mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-30 17:41:12 +00:00
Code Issues Wiki Activity
88310 commits 267 branches 125 tags 5.3 GiB
Commit graph

1576 commits

Author SHA1 Message Date
Joachim Fasting d8e4432fe2
kernel: unconditionally disable /dev/kmem 
This was presumably set for grsecurity compatibility, but now appears
redundant.  Grsecurity does not expect nor require /dev/kmem to be
present and so it makes little sense to continue making its inclusion in
the standard kernel dependent on grsecurity.

More generally, given the large number of possible grsecurity
configurations, it is unclear what `features.grsecurity` even
*means* and its use should be discouraged.
 2016-06-10 19:27:41 +02:00
Shea Levy 4fbafb2395 linux 4.6.1 -> 4.6.2 2016-06-10 09:30:11 -04:00
Robin Gloster 8031cba2ab Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-06-10 09:27:04 +00:00
Joachim Fasting edc36a0091
grsecurity: 4.5.6-201606051644 -> 4.5.7-201606080852 2016-06-09 15:40:06 +02:00
Vladimír Čunát 20c2ce4954 Merge #16045: kernel: 4.6.0 -> 4.6.1 2016-06-09 14:37:32 +02:00
Vladimír Čunát c0895be3ee Merge #16044: kernel: 4.1.20 -> 4.1.25 2016-06-09 14:36:31 +02:00
Vladimír Čunát f9310c2eee Merge #16043: kernel: 4.4.11 -> 4.4.12 2016-06-09 14:34:50 +02:00
Tim Steinbach 269b7d30a7 kernel: 4.6.0 -> 4.6.1 2016-06-07 09:59:19 -04:00
Tim Steinbach 8f4755a0ae kernel: 4.5.5 -> 4.5.6 2016-06-07 09:58:24 -04:00
Tim Steinbach a57cbf6546 kernel: 4.4.11 -> 4.4.12 2016-06-07 09:57:47 -04:00
Tim Steinbach f3ebf13762 kernel: 4.1.20 -> 4.1.25 2016-06-07 09:57:07 -04:00
Joachim Fasting 72899d92d0
grsecurity: 4.5.5-201605291201 -> 4.5.6-201606051644 2016-06-07 15:04:24 +02:00
Tuomas Tynkkynen bac26e08db Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
Alexander Kjeldaas 4c99d22f19 kernel: set nx bit on module ro segments 
Fixes #4757.
 2016-06-03 15:41:47 +02:00
Robin Gloster 2d382f3d98 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-05-30 19:39:34 +00:00
Joachim Fasting bfefc54bc5
grsecurity: 4.5.5-201605211442 -> 4.5.5-201605291201 2016-05-29 20:34:24 +02:00
Eelco Dolstra 3ee6b22dc3 linux: 4.4.10 -> 4.4.11 2016-05-22 23:05:10 +02:00
Joachim Fasting 5a357d9731
grsecurity: 4.5.5-201605202102 -> 4.5.5-201605211442 2016-05-21 22:28:36 +02:00
Joachim Fasting 79481bd68f
linux: 4.5.4 -> 4.5.5 2016-05-21 07:37:41 +02:00
Joachim Fasting cdf2ffda9d
grsecurity: 4.5.4-201605131918 -> 4.5.5-201605202102 2016-05-21 07:37:41 +02:00
Franz Pletz f8d481754c
Merge remote-tracking branch 'origin/master' into hardened-stdenv 2016-05-18 17:10:02 +02:00
Shea Levy 1ea263ef03 linux-4.6: Fix copy-paste error. 
Thanks to @NeQuissimus for the spot
 2016-05-16 13:53:23 -04:00
Shea Levy 0373eb86f1 Linux 4.6 2016-05-16 11:56:39 -04:00
Joachim Fasting f99c86eec1
grsecurity: remove expressions for unsupported versions 
Retain top-level attributes for now but consolidate compatibility
attributes.

Part of ongoing cleanup, doing it all at once is infeasible.
 2016-05-16 09:10:27 +02:00
Joachim Fasting 6194e9d801
kernelPatches.grsecurity: 4.5.4-201605122039 -> 4.5.4-201605131918 
Also revert to using the grsecurity-scrape mirror; relying on upstream
just isn't viable. Lately, updates have been so frequent that a new
version is released before Hydra even gets around to building the
previous one.
 2016-05-14 05:15:35 +02:00
Joachim Fasting 7fdce2feb0
kernelPatches.grsecurity_4_5: 4.5.4-201605112030 -> 4.5.4-201605122039 2016-05-13 23:11:07 +02:00
Joachim Fasting 10aaca8c1f
grsecurity_4_5: 4.5.3-201605080858 -> 4.5.4-201605112030 2016-05-13 20:11:31 +02:00
Franz Pletz 006f6d9437 linux: 4.5.3 -> 4.5.4 2016-05-13 17:27:51 +02:00
Eelco Dolstra 7a8ea6138e linux: 4.4.9 -> 4.4.10 2016-05-11 20:34:02 +02:00
Joachim Fasting 52477b0a0b
kernelPatches.grsecurity_4_5: 201605060852 -> 201605080858 2016-05-09 16:38:44 +02:00
Tim Steinbach f53850bf21 kernel: 4.4.8 -> 4.4.9 (#15276) 2016-05-06 20:25:29 +02:00
Lluís Batlle i Rossell 53a4582552 Adding vmlinux to linux kernel 'dev' derivation. 
It takes some extra 13MB (and in dev, not out), but allows perf to show kernel
symbols when profiling. I think it is worth it.

In my NixOS, I refer to it in the system derivation, for easy telling to perf
through /run/booted-system/vmlinux:

  system.extraSystemBuilderCmds = ''
    ln -s ${config.boot.kernelPackages.kernel.dev}/vmlinux $out/vmlinux
  '';
 2016-05-06 18:11:03 +02:00
Tim Steinbach 02d94d335a
kernel: 4.5.2 -> 4.5.3 2016-05-06 11:12:04 -04:00
Joachim Fasting 27061905bd
linuxPackages_grsec_4_5: 3.1-4.5.2-201604290633 -> 3.1-4.5.3-201605060852 2016-05-06 16:37:25 +02:00
Eelco Dolstra 1f84e43239 Do some large, concurrency-capable builds on dedicated machines 2016-05-04 18:16:27 +02:00
Joachim Fasting 0bd31bce10
grsecurity: drop support for 4.4 kernels 
From now on, only the testing branch of grsecurity will be supported.
Additionally, use only patches from upstream.

It's impossible to provide meaningful support for grsecurity stable.
First, because building and testing \(m \times n \times z) [1], packages
is infeasible.  Second, because stable patches are only available from
upstream for-pay, making us reliant on third-parties for patches. In
addition to creating yet more work for the maintainers, using stable
patches provided by a third-party goes against the wishes of upstream.

nixpkgs provides the tools necessary to build grsecurity kernels for any
version the user chooses, however, provided they pay for, or otherwise
acquire, the patch themselves.

Eventually, we'll want to remove the now obsolete top-level attributes,
but leave them in for now to smoothe migration (they have been removed
from top-level/release.nix, though, because it makes no sense to have
them there).

[1]: where \(m\) is the number of grsecurity flavors, \(n\) is the
number of kernel versions, and z is the size of the `linuxPackages` set
 2016-05-04 01:07:53 +02:00
Robin Gloster c92bca56f8 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-05-02 22:58:02 +00:00
Joachim Fasting 7893cb1aea
linuxPackages_grsec_4_1: delete 
Upstream supports 3.14, 4.4, and 4.5
 2016-05-02 11:28:05 +02:00
Joachim Fasting fecb56fc3f
linuxPackages_grsec_4_5: init at 3.1-4.5.2-201604290633 2016-05-02 11:28:05 +02:00
Louis Taylor 80f923f26f linux-testing: 4.6-rc5 -> 4.6-rc6 2016-05-02 02:29:42 +01:00
Tim Steinbach c494947676 linux_testing: 4.6-rc4 -> 4.6-rc5 2016-04-28 23:59:52 +00:00
Tuomas Tynkkynen 7276417870 kernel config: Enable BINFMT_MISC 
This is enabled in x86 builds but lacking on ARM.
 2016-04-28 20:46:34 +03:00
Eelco Dolstra 454eefa63b linux: 4.4.7 -> 4.4.8 2016-04-26 16:39:59 +02:00
Louis Taylor 90cdfb5414 kernel: 4.5.1 -> 4.5.2 2016-04-20 11:55:13 +01:00
Robin Gloster b59a6aa93a kernel: turn off bindnow hardening 2016-04-19 02:21:57 +00:00
Robin Gloster d020caa5b2 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-04-18 13:49:22 +00:00
Louis Taylor ec198e3868 linux-testing: 4.6-rc3 -> 4.6-rc4 (#14803) 2016-04-18 14:11:25 +01:00
Tim Steinbach ccc3080857 kernel: 4.4.6 -> 4.4.7 (#14690) 2016-04-14 16:30:20 +02:00
Tim Steinbach af4d84544f kernel: 4.5 -> 4.5.1 (#14691) 2016-04-14 15:57:18 +02:00
Vladimír Čunát 39ebb01d6e Merge branch 'staging', containing closure-size #7701 2016-04-13 09:25:28 +02:00
obadz 4788ec1372 linux kernel 4.4: fix race during build 
Patch drivers/crypto/qat/qat_common/Makefile so that qat_asym_algs.o
explicitly depends on headers qat_rsaprivkey-asn1.h and qat_rsapubkey-asn1.h

Hopefully fixes #14595
 2016-04-12 22:45:57 +01:00
Tim Steinbach 5e5ef22d73 linux_testing: 4.6-rc2 -> 4.6-rc3 (#14592) 2016-04-11 13:44:34 +01:00
Charles Strahan ad7b1e24c2 fan-networking: updated patches from Ubuntu 
This pulls in updated Fan Networking patches from Ubuntu.
(https://wiki.ubuntu.com/FanNetworking)

closes #14328
 2016-04-10 16:07:03 -04:00
Vladimír Čunát 30f14243c3 Merge branch 'master' into closure-size 
Comparison to master evaluations on Hydra:
  - 1255515 for nixos
  - 1255502 for nixpkgs
 2016-04-10 11:17:52 +02:00
Robin Gloster 3e68106afd Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-04-07 21:52:26 +00:00
Eelco Dolstra 4907fc9e8d Merge pull request #14509 from ragnard/bpf-tracing-kernel-config 
linux: kernel config for extended BPF support
 2016-04-07 11:01:34 +02:00
Ragnar Dahlén 961d1e847c linux: kernel config for extended BPF support 
- Enable BPF_SYSCALL and BPF_EVENTS
- Build modules for NET_CLS_BPF and NET_ACT_BPF

With these config options we can leverage the full potential of BPF for
tracing and instrumenting Linux systems, for example using
libraries/tools like those provided by the bcc project.
 2016-04-07 08:14:41 +01:00
Tuomas Tynkkynen b95274cc90 kernel: Don't patchELF manually 
AFAICT this is done by stdenv nowadays:

bde82098b8/pkgs/development/tools/misc/patchelf/setup-hook.sh (L5)
bde82098b8/pkgs/stdenv/generic/setup.sh (L737)

Might help /be somehow related to these mysterious errors that seem to
occur sometimes (?):

http://hydra.nixos.org/build/34131589/nixlog/1/raw
 2016-04-06 17:19:43 +03:00
Robin Gloster 5ca99ae7a7 kernel.i686-linux: disable bindnow hardening 2016-04-06 14:16:42 +00:00
Domen Kožar b95a1c4f77 kernel: fix build of 3.10 and 3.12 on i686 
(cherry picked from commit 23730413fe)
Signed-off-by: Domen Kožar <domen@dev.si>
 2016-04-06 10:36:04 +01:00
Robin Gloster bbbaccfa68 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-04-04 15:24:52 +00:00
Tim Steinbach 5ef5e59c56 linux_testing: 4.6-rc1 -> 4.6-rc2 2016-04-03 19:14:31 +00:00
Vladimír Čunát ab15a62c68 Merge branch 'master' into closure-size 
Beware that stdenv doesn't build. It seems something more will be needed
than just resolution of merge conflicts.
 2016-04-01 10:06:01 +02:00
Robin Gloster f60c9df0ba Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-03-28 15:16:29 +00:00
Domen Kožar c61445357e Merge pull request #14239 from kragniz/linux-testing-4.6-rc1 
Linux-testing 4.6-rc1
 2016-03-28 15:53:52 +01:00
Joachim Fasting dd16dcbba4 linux_grsec_3_14: mark as broken 
First, The patch is outdated, I failed to find it anywhere in the mirror repos.
Second, the build fails, and while it may be "fixed" by ad-hoc patching (it
appears to simply need some missing includes), this would mean shipping a
potentially insecure software package. Given that the only reason to use
grsecurity is security, this is both misleading and exposes users to undue risk.
Finally, the build has been broken for quite a long time with no complaints,
leading me to believe that the number of actual users is quite low.
 2016-03-27 21:13:41 +02:00
Domen Kožar b07e7bfc7b Merge remote-tracking branch 'origin/staging' 2016-03-27 13:19:04 +01:00
Joachim Fasting bd9737cc3e linux_chromiumos: require 64bit build host 
I noticed that almost all the Hydra build failures were on i686. Sure
enough, upstream says that you need an x86_64 machine to build the
kernel.
 2016-03-27 05:35:04 +02:00
Louis Taylor 8b7e150bb9 linux-testing: 4.5-rc7 -> 4.6-rc1 2016-03-27 03:10:19 +01:00
Louis Taylor 695c2e4ee4 kernel-config: do not use NFSD_PNFS on >=4.6 2016-03-27 03:09:30 +01:00
Joachim Fasting 89c6b3c11a perf: fix build 
https://hydra.nixos.org/build/33553564/nixlog/1/raw
 2016-03-26 18:18:40 +01:00
Domen Kožar 4393e65a44 Merge pull request #14054 from NeQuissimus/kernel310101 
kernel: 3.10.99 -> 3.10.101
 2016-03-23 11:31:21 +00:00
Domen Kožar 2a428566e8 Merge pull request #14055 from NeQuissimus/kernel31257 
kernel: 3.12.55 -> 3.12.57
 2016-03-23 11:31:14 +00:00
Domen Kožar 4b29e2e6cb Merge pull request #14056 from NeQuissimus/kernel31465 
kernel: 3.14.63 -> 3.14.65
 2016-03-23 11:30:59 +00:00
Lluís Batlle i Rossell 40b0538239 Update linux raspberry-pi to 4.1.y. 
I could boot it in pi2; I don't know if I needed new
firmware files in /boot.
 2016-03-22 15:09:57 +01:00
Tim Steinbach 6476075ccf kernel: 3.18.28 -> 3.18.29 (close #14057) 2016-03-21 12:39:29 +01:00
Tim Steinbach 379709b404 kernel: 4.1.17 -> 4.1.20 (close #14058) 2016-03-21 12:15:25 +01:00
Tim Steinbach 4274edbe40 kernel: 3.14.63 -> 3.14.65 2016-03-19 18:29:40 +00:00
Tim Steinbach bf41deb889 kernel: 3.12.55 -> 3.12.57 2016-03-19 18:27:41 +00:00
Tim Steinbach 6f5f855a2e kernel: 3.10.99 -> 3.10.101 2016-03-19 18:25:24 +00:00
Eelco Dolstra 4b512321de linux: 4.4.5 -> 4.4.6 
CVE-2016-2143
 2016-03-17 13:05:57 +01:00
Eelco Dolstra 6faa0aea88 linux: 3.18.27 -> 3.18.28 
CVE-2016-2085
 2016-03-17 13:05:13 +01:00
Robin Gloster 2ac4dba0fb Merge pull request #13909 from kragniz/linux-4.5 
linux: add 4.5
 2016-03-15 18:12:47 +01:00
Robin Gloster 3f45f0948d Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-03-15 01:44:24 +00:00
Louis Taylor 8bdee80d39 linux: add 4.5 2016-03-14 22:34:05 +00:00
Tim Steinbach a5d8256df4 grsecurity: 4.4.4 -> 4.4.5 2016-03-14 21:29:42 +00:00
Tim Steinbach 7c90420119 kernel: 4.4.4 -> 4.4.5 2016-03-10 01:39:17 +00:00
Nikolay Amiantov fedabe3334 Merge pull request #13745 from zohl/linux-chromiumos 
linux_chromiumos_3_14: kernel option fix
 2016-03-08 13:57:32 +03:00
Vladimír Čunát 09af15654f Merge master into closure-size 
The kde-5 stuff still didn't merge well.
I hand-fixed what I saw, but there may be more problems.
 2016-03-08 09:58:19 +01:00
Franz Pletz 255d710757 grsecurity: 4.4.2 -> 4.4.4 
See #13505.
 2016-03-08 01:03:47 +01:00
Franz Pletz eb5a897161 Merge remote-tracking branch 'origin/pr/13505' 
Fixes #13505.
 2016-03-08 01:01:44 +01:00
Al Zohali 9d03355bed ChromiumOS kernel option fixup 2016-03-08 01:19:42 +03:00
Franz Pletz e9fc4e7db6 Merge remote-tracking branch 'origin/master' into hardened-stdenv 2016-03-07 22:08:27 +01:00
Louis Taylor cdb0267efe linux-testing: 4.5-rc6 -> 4.5-rc7 2016-03-07 01:00:33 +00:00
Franz Pletz 3b1f2e070b linux_4_4: 4.4.3 -> 4.4.4 2016-03-05 21:50:03 +01:00
Franz Pletz af40e356fe linux_3_14: 3.14.61 -> 3.14.63 2016-03-05 21:50:03 +01:00
Franz Pletz 354a1935d3 linux_3_12: 3.12.54 -> 3.12.55 2016-03-05 21:50:03 +01:00
Franz Pletz 5b8361c118 linux_3_10: 3.10.97 -> 3.10.99 2016-03-05 21:50:03 +01:00
Franz Pletz cb3d27df93 Merge remote-tracking branch 'origin/master' into hardened-stdenv 2016-03-05 18:55:30 +01:00
Franz Pletz aff1f4ab94 Use general hardening flag toggle lists 
The following parameters are now available:

  * hardeningDisable
    To disable specific hardening flags
  * hardeningEnable
    To enable specific hardening flags

Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.

cc-wrapper supports the following flags:

  * fortify
  * stackprotector
  * pie (disabled by default)
  * pic
  * strictoverflow
  * format
  * relro
  * bindnow
 2016-03-05 18:55:26 +01:00