | -0/+193 |
| |\ \ \ \ \ |
|
| | * | | | | | fixing indentation | Peter Feigl | 2015-04-13 | 1 | -26/+26 |
| | * | | | | | changed config to only include the minimum necessary | Peter Feigl | 2015-04-13 | 1 | -755/+13 |
| | * | | | | | apache-httpd: adding subservice moodle | Peter Feigl | 2015-04-13 | 1 | -0/+935 |
| | |/ / / / |
|
| * | | | | | pycharm: Update to 4.0.6 | Jascha Geerds | 2015-04-13 | 1 | -6/+6 |
| * | | | | | Merge pull request #7358 from Fuuzetsu/dyre-nix_ghc•••haskell-ng: patch dyre to check NIX_GHC | Peter Simons | 2015-04-13 | 2 | -0/+28 |
| |\ \ \ \ \ |
|
| | * | | | | | haskell-ng: patch dyre to check NIX_GHC•••xmonad is patched in similar manner already
| Mateusz Kowalczyk | 2015-04-13 | 2 | -0/+28 |
| * | | | | | | Merge pull request #7283 from fooblahblah/dbvis•••Package for dbvisualizer 9.2.5 | lethalman | 2015-04-13 | 2 | -0/+27 |
| |\ \ \ \ \ \
| |_|/ / / /
|/| | | | | |
|
| | * | | | | | Package for dbvisualizer 9.2.5 | Jeff Simpson | 2015-04-10 | 2 | -0/+27 |
| * | | | | | | switch-to-configuration: Better error checking | Eelco Dolstra | 2015-04-13 | 1 | -1/+3 |
| | |/ / / /
|/| | | | |
|
