alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

Merge pull request #38865 from matthewbauer/darwin-security-fixes

Browse source 
[darwin] Security fixes
This commit is contained in:
Matthew Justin Bauer 2018-04-12 14:27:00 -05:00 committed by GitHub
parent 39da015578 59bcd129e5
commit 29bc523733
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
28 changed files with 305 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkgs/development/tools/parsing/antlr/2.7.7.nix
View file

@ -19,6 +19,6 @@ stdenv.mkDerivation {
walk parse trees.
'';
homepage = http://www.antlr.org/;
platforms = platforms.linux;
platforms = platforms.unix;
};
}

21
pkgs/development/tools/xcbuild/platform.nix
View file

@ -258,6 +258,27 @@ let
};
PackageTypes = [ "com.apple.package-type.wrapper.application" ];
}
{
Type = "ProductType";
Identifier = "com.apple.product-type.framework";
Name = "Bundle";
DefaultBuildProperties = {
FULL_PRODUCT_NAME = "$(WRAPPER_NAME)";
MACH_O_TYPE = "mh_bundle";
WRAPPER_PREFIX = "";
WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
WRAPPER_EXTENSION = "bundle";
WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
FRAMEWORK_FLAG_PREFIX = "-framework";
LIBRARY_FLAG_PREFIX = "-l";
LIBRARY_FLAG_NOSPACE = "YES";
STRIP_STYLE = "non-global";
};
PackageTypes = [ "com.apple.package-type.wrapper" ];
IsWrapper = "YES";
HasInfoPlist = "YES";
HasInfoPlistStrings = "YES";
}
];
in

2
pkgs/development/tools/xcbuild/setup-hook.sh
View file

@ -5,7 +5,7 @@ xcbuildBuildPhase() {
echo "running xcodebuild"
xcodebuild OTHER_CFLAGS="$NIX_CFLAGS_COMPILE" OTHER_CPLUSPLUSFLAGS="$NIX_CFLAGS_COMPILE" OTHER_LDFLAGS="$NIX_LDFLAGS" build
xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates $xcbuildFlags build
runHook postBuild
}

3
pkgs/development/tools/xcbuild/wrapper.nix
View file

@ -46,6 +46,9 @@ stdenv.mkDerivation {
ln -s $file
done
mkdir $out/usr
ln -s $out/bin $out/usr/bin
mkdir -p $out/Library/Xcode/
ln -s ${xcbuild}/Library/Xcode/Specifications $out/Library/Xcode/Specifications

19
pkgs/os-specific/darwin/CoreSymbolication/default.nix Normal file
View file

@ -0,0 +1,19 @@
{ fetchFromGitHub, stdenv }:
# Reverse engineered CoreSymbolication to make dtrace buildable
stdenv.mkDerivation rec {
name = "CoreSymbolication";
src = fetchFromGitHub {
repo = name;
owner = "matthewbauer";
rev = "671fcb66c82eac1827f3f53dc4cc4e9b1b94da0a";
sha256 = "0qpw46gwgjxiwqqjxksb8yghp2q8dwad6hzaf4zl82xpvk9n5ahj";
};
installPhase = ''
mkdir -p $out/include
cp -r CoreSymbolication $out/include
'';
}

41
pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix Normal file
View file

@ -0,0 +1,41 @@
{ stdenv, appleDerivation, xcbuild, gnumake, Security
, libsecurity_utilities, libsecurity_cdsa_utilities }:
appleDerivation {
buildInputs = [ xcbuild libsecurity_utilities libsecurity_cdsa_utilities ];
DSTROOT = "$out";
NIX_CFLAGS_COMPILE = "-I.";
preBuild = ''
mkdir -p Security
cp ${Security}/Library/Frameworks/Security.framework/Headers/*.h Security
'';
patchPhase = ''
substituteInPlace SmartCardServices.xcodeproj/project.pbxproj \
--replace "/usr/bin/gnumake" "${gnumake}/bin/make"
substituteInPlace src/PCSC/PCSC.exp \
--replace _PCSCVersionString "" \
--replace _PCSCVersionNumber ""
substituteInPlace Makefile.installPhase \
--replace chown "# chown" \
--replace /usr/bin/ ""
'';
installPhase = ''
make -f Makefile.installPhase install
make -f Makefile-exec.installPhase install
mv $out/usr/* $out
rmdir $out/usr
mkdir -p $out/Library/Frameworks
cp -r Products/Release/PCSC.bundle $out/Library/Frameworks/PCSC.framework
'';
meta = with stdenv.lib; {
maintainers = with maintainers; [ matthewbauer ];
platforms = platforms.darwin;
license = licenses.apsl20;
};
}

2
pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
View file

@ -34,7 +34,7 @@ appleDerivation {
# temporary install phase until xcodebuild has "install" support
installPhase = ''
mkdir -p $out/bin/
install adv_cmds-*/Build/Products/Release/* $out/bin/
install Products/Release/* $out/bin/
for n in 1 8; do
mkdir -p $out/share/man/man$n

2
pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
View file

@ -14,7 +14,7 @@ appleDerivation rec {
# temporary install phase until xcodebuild has "install" support
installPhase = ''
mkdir -p $out/bin/
install basic_cmds-*/Build/Products/Release/* $out/bin/
install Products/Release/* $out/bin/
for n in 1; do
mkdir -p $out/share/man/man$n

9
pkgs/os-specific/darwin/apple-source-releases/default.nix
View file

@ -7,6 +7,7 @@ let
# now it's staying here.
versions = {
"osx-10.11.6" = {
SmartCardServices = "55111";
dtrace = "168";
xnu = "3248.60.10";
libpthread = "138.10.4";
@ -53,6 +54,7 @@ let
ICU = "531.48";
libdispatch = "442.1.4";
Security = "57031.40.6";
security_systemkeychain = "55202";
IOAudioFamily = "203.3";
IOFireWireFamily = "458";
@ -191,6 +193,8 @@ let
adv_cmds = applePackage "adv_cmds" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
packages = {
SmartCardServices = applePackage "SmartCardServices" "osx-10.11.6" "1qqjlbi6j37mw9p3qpfnwf14xh9ff8h5786bmvzwc4kblfglabkm" {};
inherit (adv_cmds) ps locale;
architecture = applePackage "architecture" "osx-10.11.6" "1pbpjcd7is69hn8y29i98ci0byik826if8gnp824ha92h90w0fq3" {};
bootstrap_cmds = applePackage "bootstrap_cmds" "dev-tools-7.0" "1v5dv2q3af1xwj5kz0a5g54fd5dm6j4c9dd2g66n4kc44ixyrhp3" {};
@ -201,7 +205,8 @@ let
configd = applePackage "configd" "osx-10.8.5" "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {};
copyfile = applePackage "copyfile" "osx-10.11.6" "1rkf3iaxmjz5ycgrmf0g971kh90jb2z1zqxg5vlqz001s4y457gs" {};
Csu = applePackage "Csu" "osx-10.11.6" "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
dtrace = applePackage "dtrace" "osx-10.11.6" "0pp5x8dgvzmg9vvg32hpy2brm17dpmbwrcr4prsmdmfvd4767wc0" {};
dtrace = applePackage "dtrace" "osx-10.11.6" "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
dtrace-xcode = applePackage "dtrace/xcode.nix" "osx-10.11.6" "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
dyld = applePackage "dyld" "osx-10.11.6" "0qkjmjazm2zpgvwqizhandybr9cm3gz9pckx8rmf0py03faafc08" {};
eap8021x = applePackage "eap8021x" "osx-10.11.6" "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
ICU = applePackage "ICU" "osx-10.10.5" "1qihlp42n5g4dl0sn0f9pc0bkxy1452dxzf0vr6y5gqpshlzy03p" {};
@ -243,6 +248,8 @@ let
shell_cmds = applePackage "shell_cmds" "osx-10.11.6" "0084k271v66h4jqp7q7rmjvv7w4mvhx3aq860qs8jbd30canm86n" {};
system_cmds = applePackage "system_cmds" "osx-10.11.6" "1h46j2c5v02pkv5d9fyv6cpgyg0lczvwicrx6r9s210cl03l77jl" {};
security_systemkeychain = applePackage "security_systemkeychain" "osx-10.10.5" "0xviskdgxsail15npi0billyiysvljlmg38mmhnr7qi4ymnnjr90" {};
libsecurity_apple_csp = libsecPackage "libsecurity_apple_csp" "osx-10.7.5" "1ngyn1ik27n4x981px3kfd1z1n8zx7r5w812b6qfjpy5nw4h746w" {};
libsecurity_apple_cspdl = libsecPackage "libsecurity_apple_cspdl" "osx-10.7.5" "1svqa5fhw7p7njzf8bzg7zgc5776aqjhdbnlhpwmr5hmz5i0x8r7" {};
libsecurity_apple_file_dl = libsecPackage "libsecurity_apple_file_dl" "osx-10.7.5" "1dfqani3n135i3iqmafc1k9awmz6s0a78zifhk15rx5a8ps870bl" {};

2
pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
View file

@ -11,7 +11,7 @@ appleDerivation rec {
# temporary install phase until xcodebuild has "install" support
installPhase = ''
mkdir -p $out/bin/
install developer_cmds-*/Build/Products/Release/* $out/bin/
install Products/Release/* $out/bin/
for n in 1; do
mkdir -p $out/share/man/man$n

45
pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix Normal file
View file

@ -0,0 +1,45 @@
{ appleDerivation, xcbuild, CoreSymbolication, xnu, bison, flex, darling, stdenv }:
appleDerivation {
buildInputs = [ xcbuild CoreSymbolication xnu bison flex darling ];
NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers";
NIX_LDFLAGS = "-L./Products/Release";
xcbuildFlags = "-target dtrace";
patchPhase = ''
substituteInPlace dtrace.xcodeproj/project.pbxproj --replace "/usr/sbin" ""
substituteInPlace libdtrace/dt_open.c \
--replace "/usr/bin/clang" "${stdenv.cc}/bin/cpp" \
--replace "/usr/bin/ld" "${stdenv.cc}/bin/ld" \
--replace "/usr/bin/dtrace" $out/lib/dtrace
'';
# hack to handle xcbuild's broken lex handling
preBuild = ''
cd libdtrace
yacc -d dt_grammar.y
flex -l -d dt_lex.l
cd ..
substituteInPlace dtrace.xcodeproj/project.pbxproj \
--replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
--replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
'';
# xcbuild doesn't support install
installPhase = ''
mkdir -p $out
cp -r Products/Release/usr $out
mv $out/usr/* $out
rmdir $out/usr
mkdir $out/lib
cp Products/Release/*.dylib $out/lib
mkdir $out/bin
cp Products/Release/dtrace $out/bin
mkdir -p $out/lib/dtrace
'';
}

2
pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
View file

@ -19,7 +19,7 @@ appleDerivation rec {
# temporary install phase until xcodebuild has "install" support
installPhase = ''
mkdir -p $out/bin/
install file_cmds-*/Build/Products/Release/* $out/bin
install Products/Release/* $out/bin
for n in 1; do
mkdir -p $out/share/man/man$n

1
pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
View file

@ -5,6 +5,7 @@ LIBRARY_NAME = security_apple_x509_tp
security_apple_x509_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
security_apple_x509_tp_HEADER_FILES_DIR = lib
security_apple_x509_tp_C_FILES = $(wildcard lib/*.c)
security_apple_x509_tp_CC_FILES = $(wildcard lib/*.cpp)
include $(GNUSTEP_MAKEFILES)/library.make

36
pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
View file

@ -1,7 +1,33 @@
{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities }:
{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities
, Security, xnu, xar, antlr, libsecurityd, apple_sdk
, dtrace-xcode, osx_private_sdk }:
appleDerivation {
buildInputs = [
libsecurity_utilities
libsecurity_cdsa_utilities
];
buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities dtrace-xcode
Security xar antlr libsecurityd ];
NIX_CFLAGS_COMPILE = "-Iinclude -I${xnu}/Library/Frameworks/System.framework/Headers";
patchPhase = ''
substituteInPlace lib/policydb.cpp \
--replace "new MutableDictionary::MutableDictionary()" NULL
substituteInPlace lib/xpcengine.h \
--replace "#include <xpc/private.h>" ""
substituteInPlace lib/policyengine.cpp \
--replace "#include <OpenScriptingUtilPriv.h>" ""
rm lib/policyengine.cpp lib/quarantine++.cpp lib/codedirectory.cpp lib/xpcengine.cpp
'';
preBuild = ''
mkdir -p include
cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/usr/include/quarantine.h include
mkdir -p include/CoreServices/
cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreServices.framework/PrivateHeaders/*.h include/CoreServices/
unpackFile ${Security.src}
mkdir -p include/securityd_client
cp Security-*/libsecurityd/lib/*.h include/securityd_client
mkdir -p include/xpc
cp ${apple_sdk.sdk}/include/xpc/*.h include/xpc
sed -i '1i #define bool int' lib/security_codesigning.d
dtrace -h -C -s lib/security_codesigning.d -o codesigning_dtrace.h
'';
}

3
pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
View file

@ -4,9 +4,12 @@ appleDerivation {
libauto
libobjc
IOKit
];
propagatedBuildInputs = [
sqlite
apple_sdk.frameworks.PCSC
];
NIX_LDFLAGS = "-framework PCSC";
patchPhase = ''
substituteInPlace lib/errors.h --replace \
'<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \

4
pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
View file

@ -18,8 +18,8 @@ appleDerivation {
installPhase = ''
mkdir -p $out/lib $out/include
cp libutil-*/Build/Products/Release/*.dylib $out/lib
cp libutil-*/Build/Products/Release/*.h $out/include
cp Products/Release/*.dylib $out/lib
cp Products/Release/*.h $out/include
# TODO: figure out how to get this to be right the first time around
install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib

2
pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
View file

@ -19,7 +19,7 @@ appleDerivation rec {
# temporary install phase until xcodebuild has "install" support
installPhase = ''
mkdir -p $out/bin/
install network_cmds-*/Build/Products/Release/* $out/bin/
install Products/Release/* $out/bin/
for n in 1 5; do
mkdir -p $out/share/man/man$n

31
pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix Normal file
View file

@ -0,0 +1,31 @@
{ appleDerivation, xcbuild, Security
, libsecurity_codesigning, libsecurity_utilities, libsecurity_cdsa_utilities
, xnu, osx_private_sdk, pcsclite}:
appleDerivation {
buildInputs = [ xcbuild Security libsecurity_utilities
libsecurity_cdsa_utilities libsecurity_codesigning
pcsclite ];
NIX_LDFLAGS = "-lpcsclite";
# can't build the whole thing
xcbuildFlags = "-target codesign";
preBuild = ''
mkdir -p include/Security
cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/PrivateHeaders/*.h include/Security
cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/Headers/*.h include/Security
unpackFile ${xnu.src}
mkdir -p include/sys
cp -r xnu-*/bsd/sys/codesign.h include/sys/codesign.h
'';
NIX_CFLAGS_COMPILE = "-Iinclude";
installPhase = ''
mkdir -p $out/bin
cp Products/Release/codesign $out/bin/codesign
'';
}

2
pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
View file

@ -29,7 +29,7 @@ appleDerivation rec {
# temporary install phase until xcodebuild has "install" support
installPhase = ''
mkdir -p $out/usr/bin
install shell_cmds-*/Build/Products/Release/* $out/usr/bin
install Products/Release/* $out/usr/bin
export DSTROOT=$out
export SRCROOT=$PWD

34
pkgs/os-specific/darwin/darling/default.nix Normal file
View file

@ -0,0 +1,34 @@
{stdenv, lib, fetchFromGitHub, cmake, bison, flex}:
stdenv.mkDerivation rec {
pname = "darling";
name = pname;
src = fetchFromGitHub {
repo = pname;
owner = "darlinghq";
rev = "d2cc5fa748003aaa70ad4180fff0a9a85dc65e9b";
sha256 = "1mkcnzy1cfpwghgvb9pszhy9jy6534y8krw8inwl9fqfd0w019wz";
};
# only packaging sandbox for now
buildPhase = ''
cc -c src/sandbox/sandbox.c -o src/sandbox/sandbox.o
cc -dynamiclib -flat_namespace src/sandbox/sandbox.o -o libsystem_sandbox.dylib
'';
installPhase = ''
mkdir -p $out/lib
cp -rL src/sandbox/include/ $out/
cp libsystem_sandbox.dylib $out/lib/
'';
# buildInputs = [ cmake bison flex ];
meta = with lib; {
maintainers = with maintainers; [ matthewbauer ];
license = licenses.gpl3;
description = "Darwin/macOS emulation layer for Linux";
platforms = platforms.unix;
};
}

0
pkgs/os-specific/darwin/swift-corefoundation/default.nix → pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
View file

8
pkgs/os-specific/darwin/swift-corelibs/default.nix Normal file
View file

@ -0,0 +1,8 @@
{callPackage, stdenv, darwin, xcbuild}:
rec {
corefoundation = callPackage ./corefoundation.nix {};
libdispatch = callPackage ./libdispatch.nix {
inherit (darwin) apple_sdk_sierra xnu;
};
}

12
pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix Normal file
View file

@ -0,0 +1,12 @@
{ stdenv, fetchFromGitHub, cmake, apple_sdk_sierra, xnu-new }:
stdenv.mkDerivation rec {
name = "swift-corelibs-libdispatch";
src = fetchFromGitHub {
owner = "apple";
repo = name;
rev = "f83b5a498bad8e9ff8916183cf6e8ccf677c346b";
sha256 = "1czkyyc9llq2mnqfp19mzcfsxzas0y8zrk0gr5hg60acna6jkz2l";
};
buildInputs = [ cmake apple_sdk_sierra.sdk xnu-new ];
}

27
pkgs/tools/compression/pbzx/default.nix Normal file
View file

@ -0,0 +1,27 @@
{stdenv, lib, fetchFromGitHub, lzma, xar}:
stdenv.mkDerivation rec {
pname = "pbzx";
version = "1.0.2";
name = "${pname}-${version}";
src = fetchFromGitHub {
owner = "NiklasRosenstein";
repo = "pbzx";
rev = "v${version}";
sha256 = "0bwd7wmnhpz1n5p39mh6asfyccj4cm06hwigslcwbb3pdwmvxc90";
};
buildInputs = [ lzma xar ];
buildPhase = ''
cc pbzx.c -llzma -lxar -o pbzx
'';
installPhase = ''
mkdir -p $out/bin
cp pbzx $out/bin
'';
meta = with lib; {
description = "Stream parser of Apple's pbzx compression format.";
platforms = platforms.unix;
license = licenses.gpl3;
maintainers = [ maintainers.matthewbauer ];
};
}

2
pkgs/tools/misc/contacts/default.nix
View file

@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
installPhase = ''
mkdir -p $out/bin
cp ./contacts-*/Build/Products/Default/contacts $out/bin
cp Products/Default/contacts $out/bin
'';
## FIXME: the framework setup hook isn't adding these correctly

2
pkgs/tools/security/pinentry-mac/default.nix
View file

@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
installPhase = ''
mkdir -p $out/Applications
mv pinentry-mac-*/Build/Products/Release/pinentry-mac.app $out/Applications
mv Products/Release/pinentry-mac.app $out/Applications
'';
passthru = {

2
pkgs/top-level/all-packages.nix
View file

@ -1336,6 +1336,8 @@ with pkgs;
patdiff = callPackage ../tools/misc/patdiff { };
pbzx = callPackage ../tools/compression/pbzx { };
playerctl = callPackage ../tools/audio/playerctl { };
ps_mem = callPackage ../tools/system/ps_mem { };

8
pkgs/top-level/darwin-packages.nix
View file

@ -57,12 +57,16 @@ in
stubs = callPackages ../os-specific/darwin/stubs { };
swift-corefoundation = callPackage ../os-specific/darwin/swift-corefoundation { };
trash = callPackage ../os-specific/darwin/trash { inherit (darwin.apple_sdk) frameworks; };
usr-include = callPackage ../os-specific/darwin/usr-include { };
xcode = callPackage ../os-specific/darwin/xcode { };
CoreSymbolication = callPackage ../os-specific/darwin/CoreSymbolication { };
swift-corelibs = callPackages ../os-specific/darwin/swift-corelibs { };
darling = callPackage ../os-specific/darwin/darling/default.nix { };
})