diff --git a/lib/maintainers.nix b/lib/maintainers.nix index 221201a6041..0418337b217 100644 --- a/lib/maintainers.nix +++ b/lib/maintainers.nix @@ -55,6 +55,7 @@ smironov = "Sergey Mironov "; thammers = "Tobias Hammerschmidt "; the-kenny = "Moritz Ulrich "; + tomberek = "Thomas Bereknyei "; urkud = "Yury G. Kudryashov "; vcunat = "Vladimír Čunát "; viric = "Lluís Batlle i Rossell "; @@ -63,5 +64,6 @@ winden = "Antonio Vargas Gonzalez "; z77z = "Marco Maggesi "; zef = "Zef Hemel "; + zimbatm = "zimbatm "; zoomulator = "Kim Simmons "; } diff --git a/nixos/doc/manual/development.xml b/nixos/doc/manual/development.xml index 6bbccac6e5c..cbf7ff8902f 100644 --- a/nixos/doc/manual/development.xml +++ b/nixos/doc/manual/development.xml @@ -652,6 +652,37 @@ $ qemu-system-x86_64 -kernel ./kernel/bzImage -initrd ./initrd/initrd -hda /dev/ + + systemd.units.unit-name.unit + + This builds the unit with the specified name. Note that + since unit names contain dots + (e.g. httpd.service), you need to put them + between quotes, like this: + + +$ nix-build -A 'config.systemd.units."httpd.service".unit' + + + You can also test individual units, without rebuilding the whole + system, by putting them in + /run/systemd/system: + + +$ cp $(nix-build -A 'config.systemd.units."httpd.service".unit')/httpd.service \ + /run/systemd/system/tmp-httpd.service +$ systemctl daemon-reload +$ systemctl start tmp-httpd.service + + + Note that the unit must not have the same name as any unit in + /etc/systemd/system since those take + precedence over /run/systemd/system. + That’s why the unit is installed as + tmp-httpd.service here. + + + diff --git a/nixos/lib/build-vms.nix b/nixos/lib/build-vms.nix index d20fbc1cc66..498c0a37783 100644 --- a/nixos/lib/build-vms.nix +++ b/nixos/lib/build-vms.nix @@ -68,8 +68,8 @@ rec { # the first interface (i.e. the first network in its # virtualisation.vlans option). networking.extraHosts = flip concatMapStrings machines - (m: let config = (getAttr m nodes).config; in - optionalString (config.networking.primaryIPAddress != "") + (m': let config = (getAttr m' nodes).config; in + optionalString (m.first != m' && config.networking.primaryIPAddress != "") ("${config.networking.primaryIPAddress} " + "${config.networking.hostName}\n")); diff --git a/nixos/lib/eval-config.nix b/nixos/lib/eval-config.nix index 5e1ce69158f..4b8c7354a7e 100644 --- a/nixos/lib/eval-config.nix +++ b/nixos/lib/eval-config.nix @@ -8,6 +8,7 @@ , extraArgs ? {} , modules , check ? true +, prefix ? [] }: let extraArgs_ = extraArgs; pkgs_ = pkgs; system_ = system; in @@ -17,6 +18,7 @@ rec { # Merge the option definitions in all modules, forming the full # system configuration. inherit (pkgs.lib.evalModules { + inherit prefix; modules = modules ++ baseModules; args = extraArgs; check = check && options.environment.checkConfigurationOptions.value; @@ -48,7 +50,7 @@ rec { let system = if nixpkgsOptions.system != "" then nixpkgsOptions.system else system_; nixpkgsOptions = (import ./eval-config.nix { - inherit system extraArgs modules; + inherit system extraArgs modules prefix; # For efficiency, leave out most NixOS modules; they don't # define nixpkgs.config, so it's pointless to evaluate them. baseModules = [ ../modules/misc/nixpkgs.nix ]; diff --git a/nixos/maintainers/scripts/ec2/create-ebs-amis.py b/nixos/maintainers/scripts/ec2/create-ebs-amis.py index 2e7a3273118..541eadd7b8c 100755 --- a/nixos/maintainers/scripts/ec2/create-ebs-amis.py +++ b/nixos/maintainers/scripts/ec2/create-ebs-amis.py @@ -67,7 +67,7 @@ m.run_command("mkdir -p /mnt/etc/nixos") m.run_command("nix-channel --add http://nixos.org/channels/nixos-unstable") m.run_command("nix-channel --update") m.run_command("nixos-rebuild switch") -version = m.run_command("nixos-version", capture_stdout=True).replace('"', '').rstrip() +version = m.run_command("nixos-version", capture_stdout=True).split(' ')[0] print >> sys.stderr, "NixOS version is {0}".format(version) m.upload_file("./amazon-base-config.nix", "/mnt/etc/nixos/configuration.nix") m.run_command("nixos-install") diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix index f987c9c9e94..8f9b31dccff 100644 --- a/nixos/modules/config/sysctl.nix +++ b/nixos/modules/config/sysctl.nix @@ -46,7 +46,10 @@ in before = [ "sysinit.target" "shutdown.target" ]; wantedBy = [ "sysinit.target" "multi-user.target" ]; restartTriggers = [ config.environment.etc."sysctl.d/nixos.conf".source ]; - unitConfig.DefaultDependencies = false; # needed to prevent a cycle + unitConfig = { + DefaultDependencies = false; # needed to prevent a cycle + ConditionPathIsReadWrite = "/proc/sys/"; # prevent systemd-sysctl in containers + }; serviceConfig = { Type = "oneshot"; RemainAfterExit = true; diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index 0b4274b13e6..ccd75d5b915 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -107,6 +107,7 @@ redis = 96; haproxy = 97; mongodb = 98; + openldap = 99; # When adding a uid, make sure it doesn't match an existing gid. @@ -194,6 +195,7 @@ amule = 90; minidlna = 91; haproxy = 92; + openldap = 93; # When adding a gid, make sure it doesn't match an existing uid. diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 09625511bba..078ea225e16 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -91,6 +91,7 @@ ./services/databases/virtuoso.nix ./services/games/ghost-one.nix ./services/hardware/acpid.nix + ./services/hardware/amd-hybrid-graphics.nix ./services/hardware/bluetooth.nix ./services/hardware/nvidia-optimus.nix ./services/hardware/pcscd.nix @@ -246,11 +247,11 @@ ./system/boot/kexec.nix ./system/boot/loader/efi.nix ./system/boot/loader/generations-dir/generations-dir.nix - ./system/boot/loader/gummiboot/gummiboot.nix - ./system/boot/loader/raspberrypi/raspberrypi.nix ./system/boot/loader/grub/grub.nix ./system/boot/loader/grub/memtest.nix + ./system/boot/loader/gummiboot/gummiboot.nix ./system/boot/loader/init-script/init-script.nix + ./system/boot/loader/raspberrypi/raspberrypi.nix ./system/boot/luksroot.nix ./system/boot/modprobe.nix ./system/boot/shutdown.nix @@ -274,6 +275,8 @@ ./tasks/network-interfaces.nix ./tasks/scsi-link-power-management.nix ./tasks/swraid.nix + ./testing/service-runner.nix + ./virtualisation/containers.nix ./virtualisation/libvirtd.nix #./virtualisation/nova.nix ./virtualisation/virtualbox-guest.nix diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix index 940e87e0b02..dbec4ad98d1 100644 --- a/nixos/modules/security/polkit.nix +++ b/nixos/modules/security/polkit.nix @@ -23,7 +23,15 @@ in default = ""; example = '' - TODO + /* Log authorization checks. */ + polkit.addRule(function(action, subject) { + polkit.log("user " + subject.user + " is attempting action " + action.id + " from PID " + subject.pid); + }); + + /* Allow any local user to do anything (dangerous!). */ + polkit.addRule(function(action, subject) { + if (subject.local) return "yes"; + }); ''; description = '' @@ -33,9 +41,9 @@ in }; security.polkit.adminIdentities = mkOption { - type = types.str; - default = "unix-user:0;unix-group:wheel"; - example = ""; + type = types.listOf types.str; + default = [ "unix-user:0" "unix-group:wheel" ]; + example = [ "unix-user:alice" "unix-group:admin" ]; description = '' Specifies which users are considered “administrators”, for those @@ -58,18 +66,15 @@ in # The polkit daemon reads action/rule files environment.pathsToLink = [ "/share/polkit-1" ]; - # PolKit rules for NixOS - environment.etc = [ { - source = pkgs.writeText "10-nixos.conf" - '' - polkit.addAdminRule(function(action, subject) { - return ["${cfg.adminIdentities}"]; - }); + # PolKit rules for NixOS. + environment.etc."polkit-1/rules.d/10-nixos.rules".text = + '' + polkit.addAdminRule(function(action, subject) { + return [${concatStringsSep ", " (map (i: "\"${i}\"") cfg.adminIdentities)}]; + }); - ${cfg.extraConfig} - ''; #TODO: validation on compilation (at least against typos) - target = "polkit-1/rules.d/10-nixos.conf"; - } ]; + ${cfg.extraConfig} + ''; #TODO: validation on compilation (at least against typos) services.dbus.packages = [ pkgs.polkit ]; diff --git a/nixos/modules/services/audio/alsa.nix b/nixos/modules/services/audio/alsa.nix index d021b8bd3ba..c9a2ef4589b 100644 --- a/nixos/modules/services/audio/alsa.nix +++ b/nixos/modules/services/audio/alsa.nix @@ -55,6 +55,7 @@ in { description = "Store Sound Card State"; wantedBy = [ "multi-user.target" ]; unitConfig.RequiresMountsFor = "/var/lib/alsa"; + unitConfig.ConditionVirtualization = "!systemd-nspawn"; serviceConfig = { Type = "oneshot"; RemainAfterExit = true; diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix index a4dd30be1fb..0fc8b88c652 100644 --- a/nixos/modules/services/databases/openldap.nix +++ b/nixos/modules/services/databases/openldap.nix @@ -26,6 +26,16 @@ in "; }; + user = mkOption { + default = "openldap"; + description = "User account under which slapd runs."; + }; + + group = mkOption { + default = "openldap"; + description = "Group account under which slapd runs."; + }; + extraConfig = mkOption { default = ""; description = " @@ -49,10 +59,23 @@ in after = [ "network.target" ]; preStart = '' mkdir -p /var/run/slapd + chown -R ${cfg.user}:${cfg.group} /var/run/slapd + mkdir -p /var/db/openldap + chown -R ${cfg.user}:${cfg.group} /var/db/openldap ''; - serviceConfig.ExecStart = "${openldap}/libexec/slapd -d 0 -f ${configFile}"; + serviceConfig.ExecStart = "${openldap}/libexec/slapd -u openldap -g openldap -d 0 -f ${configFile}"; }; - }; + users.extraUsers = optionalAttrs (cfg.user == "openldap") (singleton + { name = "openldap"; + group = "openldap"; + uid = config.ids.uids.openldap; + }); + users.extraGroups = optionalAttrs (cfg.group == "openldap") (singleton + { name = "openldap"; + gid = config.ids.gids.openldap; + }); + + }; } diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix index 73447e3cf0d..d99ad2c9c7c 100644 --- a/nixos/modules/services/databases/postgresql.nix +++ b/nixos/modules/services/databases/postgresql.nix @@ -30,6 +30,7 @@ let hba_file = '${pkgs.writeText "pg_hba.conf" cfg.authentication}' ident_file = '${pkgs.writeText "pg_ident.conf" cfg.identMap}' log_destination = 'stderr' + port = ${toString cfg.port} ${cfg.extraConfig} ''; @@ -63,9 +64,9 @@ in port = mkOption { type = types.int; - default = "5432"; + default = 5432; description = '' - Port for PostgreSQL. + The port on which PostgreSQL listens. ''; }; @@ -105,7 +106,9 @@ in type = types.bool; default = false; description = '' - Whether to run PostgreSQL with -i flag to enable TCP/IP connections. + Whether PostgreSQL should listen on all network interfaces. + If disabled, the database can only be accessed via its Unix + domain socket or via TCP connections to localhost. ''; }; @@ -181,8 +184,13 @@ in # Initialise the database. if ! test -e ${cfg.dataDir}; then mkdir -m 0700 -p ${cfg.dataDir} - chown -R postgres ${cfg.dataDir} - su -s ${pkgs.stdenv.shell} postgres -c 'initdb -U root' + if [ "$(id -u)" = 0 ]; then + chown -R postgres ${cfg.dataDir} + su -s ${pkgs.stdenv.shell} postgres -c 'initdb -U root' + else + # For non-root operation. + initdb + fi rm -f ${cfg.dataDir}/*.conf touch "${cfg.dataDir}/.first_startup" fi diff --git a/nixos/modules/services/hardware/acpid.nix b/nixos/modules/services/hardware/acpid.nix index adba6394dcf..2329f38dfc2 100644 --- a/nixos/modules/services/hardware/acpid.nix +++ b/nixos/modules/services/hardware/acpid.nix @@ -110,6 +110,7 @@ in exec = "acpid --confdir ${acpiConfDir}"; + unitConfig.ConditionVirtualization = "!systemd-nspawn"; unitConfig.ConditionPathExists = [ "/proc/acpi" ]; }; diff --git a/nixos/modules/services/hardware/amd-hybrid-graphics.nix b/nixos/modules/services/hardware/amd-hybrid-graphics.nix new file mode 100644 index 00000000000..d938867186d --- /dev/null +++ b/nixos/modules/services/hardware/amd-hybrid-graphics.nix @@ -0,0 +1,39 @@ +{ config, pkgs, ... }: + +{ + + ###### interface + + options = { + + hardware.amdHybridGraphics.disable = pkgs.lib.mkOption { + default = false; + type = pkgs.lib.types.bool; + description = '' + Completely disable the AMD graphics card and use the + integrated graphics processor instead. + ''; + }; + + }; + + + ###### implementation + + config = pkgs.lib.mkIf config.hardware.amdHybridGraphics.disable { + systemd.services."amd-hybrid-graphics" = { + path = [ pkgs.bash ]; + description = "Disable AMD Card"; + after = [ "sys-kernel-debug.mount" ]; + requires = [ "sys-kernel-debug.mount" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + ExecStart = "${pkgs.bash}/bin/sh -c 'echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch; exit 0'"; + ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch; exit 0'"; + }; + }; + }; + +} diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix index 516569c0280..52b3ad43579 100644 --- a/nixos/modules/services/hardware/udev.nix +++ b/nixos/modules/services/hardware/udev.nix @@ -209,7 +209,7 @@ in ###### implementation - config = { + config = mkIf (!config.boot.isContainer) { services.udev.extraRules = nixosRules; @@ -231,9 +231,16 @@ in boot.extraModprobeConfig = "options firmware_class path=${config.hardware.firmware}"; - system.activationScripts.clearHotplug = + system.activationScripts.udevd = '' echo "" > /proc/sys/kernel/hotplug + + # Regenerate the hardware database /var/lib/udev/hwdb.bin + # whenever systemd changes. + if [ ! -e /var/lib/udev/prev-systemd -o "$(readlink /var/lib/udev/prev-systemd)" != ${config.systemd.package} ]; then + echo "regenerating udev hardware database..." + ${config.systemd.package}/bin/udevadm hwdb --update && ln -sfn ${config.systemd.package} /var/lib/udev/prev-systemd + fi ''; }; diff --git a/nixos/modules/services/logging/klogd.nix b/nixos/modules/services/logging/klogd.nix index d7d0bbf89a5..36b530d0077 100644 --- a/nixos/modules/services/logging/klogd.nix +++ b/nixos/modules/services/logging/klogd.nix @@ -32,6 +32,8 @@ with pkgs.lib; path = [ pkgs.sysklogd ]; + unitConfig.ConditionVirtualization = "!systemd-nspawn"; + exec = "klogd -c 1 -2 -n " + "-k $(dirname $(readlink -f /run/booted-system/kernel))/System.map"; diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix index 1707828d0db..cca42aa1100 100644 --- a/nixos/modules/services/misc/nix-daemon.nix +++ b/nixos/modules/services/misc/nix-daemon.nix @@ -279,6 +279,7 @@ in { description = "Nix Daemon Socket"; wantedBy = [ "sockets.target" ]; before = [ "multi-user.target" ]; + unitConfig.ConditionPathIsReadWrite = "/nix/var/nix/daemon-socket/"; socketConfig.ListenStream = "/nix/var/nix/daemon-socket/socket"; }; @@ -290,6 +291,8 @@ in environment = cfg.envVars // { CURL_CA_BUNDLE = "/etc/ssl/certs/ca-bundle.crt"; }; + unitConfig.ConditionPathIsReadWrite = "/nix/var/nix/daemon-socket/"; + serviceConfig = { ExecStart = "@${nix}/bin/nix-daemon nix-daemon --daemon"; KillMode = "process"; @@ -331,10 +334,8 @@ in '' # Set up secure multi-user builds: non-root users build through the # Nix daemon. - if test "$USER" != root; then + if [ "$USER" != root -o ! -w /nix/var/nix/db ]; then export NIX_REMOTE=daemon - else - export NIX_REMOTE= fi ''; diff --git a/nixos/modules/services/monitoring/dd-agent.nix b/nixos/modules/services/monitoring/dd-agent.nix index f99114ac9ad..37ce1c099df 100644 --- a/nixos/modules/services/monitoring/dd-agent.nix +++ b/nixos/modules/services/monitoring/dd-agent.nix @@ -62,6 +62,8 @@ in { ExecStart = "${pkgs.dd-agent}/bin/dd-agent foreground"; User = "dd-agent"; Group = "dd-agent"; + Restart = "always"; + RestartSec = 2; }; restartTriggers = [ pkgs.dd-agent datadog_conf ]; }; @@ -76,6 +78,8 @@ in { Group = "dd-agent"; Type = "forking"; PIDFile = "/tmp/dogstatsd.pid"; + Restart = "always"; + RestartSec = 2; }; restartTriggers = [ pkgs.dd-agent datadog_conf ]; }; diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix index 07b5606eaca..ea263b3c89d 100644 --- a/nixos/modules/services/networking/dhcpcd.nix +++ b/nixos/modules/services/networking/dhcpcd.nix @@ -114,6 +114,8 @@ in path = [ dhcpcd pkgs.nettools pkgs.openresolv ]; + unitConfig.ConditionCapability = "CAP_NET_ADMIN"; + serviceConfig = { Type = "forking"; PIDFile = "/run/dhcpcd.pid"; diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix index 951cef3eac0..56ae399c901 100644 --- a/nixos/modules/services/printing/cupsd.nix +++ b/nixos/modules/services/printing/cupsd.nix @@ -149,7 +149,7 @@ in '' LogLevel info - SystemGroup root + SystemGroup root wheel Listen localhost:631 Listen /var/run/cups/cups.sock diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix index 90094889348..cdb42fa7308 100644 --- a/nixos/modules/services/web-servers/apache-httpd/default.nix +++ b/nixos/modules/services/web-servers/apache-httpd/default.nix @@ -628,10 +628,10 @@ in preStart = '' mkdir -m 0750 -p ${mainCfg.stateDir} - chown root.${mainCfg.group} ${mainCfg.stateDir} + [ $(id -u) != 0 ] || chown root.${mainCfg.group} ${mainCfg.stateDir} ${optionalString version24 '' mkdir -m 0750 -p "${mainCfg.stateDir}/runtime" - chown root.${mainCfg.group} "${mainCfg.stateDir}/runtime" + [ $(id -u) != 0 ] || chown root.${mainCfg.group} "${mainCfg.stateDir}/runtime" ''} mkdir -m 0700 -p ${mainCfg.logDir} @@ -659,6 +659,7 @@ in serviceConfig.ExecStart = "@${httpd}/bin/httpd httpd -f ${httpdConf}"; serviceConfig.ExecStop = "${httpd}/bin/httpd -f ${httpdConf} -k graceful-stop"; serviceConfig.Type = "forking"; + serviceConfig.PIDFile = "${mainCfg.stateDir}/httpd.pid"; serviceConfig.Restart = "always"; }; diff --git a/nixos/modules/services/x11/desktop-managers/xfce.nix b/nixos/modules/services/x11/desktop-managers/xfce.nix index 8199829ef90..d20010c70a6 100644 --- a/nixos/modules/services/x11/desktop-managers/xfce.nix +++ b/nixos/modules/services/x11/desktop-managers/xfce.nix @@ -72,6 +72,7 @@ in pkgs.xfce.thunar_volman pkgs.xfce.gvfs pkgs.xfce.xfce4_appfinder + pkgs.xfce.tumbler ] ++ optional config.powerManagement.enable pkgs.xfce.xfce4_power_manager; diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix index ada96131675..d9891f434cc 100644 --- a/nixos/modules/system/activation/top-level.nix +++ b/nixos/modules/system/activation/top-level.nix @@ -34,16 +34,24 @@ let in '' mkdir $out - if [ ! -f ${kernelPath} ]; then - echo "The bootloader cannot find the proper kernel image." - echo "(Expecting ${kernelPath})" - false - fi + # Containers don't have their own kernel or initrd. They boot + # directly into stage 2. + ${optionalString (!config.boot.isContainer) '' + if [ ! -f ${kernelPath} ]; then + echo "The bootloader cannot find the proper kernel image." + echo "(Expecting ${kernelPath})" + false + fi - ln -s ${kernelPath} $out/kernel - ln -s ${config.system.modulesTree} $out/kernel-modules + ln -s ${kernelPath} $out/kernel + ln -s ${config.system.modulesTree} $out/kernel-modules - ln -s ${config.system.build.initialRamdisk}/initrd $out/initrd + echo -n "$kernelParams" > $out/kernel-params + + ln -s ${config.system.build.initialRamdisk}/initrd $out/initrd + + ln -s ${config.hardware.firmware} $out/firmware + ''} echo "$activationScript" > $out/activate substituteInPlace $out/activate --subst-var out @@ -56,9 +64,7 @@ let ln -s ${config.system.build.etc}/etc $out/etc ln -s ${config.system.path} $out/sw ln -s "$systemd" $out/systemd - ln -s ${config.hardware.firmware} $out/firmware - echo -n "$kernelParams" > $out/kernel-params echo -n "$configurationName" > $out/configuration-name echo -n "systemd ${toString config.systemd.package.interfaceVersion}" > $out/init-interface-version echo -n "$nixosVersion" > $out/nixos-version diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix index 006909fbd0c..ee2f5e9b4f6 100644 --- a/nixos/modules/system/boot/kernel.nix +++ b/nixos/modules/system/boot/kernel.nix @@ -145,7 +145,7 @@ in ###### implementation - config = { + config = mkIf (!config.boot.isContainer) { system.build = { inherit kernel; }; @@ -230,9 +230,10 @@ in { description = "Load Kernel Modules"; wantedBy = [ "sysinit.target" "multi-user.target" ]; before = [ "sysinit.target" "shutdown.target" ]; + conflicts = [ "shutdown.target" ]; unitConfig = - { DefaultDependencies = "no"; - Conflicts = "shutdown.target"; + { DefaultDependencies = false; + ConditionCapability = "CAP_SYS_MODULE"; }; serviceConfig = { Type = "oneshot"; diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix index 8b3923e30a0..ef6ff71ed77 100644 --- a/nixos/modules/system/boot/loader/grub/grub.nix +++ b/nixos/modules/system/boot/loader/grub/grub.nix @@ -44,7 +44,7 @@ in boot.loader.grub = { enable = mkOption { - default = true; + default = !config.boot.isContainer; type = types.bool; description = '' Whether to enable the GNU GRUB boot loader. diff --git a/nixos/modules/system/boot/modprobe.nix b/nixos/modules/system/boot/modprobe.nix index 39928da8d19..027a7ac99d5 100644 --- a/nixos/modules/system/boot/modprobe.nix +++ b/nixos/modules/system/boot/modprobe.nix @@ -66,7 +66,7 @@ with pkgs.lib; ###### implementation - config = { + config = mkIf (!config.boot.isContainer) { environment.etc = singleton { source = pkgs.writeText "modprobe.conf" diff --git a/nixos/modules/system/boot/shutdown.nix b/nixos/modules/system/boot/shutdown.nix index ad71a2e816e..44cadcd64a7 100644 --- a/nixos/modules/system/boot/shutdown.nix +++ b/nixos/modules/system/boot/shutdown.nix @@ -6,20 +6,20 @@ with pkgs.lib; # This unit saves the value of the system clock to the hardware # clock on shutdown. - systemd.units."save-hwclock.service" = - { wantedBy = [ "shutdown.target" ]; + systemd.services.save-hwclock = + { description = "Save Hardware Clock"; - text = - '' - [Unit] - Description=Save Hardware Clock - DefaultDependencies=no - Before=shutdown.target + wantedBy = [ "shutdown.target" ]; - [Service] - Type=oneshot - ExecStart=${pkgs.utillinux}/sbin/hwclock --systohc ${if config.time.hardwareClockInLocalTime then "--localtime" else "--utc"} - ''; + unitConfig = { + DefaultDependencies = false; + ConditionVirtualization = "!systemd-nspawn"; + }; + + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.utillinux}/sbin/hwclock --systohc ${if config.time.hardwareClockInLocalTime then "--localtime" else "--utc"}"; + }; }; boot.kernel.sysctl."kernel.poweroff_cmd" = "${config.systemd.package}/sbin/poweroff"; diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix index b2b66280372..8ed3aecb691 100644 --- a/nixos/modules/system/boot/stage-1.nix +++ b/nixos/modules/system/boot/stage-1.nix @@ -328,7 +328,12 @@ in }; - config = { + config = mkIf (!config.boot.isContainer) { + + assertions = singleton + { assertion = any (fs: fs.mountPoint == "/") (attrValues config.fileSystems); + message = "The ‘fileSystems’ option does not specify your root file system."; + }; system.build.bootStage1 = bootStage1; system.build.initialRamdisk = initialRamdisk; diff --git a/nixos/modules/system/boot/systemd-unit-options.nix b/nixos/modules/system/boot/systemd-unit-options.nix index a1faea886f9..c0518599f17 100644 --- a/nixos/modules/system/boot/systemd-unit-options.nix +++ b/nixos/modules/system/boot/systemd-unit-options.nix @@ -14,6 +14,18 @@ let in if errors == [] then true else builtins.trace (concatStringsSep "\n" errors) false; + unitOption = mkOptionType { + name = "systemd option"; + merge = loc: defs: + let + defs' = filterOverrides defs; + defs'' = getValues defs'; + in + if isList (head defs'') + then concatLists defs'' + else mergeOneOption loc defs'; + }; + in rec { unitOptions = { @@ -37,7 +49,7 @@ in rec { requires = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = '' Start the specified units when this unit is started, and stop this unit when the specified units are stopped or fail. @@ -46,7 +58,7 @@ in rec { wants = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = '' Start the specified units when this unit is started. ''; @@ -54,7 +66,7 @@ in rec { after = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = '' If the specified units are started at the same time as this unit, delay this unit until they have started. @@ -63,7 +75,7 @@ in rec { before = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = '' If the specified units are started at the same time as this unit, delay them until this unit has started. @@ -72,7 +84,7 @@ in rec { bindsTo = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = '' Like ‘requires’, but in addition, if the specified units unexpectedly disappear, this unit will be stopped as well. @@ -81,7 +93,7 @@ in rec { partOf = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = '' If the specified units are stopped or restarted, then this unit is stopped or restarted as well. @@ -90,7 +102,7 @@ in rec { conflicts = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = '' If the specified units are started, then this unit is stopped and vice versa. @@ -99,20 +111,20 @@ in rec { requiredBy = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = "Units that require (i.e. depend on and need to go down with) this unit."; }; wantedBy = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; description = "Units that want (i.e. depend on) this unit."; }; unitConfig = mkOption { default = {}; example = { RequiresMountsFor = "/data"; }; - type = types.attrs; + type = types.attrsOf unitOption; description = '' Each attribute in this set specifies an option in the [Unit] section of the unit. See @@ -137,7 +149,7 @@ in rec { environment = mkOption { default = {}; - type = types.attrs; + type = types.attrs; # FIXME example = { PATH = "/foo/bar/bin"; LANG = "nl_NL.UTF-8"; }; description = "Environment variables passed to the service's processes."; }; @@ -159,7 +171,7 @@ in rec { { StartLimitInterval = 10; RestartSec = 5; }; - type = types.addCheck types.attrs checkService; + type = types.addCheck (types.attrsOf unitOption) checkService; description = '' Each attribute in this set specifies an option in the [Service] section of the unit. See @@ -169,7 +181,7 @@ in rec { }; script = mkOption { - type = types.str; + type = types.lines; default = ""; description = "Shell commands executed as the service's main process."; }; @@ -181,7 +193,7 @@ in rec { }; preStart = mkOption { - type = types.string; + type = types.lines; default = ""; description = '' Shell commands executed before the service's main process @@ -190,7 +202,7 @@ in rec { }; postStart = mkOption { - type = types.string; + type = types.lines; default = ""; description = '' Shell commands executed after the service's main process @@ -198,8 +210,16 @@ in rec { ''; }; + preStop = mkOption { + type = types.lines; + default = ""; + description = '' + Shell commands executed to stop the service. + ''; + }; + postStop = mkOption { - type = types.string; + type = types.lines; default = ""; description = '' Shell commands executed after the service's main process @@ -252,7 +272,7 @@ in rec { listenStreams = mkOption { default = []; - type = types.listOf types.string; + type = types.listOf types.str; example = [ "0.0.0.0:993" "/run/my-socket" ]; description = '' For each item in this list, a ListenStream @@ -263,7 +283,7 @@ in rec { socketConfig = mkOption { default = {}; example = { ListenStream = "/run/my-socket"; }; - type = types.attrs; + type = types.attrsOf unitOption; description = '' Each attribute in this set specifies an option in the [Socket] section of the unit. See @@ -280,7 +300,7 @@ in rec { timerConfig = mkOption { default = {}; example = { OnCalendar = "Sun 14:00:00"; Unit = "foo.service"; }; - type = types.attrs; + type = types.attrsOf unitOption; description = '' Each attribute in this set specifies an option in the [Timer] section of the unit. See @@ -328,7 +348,7 @@ in rec { mountConfig = mkOption { default = {}; example = { DirectoryMode = "0775"; }; - type = types.attrs; + type = types.attrsOf unitOption; description = '' Each attribute in this set specifies an option in the [Mount] section of the unit. See @@ -352,7 +372,7 @@ in rec { automountConfig = mkOption { default = {}; example = { DirectoryMode = "0775"; }; - type = types.attrs; + type = types.attrsOf unitOption; description = '' Each attribute in this set specifies an option in the [Automount] section of the unit. See diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 7c6807340fd..75c2c788f38 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -160,16 +160,48 @@ let }; serviceConfig = { name, config, ... }: { - config = { - # Default path for systemd services. Should be quite minimal. - path = - [ pkgs.coreutils - pkgs.findutils - pkgs.gnugrep - pkgs.gnused - systemd - ]; - }; + config = mkMerge + [ { # Default path for systemd services. Should be quite minimal. + path = + [ pkgs.coreutils + pkgs.findutils + pkgs.gnugrep + pkgs.gnused + systemd + ]; + environment.PATH = config.path; + } + (mkIf (config.preStart != "") + { serviceConfig.ExecStartPre = makeJobScript "${name}-pre-start" '' + #! ${pkgs.stdenv.shell} -e + ${config.preStart} + ''; + }) + (mkIf (config.script != "") + { serviceConfig.ExecStart = makeJobScript "${name}-start" '' + #! ${pkgs.stdenv.shell} -e + ${config.script} + '' + " " + config.scriptArgs; + }) + (mkIf (config.postStart != "") + { serviceConfig.ExecStartPost = makeJobScript "${name}-post-start" '' + #! ${pkgs.stdenv.shell} -e + ${config.postStart} + ''; + }) + (mkIf (config.preStop != "") + { serviceConfig.ExecStop = makeJobScript "${name}-pre-stop" '' + #! ${pkgs.stdenv.shell} -e + ${config.preStop} + ''; + }) + (mkIf (config.postStop != "") + { serviceConfig.ExecStopPost = makeJobScript "${name}-post-stop" '' + #! ${pkgs.stdenv.shell} -e + ${config.postStop} + ''; + }) + ]; }; mountConfig = { name, config, ... }: { @@ -223,41 +255,10 @@ let ${attrsToSection def.unitConfig} [Service] - Environment=PATH=${def.path} - Environment=LD_LIBRARY_PATH= ${let env = cfg.globalEnvironment // def.environment; in concatMapStrings (n: "Environment=\"${n}=${getAttr n env}\"\n") (attrNames env)} ${optionalString (!def.restartIfChanged) "X-RestartIfChanged=false"} ${optionalString (!def.stopIfChanged) "X-StopIfChanged=false"} - - ${optionalString (def.preStart != "") '' - ExecStartPre=${makeJobScript "${name}-pre-start" '' - #! ${pkgs.stdenv.shell} -e - ${def.preStart} - ''} - ''} - - ${optionalString (def.script != "") '' - ExecStart=${makeJobScript "${name}-start" '' - #! ${pkgs.stdenv.shell} -e - ${def.script} - ''} ${def.scriptArgs} - ''} - - ${optionalString (def.postStart != "") '' - ExecStartPost=${makeJobScript "${name}-post-start" '' - #! ${pkgs.stdenv.shell} -e - ${def.postStart} - ''} - ''} - - ${optionalString (def.postStop != "") '' - ExecStopPost=${makeJobScript "${name}-post-stop" '' - #! ${pkgs.stdenv.shell} -e - ${def.postStop} - ''} - ''} - ${attrsToSection def.serviceConfig} ''; }; @@ -311,8 +312,6 @@ let ''; }; - nixosUnits = mapAttrsToList makeUnit cfg.units; - units = pkgs.runCommand "units" { preferLocalBuild = true; } '' mkdir -p $out @@ -338,7 +337,7 @@ let done done - for i in ${toString nixosUnits}; do + for i in ${toString (mapAttrsToList (n: v: v.unit) cfg.units)}; do ln -s $i/* $out/ done @@ -387,32 +386,41 @@ in description = "Definition of systemd units."; default = {}; type = types.attrsOf types.optionSet; - options = { - text = mkOption { - type = types.str; - description = "Text of this systemd unit."; + options = { name, config, ... }: + { options = { + text = mkOption { + type = types.str; + description = "Text of this systemd unit."; + }; + enable = mkOption { + default = true; + type = types.bool; + description = '' + If set to false, this unit will be a symlink to + /dev/null. This is primarily useful to prevent specific + template instances (e.g. serial-getty@ttyS0) + from being started. + ''; + }; + requiredBy = mkOption { + default = []; + type = types.listOf types.string; + description = "Units that require (i.e. depend on and need to go down with) this unit."; + }; + wantedBy = mkOption { + default = []; + type = types.listOf types.string; + description = "Units that want (i.e. depend on) this unit."; + }; + unit = mkOption { + internal = true; + description = "The generated unit."; + }; + }; + config = { + unit = makeUnit name config; + }; }; - enable = mkOption { - default = true; - type = types.bool; - description = '' - If set to false, this unit will be a symlink to - /dev/null. This is primarily useful to prevent specific - template instances (e.g. serial-getty@ttyS0) - from being started. - ''; - }; - requiredBy = mkOption { - default = []; - type = types.listOf types.string; - description = "Units that require (i.e. depend on and need to go down with) this unit."; - }; - wantedBy = mkOption { - default = []; - type = types.listOf types.string; - description = "Units that want (i.e. depend on) this unit."; - }; - }; }; systemd.packages = mkOption { @@ -486,6 +494,16 @@ in ''; }; + systemd.extraConfig = mkOption { + default = ""; + type = types.lines; + example = "DefaultLimitCORE=infinity"; + description = '' + Extra config options for systemd. See man systemd-system.conf for + available options. + ''; + }; + services.journald.console = mkOption { default = ""; type = types.str; @@ -516,9 +534,19 @@ in ''; }; + services.journald.extraConfig = mkOption { + default = ""; + type = types.lines; + example = "Storage=volatile"; + description = '' + Extra config options for systemd-journald. See man journald.conf + for available options. + ''; + }; + services.logind.extraConfig = mkOption { default = ""; - type = types.str; + type = types.lines; example = "HandleLidSwitch=ignore"; description = '' Extra config options for systemd-logind. See man logind.conf for @@ -555,6 +583,7 @@ in environment.etc."systemd/system.conf".text = '' [Manager] + ${config.systemd.extraConfig} ''; environment.etc."systemd/journald.conf".text = @@ -566,6 +595,7 @@ in ForwardToConsole=yes TTYPath=${config.services.journald.console} ''} + ${config.services.journald.extraConfig} ''; environment.etc."systemd/logind.conf".text = @@ -585,13 +615,6 @@ in mkdir -p /var/log/journal chmod 0755 /var/log/journal - # Regenerate the hardware database /var/lib/udev/hwdb.bin - # whenever systemd changes. - if [ ! -e /var/lib/udev/prev-systemd -o "$(readlink /var/lib/udev/prev-systemd)" != ${systemd} ]; then - echo "regenerating udev hardware database..." - ${systemd}/bin/udevadm hwdb --update && ln -sfn ${systemd} /var/lib/udev/prev-systemd - fi - # Make all journals readable to users in the wheel and adm # groups, in addition to those in the systemd-journal group. # Users can always read their own journals. diff --git a/nixos/modules/tasks/cpu-freq.nix b/nixos/modules/tasks/cpu-freq.nix index ce36a8bab09..705ec93a136 100644 --- a/nixos/modules/tasks/cpu-freq.nix +++ b/nixos/modules/tasks/cpu-freq.nix @@ -33,6 +33,8 @@ with pkgs.lib; after = [ "systemd-modules-load.service" ]; wantedBy = [ "multi-user.target" ]; + unitConfig.ConditionPathIsReadWrite = "/sys/devices/"; + path = [ pkgs.cpufrequtils ]; preStart = '' diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix index 3f484045ed4..b0bcd2eb373 100644 --- a/nixos/modules/tasks/filesystems.nix +++ b/nixos/modules/tasks/filesystems.nix @@ -81,6 +81,7 @@ in options = { fileSystems = mkOption { + default = {}; example = { "/".device = "/dev/hda1"; "/data" = { diff --git a/nixos/modules/tasks/kbd.nix b/nixos/modules/tasks/kbd.nix index 9f294a5f93e..1083fb784fc 100644 --- a/nixos/modules/tasks/kbd.nix +++ b/nixos/modules/tasks/kbd.nix @@ -55,9 +55,9 @@ in { description = "Setup Virtual Console"; wantedBy = [ "sysinit.target" "multi-user.target" ]; before = [ "sysinit.target" "shutdown.target" ]; + conflicts = [ "shutdown.target" ]; unitConfig = { DefaultDependencies = "no"; - Conflicts = "shutdown.target"; ConditionPathExists = "/dev/tty1"; }; serviceConfig = diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix index d8522b6abba..b1ab989f130 100644 --- a/nixos/modules/tasks/network-interfaces.nix +++ b/nixos/modules/tasks/network-interfaces.nix @@ -270,6 +270,8 @@ in before = [ "network.target" ]; wantedBy = [ "network.target" ]; + unitConfig.ConditionCapability = "CAP_NET_ADMIN"; + path = [ pkgs.iproute ]; serviceConfig.Type = "oneshot"; diff --git a/nixos/modules/tasks/scsi-link-power-management.nix b/nixos/modules/tasks/scsi-link-power-management.nix index 4927952080f..071a8086598 100644 --- a/nixos/modules/tasks/scsi-link-power-management.nix +++ b/nixos/modules/tasks/scsi-link-power-management.nix @@ -31,6 +31,8 @@ with pkgs.lib; task = true; + unitConfig.ConditionPathIsReadWrite = "/sys/class/scsi_host"; + script = '' shopt -s nullglob for x in /sys/class/scsi_host/host*/link_power_management_policy; do diff --git a/nixos/modules/testing/service-runner.nix b/nixos/modules/testing/service-runner.nix new file mode 100644 index 00000000000..6f17ed77dad --- /dev/null +++ b/nixos/modules/testing/service-runner.nix @@ -0,0 +1,114 @@ +{ config, pkgs, ... }: + +with pkgs.lib; + +let + + makeScript = name: service: pkgs.writeScript "${name}-runner" + '' + #! ${pkgs.perl}/bin/perl -w -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl + + use File::Slurp; + + sub run { + my ($cmd) = @_; + my @args = split " ", $cmd; + my $prog; + if (substr($args[0], 0, 1) eq "@") { + $prog = substr($args[0], 1); + shift @args; + } else { + $prog = $args[0]; + } + my $pid = fork; + if ($pid == 0) { + setpgrp; # don't receive SIGINT etc. from terminal + exec { $prog } @args; + die "failed to exec $prog\n"; + } elsif (!defined $pid) { + die "failed to fork: $!\n"; + } + return $pid; + }; + + sub run_wait { + my ($cmd) = @_; + my $pid = run $cmd; + die if waitpid($pid, 0) != $pid; + return $?; + }; + + # Set the environment. FIXME: escaping. + foreach my $key (keys %ENV) { + next if $key eq 'LOCALE_ARCHIVE'; + delete $ENV{$key}; + } + ${concatStrings (mapAttrsToList (n: v: '' + $ENV{'${n}'} = '${v}'; + '') service.environment)} + + # Run the ExecStartPre program. FIXME: this could be a list. + my $preStart = '${service.serviceConfig.ExecStartPre or ""}'; + if ($preStart ne "") { + print STDERR "running ExecStartPre: $preStart\n"; + my $res = run_wait $preStart; + die "$0: ExecStartPre failed with status $res\n" if $res; + }; + + # Run the ExecStart program. + my $cmd = '${service.serviceConfig.ExecStart}'; + print STDERR "running ExecStart: $cmd\n"; + my $mainPid = run $cmd; + $ENV{'MAINPID'} = $mainPid; + + # Catch SIGINT, propagate to the main program. + sub intHandler { + print STDERR "got SIGINT, stopping service...\n"; + kill 'INT', $mainPid; + }; + $SIG{'INT'} = \&intHandler; + $SIG{'QUIT'} = \&intHandler; + + # Run the ExecStartPost program. + my $postStart = '${service.serviceConfig.ExecStartPost or ""}'; + if ($postStart ne "") { + print STDERR "running ExecStartPost: $postStart\n"; + my $res = run_wait $postStart; + die "$0: ExecStartPost failed with status $res\n" if $res; + } + + # Wait for the main program to exit. + die if waitpid($mainPid, 0) != $mainPid; + my $mainRes = $?; + + # Run the ExecStopPost program. + my $postStop = '${service.serviceConfig.ExecStopPost or ""}'; + if ($postStop ne "") { + print STDERR "running ExecStopPost: $postStop\n"; + my $res = run_wait $postStop; + die "$0: ExecStopPost failed with status $res\n" if $res; + } + + exit($mainRes & 127 ? 255 : $mainRes << 8); + ''; + +in + +{ + options = { + systemd.services = mkOption { + options = + { config, name, ... }: + { options.runner = mkOption { + internal = true; + description = '' + A script that runs the service outside of systemd, + useful for testing or for using NixOS services outside + of NixOS. + ''; + }; + config.runner = makeScript name config; + }; + }; + }; +} diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix new file mode 100644 index 00000000000..bcbfaacd703 --- /dev/null +++ b/nixos/modules/virtualisation/containers.nix @@ -0,0 +1,137 @@ +{ config, pkgs, ... }: + +with pkgs.lib; + +{ + options = { + + boot.isContainer = mkOption { + type = types.bool; + default = false; + description = '' + Whether this NixOS machine is a lightweight container running + in another NixOS system. + ''; + }; + + systemd.containers = mkOption { + type = types.attrsOf (types.submodule ( + { config, options, name, ... }: + { + options = { + + root = mkOption { + type = types.path; + description = '' + The root directory of the container. + ''; + }; + + config = mkOption { + description = '' + A specification of the desired configuration of this + container, as a NixOS module. + ''; + }; + + path = mkOption { + type = types.path; + example = "/nix/var/nix/profiles/containers/webserver"; + description = '' + As an alternative to specifying + , you can specify the path to + the evaluated NixOS system configuration, typically a + symlink to a system profile. + ''; + }; + + }; + + config = mkMerge + [ { root = mkDefault "/var/lib/containers/${name}"; + } + (mkIf options.config.isDefined { + path = (import ../../lib/eval-config.nix { + modules = + let extraConfig = + { boot.isContainer = true; + security.initialRootPassword = "!"; + networking.hostName = mkDefault name; + }; + in [ extraConfig config.config ]; + prefix = [ "systemd" "containers" name ]; + }).config.system.build.toplevel; + }) + ]; + })); + + default = {}; + example = literalExample + '' + { webserver = + { root = "/containers/webserver"; + path = "/nix/var/nix/profiles/webserver"; + }; + database = + { root = "/containers/database"; + config = + { config, pkgs, ... }: + { services.postgresql.enable = true; + services.postgresql.package = pkgs.postgresql92; + }; + }; + } + ''; + description = '' + A set of NixOS system configurations to be run as lightweight + containers. Each container appears as a service + container-name + on the host system, allowing it to be started and stopped via + systemctl . + ''; + }; + + }; + + + config = { + + systemd.services = mapAttrs' (name: container: nameValuePair "container-${name}" + { description = "Container '${name}'"; + + wantedBy = [ "multi-user.target" ]; + + unitConfig.RequiresMountsFor = [ container.root ]; + + preStart = + '' + mkdir -p -m 0755 ${container.root}/etc + if ! [ -e ${container.root}/etc/os-release ]; then + touch ${container.root}/etc/os-release + fi + ''; + + serviceConfig.ExecStart = + "${config.systemd.package}/bin/systemd-nspawn -M ${name} -D ${container.root} --bind-ro=/nix ${container.path}/init"; + + preStop = + '' + pid="$(cat /sys/fs/cgroup/systemd/machine/${name}.nspawn/system/tasks 2> /dev/null)" + if [ -n "$pid" ]; then + # Send the RTMIN+3 signal, which causes the container + # systemd to start halt.target. + echo "killing container systemd, PID = $pid" + kill -RTMIN+3 $pid + # Wait for the container to exit. We can't let systemd + # do this because it will send a signal to the entire + # cgroup. + for ((n = 0; n < 180; n++)); do + if ! kill -0 $pid 2> /dev/null; then break; fi + sleep 1 + done + fi + ''; + }) config.systemd.containers; + + }; +} \ No newline at end of file diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix index 552441f6a62..d8668eb1607 100644 --- a/nixos/modules/virtualisation/libvirtd.nix +++ b/nixos/modules/virtualisation/libvirtd.nix @@ -101,6 +101,19 @@ in mkdir -p /etc/$(dirname $i) -m 755 cp -fpd ${pkgs.libvirt}/etc/$i /etc/$i done + + # libvirtd puts the full path of the emulator binary in the machine + # config file. But this path can unfortunately be garbage collected + # while still being used by the virtual machine. So update the + # emulator path on each startup to something valid (re-scan $PATH). + for file in /etc/libvirt/qemu/*.xml; do + # get (old) emulator path from config file + emulator=$(grep "^[[:space:]]*" "$file" | sed 's,^[[:space:]]*\(.*\).*,\1,') + # get a (definitely) working emulator path by re-scanning $PATH + new_emulator=$(command -v $(basename "$emulator")) + # write back + sed -i "s,^[[:space:]]*.*, $new_emulator ," "$file" + done ''; # */ serviceConfig.ExecStart = ''@${pkgs.libvirt}/sbin/libvirtd libvirtd --config "${configFile}" --daemon --verbose''; diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix index 12ac6f6f9a6..d355d705a24 100644 --- a/nixos/tests/misc.nix +++ b/nixos/tests/misc.nix @@ -59,6 +59,12 @@ subtest "override-env-var", sub { $machine->succeed('[ "$EDITOR" = emacs ]'); }; + + # Test whether hostname (and by extension nss_myhostname) works. + subtest "hostname", sub { + $machine->succeed('[ "`hostname`" = machine ]'); + $machine->succeed('[ "`hostname -s`" = machine ]'); + }; ''; } diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix index 8b99988f07b..8cb64820295 100644 --- a/pkgs/applications/audio/qmmp/default.nix +++ b/pkgs/applications/audio/qmmp/default.nix @@ -28,11 +28,11 @@ # handle that. stdenv.mkDerivation rec { - name = "qmmp-0.7.0"; + name = "qmmp-0.7.3"; src = fetchurl { url = "http://qmmp.ylsoftware.com/files/${name}.tar.bz2"; - sha256 = "0g8qcs82y3dy06lsgam2w6gh2ccx0frlw9fp4xg947vi3a16g6ig"; + sha256 = "0qjmnyq3qmrm510g3lsa6vd80nmbz0859pwhnaaa19ah0jhf3r2p"; }; buildInputs = @@ -55,5 +55,6 @@ stdenv.mkDerivation rec { license = licenses.gpl2; platforms = platforms.linux; maintainers = [maintainers.bjornfor]; + repositories.svn = http://qmmp.googlecode.com/svn/; }; } diff --git a/pkgs/applications/editors/emacs-modes/ess/default.nix b/pkgs/applications/editors/emacs-modes/ess/default.nix index 4bd5148b950..a5b9cc184f3 100644 --- a/pkgs/applications/editors/emacs-modes/ess/default.nix +++ b/pkgs/applications/editors/emacs-modes/ess/default.nix @@ -1,11 +1,11 @@ { stdenv, fetchurl, emacs, texinfo }: -stdenv.mkDerivation { - name = "ess-13.05"; +stdenv.mkDerivation rec { + name = "ess-13.09"; src = fetchurl { - url = "http://ess.r-project.org/downloads/ess/ess-13.05.tgz"; - sha256 = "007rd8hg1aclr2i8178ym5c4bi7vgmwkp802v1mkgr85h50zlfdk"; + url = "http://ess.r-project.org/downloads/ess/${name}.tgz"; + sha256 = "1lki3vb6p7cw98zqq0gaia68flpqrjkd6dcl85fs0cc8qf55yqnh"; }; buildInputs = [ emacs texinfo ]; diff --git a/pkgs/applications/graphics/grafx2/default.nix b/pkgs/applications/graphics/grafx2/default.nix new file mode 100644 index 00000000000..6b7c9a27694 --- /dev/null +++ b/pkgs/applications/graphics/grafx2/default.nix @@ -0,0 +1,28 @@ +{ stdenv, fetchurl, SDL, SDL_image, SDL_ttf, zlib, libpng, pkgconfig, lua5 }: + +stdenv.mkDerivation rec { + + version = "2.4.2035"; + name = "grafx2-${version}"; + + src = fetchurl { + url = "https://grafx2.googlecode.com/files/${name}-src.tgz"; + sha256 = "0svsy6rqmdj11b400c242i2ixihyz0hds0dgicqz6g6dcgmcl62q"; + }; + + buildInputs = [ SDL SDL_image SDL_ttf libpng zlib lua5 pkgconfig ]; + + preBuild = "cd src"; + + preInstall = '' mkdir -p "$out" ''; + + installPhase = ''make install prefix="$out"''; + + meta = { + description = "GrafX2 is a bitmap paint program inspired by the Amiga programs Deluxe Paint and Brilliance."; + homepage = http://code.google.co/p/grafx2/; + license = stdenv.lib.licenses.gpl2; + platforms = [ "x86_64-linux" "i686-linux" ]; + maintainers = [ stdenv.lib.maintainers.zoomulator ]; + }; +} diff --git a/pkgs/applications/graphics/mypaint/default.nix b/pkgs/applications/graphics/mypaint/default.nix index a59498b8f14..be8df8ef16d 100644 --- a/pkgs/applications/graphics/mypaint/default.nix +++ b/pkgs/applications/graphics/mypaint/default.nix @@ -1,5 +1,6 @@ -{ stdenv, fetchurl, gettext, glib, gtk, json_c, lcms2, libpng -, makeWrapper, pkgconfig, pygtk, python, pythonPackages, scons, swig +{ stdenv, fetchurl, gettext, glib, gtk, hicolor_icon_theme, json_c +, lcms2, libpng , makeWrapper, pkgconfig, pygtk, python, pythonPackages +, scons, swig }: stdenv.mkDerivation rec { @@ -11,18 +12,21 @@ stdenv.mkDerivation rec { sha256 = "0f7848hr65h909c0jkcx616flc0r4qh53g3kd1cgs2nr1pjmf3bq"; }; - buildInputs = [ + buildInputs = [ gettext glib gtk json_c lcms2 libpng makeWrapper pkgconfig pygtk python scons swig ]; - - propagatedBuildInputs = [ pythonPackages.numpy ]; + + propagatedBuildInputs = [ hicolor_icon_theme pythonPackages.numpy ]; buildPhase = "scons prefix=$out"; installPhase = '' scons prefix=$out install - wrapProgram $out/bin/mypaint --prefix PYTHONPATH : $PYTHONPATH + sed -i -e 's|/usr/bin/env python2.7|${python}/bin/python|' $out/bin/mypaint + wrapProgram $out/bin/mypaint \ + --prefix PYTHONPATH : $PYTHONPATH \ + --prefix XDG_DATA_DIRS ":" "${hicolor_icon_theme}/share" ''; meta = with stdenv.lib; { diff --git a/pkgs/applications/graphics/pencil/default.nix b/pkgs/applications/graphics/pencil/default.nix new file mode 100644 index 00000000000..737baf375d1 --- /dev/null +++ b/pkgs/applications/graphics/pencil/default.nix @@ -0,0 +1,33 @@ +{ stdenv, fetchurl, xulrunner }: + +stdenv.mkDerivation rec { + name = "pencil-2.0.5"; + + src = fetchurl { + url = "http://evoluspencil.googlecode.com/files/${name}.tar.gz"; + sha256 = "0rn5nb08p8wph5s5gajkil6y06zgrm86p4gnjdgv76czx1fqazm0"; + }; + + # Pre-built package + buildPhase = "true"; + + installPhase = '' + mkdir -p "$out" + cp -r usr/* "$out" + cp COPYING "$out/share/pencil" + sed -e "s|/usr/bin/xulrunner|${xulrunner}/bin/xulrunner|" \ + -e "s|/usr/share/pencil|$out/share/pencil|" \ + -i "$out/bin/pencil" + sed -e "s|/usr/bin/pencil|$out/bin/pencil|" \ + -e "s|Icon=.*|Icon=$out/share/pencil/skin/classic/icon.svg|" \ + -i "$out/share/applications/pencil.desktop" + ''; + + meta = with stdenv.lib; { + description = "GUI prototyping/mockup tool"; + homepage = http://pencil.evolus.vn/; + license = licenses.gpl2; # Commercial license is also available + maintainers = [ maintainers.bjornfor ]; + platforms = platforms.linux; + }; +} diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix index 10d92e4d517..41f4b4f0904 100644 --- a/pkgs/applications/misc/calibre/default.nix +++ b/pkgs/applications/misc/calibre/default.nix @@ -4,11 +4,11 @@ }: stdenv.mkDerivation rec { - name = "calibre-1.8.0"; + name = "calibre-1.13.0"; src = fetchurl { url = "mirror://sourceforge/calibre/${name}.tar.xz"; - sha256 = "0awh24n5bvypmiylngmz0w0126yz1jxlrjfy9b4w5aflg7vgr0qq"; + sha256 = "0j0l81jkjzd8n3ciqwxh8zxz945y594xjfsizp3cxjjfhj90aagj"; }; inherit python; diff --git a/pkgs/applications/misc/girara/default.nix b/pkgs/applications/misc/girara/default.nix index e112427126a..7af8cbeccc6 100644 --- a/pkgs/applications/misc/girara/default.nix +++ b/pkgs/applications/misc/girara/default.nix @@ -1,11 +1,11 @@ { stdenv, fetchurl, pkgconfig, gtk, gettext }: stdenv.mkDerivation rec { - name = "girara-0.1.5"; + name = "girara-0.1.9"; src = fetchurl { url = "http://pwmt.org/projects/girara/download/${name}.tar.gz"; - sha256 = "1hfi3jmx8ydvrqm3h6p6py2csavh7xx0223vxyca51kjl9mfnbld"; + sha256 = "1kd20dalnpy07hajv0rkmkbsym4bpfxh0gby7j2mvkvl5qr3vx70"; }; buildInputs = [ pkgconfig gtk gettext ]; diff --git a/pkgs/applications/misc/rxvt_unicode/default.nix b/pkgs/applications/misc/rxvt_unicode/default.nix index c05dd028eb3..640ace40277 100644 --- a/pkgs/applications/misc/rxvt_unicode/default.nix +++ b/pkgs/applications/misc/rxvt_unicode/default.nix @@ -38,13 +38,6 @@ stdenv.mkDerivation (rec { ln -s $out/{lib/urxvt,lib/perl5/site_perl} ''; - # we link the separate terminfo output to the main output - # as I don't think there's a usecase for wanting urxvt without its terminfo files - # and we don't want users to install them separately - postInstall = '' - ln -s $terminfo/share/terminfo $out/share - ''; - meta = { description = "A clone of the well-known terminal emulator rxvt"; homepage = "http://software.schmorp.de/pkg/rxvt-unicode.html"; diff --git a/pkgs/applications/misc/vifm/default.nix b/pkgs/applications/misc/vifm/default.nix index 7230e84601e..4af565d717a 100644 --- a/pkgs/applications/misc/vifm/default.nix +++ b/pkgs/applications/misc/vifm/default.nix @@ -2,14 +2,14 @@ let name = "vifm-${version}"; - version = "0.7.5"; + version = "0.7.6"; in stdenv.mkDerivation { inherit name; src = fetchurl { url="mirror://sourceforge/project/vifm/vifm/${name}.tar.bz2"; - sha256 ="1r1d92zrff94rfx011dw2qsgdwd2ksqlz15la74d6h7sfcsnyd01"; + sha256 ="03v50hmgfvrci5fz31zmklmp6ix7qpqnhvm6639wbk3g5mcrh5w6"; }; #phaseNames = ["doConfigure" "doMakeInstall"]; diff --git a/pkgs/applications/misc/vue/default.nix b/pkgs/applications/misc/vue/default.nix index c90e4d24f37..542f11f6e67 100644 --- a/pkgs/applications/misc/vue/default.nix +++ b/pkgs/applications/misc/vue/default.nix @@ -11,10 +11,10 @@ let (builtins.attrNames (builtins.removeAttrs x helperArgNames)); sourceInfo = rec { baseName="vue"; - version="3.1.2"; + version="3.2.2"; name="${baseName}-${version}"; - url="http://releases.atech.tufts.edu/vue/v${version}/VUE_3_1_2.zip"; - hash="0ga98gnp4qhcrb31cb8j0mwbrh6ym6hr4k5y4blxvyfff9c0vq47"; + url="releases.atech.tufts.edu/jenkins/job/VUE/64/deployedArtifacts/download/artifact.2"; + hash="0sb1kgan8fvph2cqfxk3906cwx5wy83zni2vlz4zzi6yg4zvfxld"; }; in rec { @@ -30,9 +30,8 @@ rec { phaseNames = ["doDeploy"]; doDeploy = a.fullDepEntry '' - unzip ${src} mkdir -p "$out"/{share/vue,bin} - cp VUE.jar "$out/share/vue/vue.jar" + cp ${src} "$out/share/vue/vue.jar" echo '#!${a.stdenv.shell}' >> "$out/bin/vue" echo '${a.jre}/bin/java -jar "'"$out/share/vue/vue.jar"'" "$@"' >> "$out/bin/vue" chmod a+x "$out/bin/vue" diff --git a/pkgs/applications/misc/xmobar/default.nix b/pkgs/applications/misc/xmobar/default.nix index 273998dde5d..7d4d2715d04 100644 --- a/pkgs/applications/misc/xmobar/default.nix +++ b/pkgs/applications/misc/xmobar/default.nix @@ -1,5 +1,5 @@ { cabal, filepath, libXrandr, mtl, parsec, regexCompat, stm, time -, utf8String, X11, X11Xft +, utf8String, wirelesstools, X11, X11Xft }: cabal.mkDerivation (self: { @@ -11,8 +11,8 @@ cabal.mkDerivation (self: { buildDepends = [ filepath mtl parsec regexCompat stm time utf8String X11 X11Xft ]; - extraLibraries = [ libXrandr ]; - configureFlags = "-fwith_xft"; + extraLibraries = [ libXrandr wirelesstools ]; + configureFlags = "-fwith_xft -fwith_iwlib"; meta = { homepage = "http://projects.haskell.org/xmobar/"; description = "A Minimalistic Text Based Status Bar"; diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix index e5eae771d8b..f3431f9480f 100644 --- a/pkgs/applications/misc/zathura/core/default.nix +++ b/pkgs/applications/misc/zathura/core/default.nix @@ -1,17 +1,15 @@ { stdenv, fetchurl, pkgconfig, gtk, girara, gettext, docutils, file, makeWrapper }: stdenv.mkDerivation rec { - - version = "0.2.2"; - + version = "0.2.5"; name = "zathura-core-${version}"; src = fetchurl { url = "http://pwmt.org/projects/zathura/download/zathura-${version}.tar.gz"; - sha256 = "1ja2j9ygymr259fxf02j1vkvalypac48gpadq8fn3qbclxxj61k5"; + sha256 = "1lw9q0x4b7x6z86hwgs93f8srimd0sj8fwg91185f63yz9g800fr"; }; - buildInputs = [ pkgconfig gtk girara gettext makeWrapper ]; + buildInputs = [ pkgconfig file gtk girara gettext makeWrapper ]; # Bug in zathura build system: we should remove empty manfiles in order them # to be compiled properly diff --git a/pkgs/applications/misc/zathura/default.nix b/pkgs/applications/misc/zathura/default.nix index 8bdc7865832..74288657fb3 100644 --- a/pkgs/applications/misc/zathura/default.nix +++ b/pkgs/applications/misc/zathura/default.nix @@ -3,13 +3,19 @@ rec { inherit (pkgs) stdenv; - zathura_core = callPackage ./core { }; + zathura_core = callPackage ./core { + gtk = pkgs.gtk3; + }; zathura_pdf_poppler = callPackage ./pdf-poppler { }; - zathura_djvu = callPackage ./djvu { }; + zathura_djvu = callPackage ./djvu { + gtk = pkgs.gtk3; + }; - zathura_ps = callPackage ./ps { }; + zathura_ps = callPackage ./ps { + gtk = pkgs.gtk3; + }; zathuraWrapper = stdenv.mkDerivation { diff --git a/pkgs/applications/misc/zathura/djvu/default.nix b/pkgs/applications/misc/zathura/djvu/default.nix index 9486acfef65..1a2347f2727 100644 --- a/pkgs/applications/misc/zathura/djvu/default.nix +++ b/pkgs/applications/misc/zathura/djvu/default.nix @@ -1,11 +1,11 @@ { stdenv, fetchurl, pkgconfig, gtk, zathura_core, girara, djvulibre, gettext }: stdenv.mkDerivation rec { - name = "zathura-djvu-0.2.1"; + name = "zathura-djvu-0.2.3"; src = fetchurl { url = "http://pwmt.org/projects/zathura/plugins/download/${name}.tar.gz"; - sha256 = "d8bb3c9e30244a0733e49740ee2dd099ce39fa16f2c320af27a0c09d9a25bcc3"; + sha256 = "12gd8kb0al5mknh4rlvxzgzwz3vhjggqjh8ws27phaq14paq4vn1"; }; buildInputs = [ pkgconfig djvulibre gettext zathura_core gtk girara ]; diff --git a/pkgs/applications/misc/zathura/pdf-poppler/default.nix b/pkgs/applications/misc/zathura/pdf-poppler/default.nix index faf4e49b968..71c418f168c 100644 --- a/pkgs/applications/misc/zathura/pdf-poppler/default.nix +++ b/pkgs/applications/misc/zathura/pdf-poppler/default.nix @@ -1,12 +1,12 @@ { stdenv, fetchurl, pkgconfig, zathura_core, girara, poppler, gettext }: stdenv.mkDerivation rec { - version = "0.2.2"; + version = "0.2.4"; name = "zathura-pdf-poppler-${version}"; src = fetchurl { url = "http://pwmt.org/projects/zathura/plugins/download/${name}.tar.gz"; - sha256 = "0px59f0bnmb9992n3c9iyzcwd6w7vg8ga069vc8qj4726ljml4c7"; + sha256 = "1x1n21naixb87g1knznjfjfibazzwbn1cv7d42kxgwlnf1p1wbzm"; }; buildInputs = [ pkgconfig poppler gettext zathura_core girara ]; diff --git a/pkgs/applications/misc/zathura/ps/default.nix b/pkgs/applications/misc/zathura/ps/default.nix index 7c0dd552a66..eef02001601 100644 --- a/pkgs/applications/misc/zathura/ps/default.nix +++ b/pkgs/applications/misc/zathura/ps/default.nix @@ -1,11 +1,11 @@ { stdenv, fetchurl, pkgconfig, gtk, zathura_core, girara, libspectre, gettext }: stdenv.mkDerivation rec { - name = "zathura-ps-0.2.0"; + name = "zathura-ps-0.2.2"; src = fetchurl { url = "http://pwmt.org/projects/zathura/plugins/download/${name}.tar.gz"; - sha256 = "717eda01213b162421b6b52f29d6b981edc302fddf351ccb2c093b6842751414"; + sha256 = "1a6ps5v1wk18qvslbkjln6w8wfzzr6fi13ls96vbdc03vdhn4m76"; }; buildInputs = [ pkgconfig libspectre gettext zathura_core gtk girara ]; diff --git a/pkgs/applications/networking/bittorrentsync/default.nix b/pkgs/applications/networking/bittorrentsync/default.nix index c2d2f28751a..895ebd7911b 100644 --- a/pkgs/applications/networking/bittorrentsync/default.nix +++ b/pkgs/applications/networking/bittorrentsync/default.nix @@ -14,9 +14,9 @@ let else if stdenv.system == "i686-linux" then "ld-linux.so.2" else throw "Bittorrent Sync for: ${stdenv.system} not supported!"; - version = "1.1.70"; - sha256 = if stdenv.system == "x86_64-linux" then "1hnyncq5439fxn1q8dkzcg2alxjkanr4q4pgqqf3nngz4cdar5vi" - else if stdenv.system == "i686-linux" then "1ijdmzl8bnb4k99vrjn5gd31hy64p9wiyxw5wc5gbpgap191h5i5" + version = "1.2.82"; + sha256 = if stdenv.system == "x86_64-linux" then "0cqrscav57xwz7rag6wy06xw6z7ca97xailprgg6jdjv4pnc91ra" + else if stdenv.system == "i686-linux" then "1b9rnfk0wkhj1zybvfqwgd9dcqnxwdnp7m0vf6lhrgi75cydj7is" else throw "Bittorrent Sync for: ${stdenv.system} not supported!"; in stdenv.mkDerivation { diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix index fa91a877fdc..87cdf673041 100644 --- a/pkgs/applications/networking/browsers/chromium/default.nix +++ b/pkgs/applications/networking/browsers/chromium/default.nix @@ -46,16 +46,17 @@ let prePatch = "patchShebangs ."; - patches = singleton ( - if versionOlder version "31.0.0.0" - then ./sandbox_userns_30.patch - else ./sandbox_userns_31.patch - ); + patches = singleton ./sandbox_userns_31.patch; postPatch = '' sed -i -r -e 's/-f(stack-protector)(-all)?/-fno-\1/' build/common.gypi + '' + (if versionOlder version "32.0.0.0" then '' sed -i -e 's|/usr/bin/gcc|gcc|' third_party/WebKit/Source/core/core.gypi - '' + optionalString useOpenSSL '' + '' else '' + sed -i -e 's|/usr/bin/gcc|gcc|' \ + third_party/WebKit/Source/build/scripts/scripts.gypi \ + third_party/WebKit/Source/build/scripts/preprocessor.pm + '') + optionalString useOpenSSL '' cat $opensslPatches | patch -p1 -d third_party/openssl/openssl ''; diff --git a/pkgs/applications/networking/browsers/chromium/sandbox_userns_30.patch b/pkgs/applications/networking/browsers/chromium/sandbox_userns_30.patch deleted file mode 100644 index 9a412352c52..00000000000 --- a/pkgs/applications/networking/browsers/chromium/sandbox_userns_30.patch +++ /dev/null @@ -1,293 +0,0 @@ -commit 41510de6ae32e6161073992bd1243f7f33148a06 -Author: aszlig -Date: Thu May 16 14:17:56 2013 +0200 - - zygote: Add support for user namespaces on Linux. - - The implementation is done by patching the Zygote host to execute the sandbox - binary with CLONE_NEWUSER and setting the uid and gid mapping so that the child - process is using uid 0 and gid 0 which map to the current user of the parent. - Afterwards, the sandbox will continue as if it was called as a setuid binary. - - In addition, this adds new_user_namespace as an option in process_util in order - to set the UID and GID mapping correctly. The reason for this is that just - passing CLONE_NEWUSER to clone_flags doesn't help in LaunchProcess(), because - without setting the mappings exec*() will clear the process's capability sets. - - If the kernel doesn't support unprivileged user namespaces and the sandbox - binary doesn't have the setuid flag, the Zygote main process will run without a - sandbox. This is to mimic the behaviour if no SUID sandbox binary path is set. - - Signed-off-by: aszlig - -diff --git a/base/process/launch.h b/base/process/launch.h -index 45b1053..ce71418 100644 ---- a/base/process/launch.h -+++ b/base/process/launch.h -@@ -51,6 +51,7 @@ struct LaunchOptions { - new_process_group(false) - #if defined(OS_LINUX) - , clone_flags(0) -+ , new_user_namespace(false) - #endif // OS_LINUX - #if defined(OS_CHROMEOS) - , ctrl_terminal_fd(-1) -@@ -125,6 +126,9 @@ struct LaunchOptions { - #if defined(OS_LINUX) - // If non-zero, start the process using clone(), using flags as provided. - int clone_flags; -+ -+ // If true, start the process in a new user namespace. -+ bool new_user_namespace; - #endif // defined(OS_LINUX) - - #if defined(OS_CHROMEOS) -diff --git a/base/process/launch_posix.cc b/base/process/launch_posix.cc -index 52e149c..312f835 100644 ---- a/base/process/launch_posix.cc -+++ b/base/process/launch_posix.cc -@@ -37,6 +37,13 @@ - #include "base/threading/platform_thread.h" - #include "base/threading/thread_restrictions.h" - -+#if defined(OS_LINUX) -+#include -+#if !defined(CLONE_NEWUSER) -+#define CLONE_NEWUSER 0x10000000 -+#endif -+#endif -+ - #if defined(OS_CHROMEOS) - #include - #endif -@@ -416,13 +423,23 @@ bool LaunchProcess(const std::vector& argv, - - pid_t pid; - #if defined(OS_LINUX) -- if (options.clone_flags) { -+ int map_pipe_fd[2]; -+ int flags = options.clone_flags; -+ -+ if (options.new_user_namespace) { -+ flags |= CLONE_NEWUSER; -+ if (pipe(map_pipe_fd) < 0) { -+ DPLOG(ERROR) << "user namespace pipe"; -+ return false; -+ } -+ } -+ -+ if (options.clone_flags || options.new_user_namespace) { - // Signal handling in this function assumes the creation of a new - // process, so we check that a thread is not being created by mistake - // and that signal handling follows the process-creation rules. -- RAW_CHECK( -- !(options.clone_flags & (CLONE_SIGHAND | CLONE_THREAD | CLONE_VM))); -- pid = syscall(__NR_clone, options.clone_flags, 0, 0, 0); -+ RAW_CHECK(!(flags & (CLONE_SIGHAND | CLONE_THREAD | CLONE_VM))); -+ pid = syscall(__NR_clone, flags, 0, 0, 0); - } else - #endif - { -@@ -440,6 +457,21 @@ bool LaunchProcess(const std::vector& argv, - } else if (pid == 0) { - // Child process - -+#if defined(OS_LINUX) -+ if (options.new_user_namespace) { -+ // Close the write end of the pipe so we get an EOF when the parent closes -+ // the FD. This is to avoid race conditions when the UID/GID mappings are -+ // written _after_ execvp(). -+ close(map_pipe_fd[1]); -+ -+ char dummy; -+ if (HANDLE_EINTR(read(map_pipe_fd[0], &dummy, 1)) != 0) { -+ RAW_LOG(ERROR, "Unexpected input in uid/gid mapping pipe."); -+ _exit(127); -+ } -+ } -+#endif -+ - // DANGER: fork() rule: in the child, if you don't end up doing exec*(), - // you call _exit() instead of exit(). This is because _exit() does not - // call any previously-registered (in the parent) exit handlers, which -@@ -555,6 +587,40 @@ bool LaunchProcess(const std::vector& argv, - _exit(127); - } else { - // Parent process -+#if defined(OS_LINUX) -+ if (options.new_user_namespace) { -+ // We need to write UID/GID mapping here to map the current user outside -+ // the namespace to the root user inside the namespace in order to -+ // correctly "fool" the child process. -+ char buf[256]; -+ int map_fd, map_len; -+ -+ snprintf(buf, sizeof(buf), "/proc/%d/uid_map", pid); -+ map_fd = open(buf, O_RDWR); -+ DPCHECK(map_fd >= 0); -+ snprintf(buf, sizeof(buf), "0 %d 1", geteuid()); -+ map_len = strlen(buf); -+ if (write(map_fd, buf, map_len) != map_len) { -+ RAW_LOG(WARNING, "Can't write to uid_map."); -+ } -+ close(map_fd); -+ -+ snprintf(buf, sizeof(buf), "/proc/%d/gid_map", pid); -+ map_fd = open(buf, O_RDWR); -+ DPCHECK(map_fd >= 0); -+ snprintf(buf, sizeof(buf), "0 %d 1", getegid()); -+ map_len = strlen(buf); -+ if (write(map_fd, buf, map_len) != map_len) { -+ RAW_LOG(WARNING, "Can't write to gid_map."); -+ } -+ close(map_fd); -+ -+ // Close the pipe on the parent, so the child can continue doing the -+ // execvp() call. -+ close(map_pipe_fd[1]); -+ } -+#endif -+ - if (options.wait) { - // While this isn't strictly disk IO, waiting for another process to - // finish is the sort of thing ThreadRestrictions is trying to prevent. -diff --git a/content/browser/zygote_host/zygote_host_impl_linux.cc b/content/browser/zygote_host/zygote_host_impl_linux.cc -index bb84e62..bce0d18 100644 ---- a/content/browser/zygote_host/zygote_host_impl_linux.cc -+++ b/content/browser/zygote_host/zygote_host_impl_linux.cc -@@ -119,25 +119,31 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) { - - sandbox_binary_ = sandbox_cmd.c_str(); - -- // A non empty sandbox_cmd means we want a SUID sandbox. -- using_suid_sandbox_ = !sandbox_cmd.empty(); -+ bool userns_sandbox = false; -+ const std::vector cmd_line_unwrapped(cmd_line.argv()); - -- if (using_suid_sandbox_) { -+ if (!sandbox_cmd.empty()) { - struct stat st; - if (stat(sandbox_binary_.c_str(), &st) != 0) { - LOG(FATAL) << "The SUID sandbox helper binary is missing: " - << sandbox_binary_ << " Aborting now."; - } - -- if (access(sandbox_binary_.c_str(), X_OK) == 0 && -- (st.st_uid == 0) && -- (st.st_mode & S_ISUID) && -- (st.st_mode & S_IXOTH)) { -+ if (access(sandbox_binary_.c_str(), X_OK) == 0) { -+ using_suid_sandbox_ = true; -+ - cmd_line.PrependWrapper(sandbox_binary_); - - scoped_ptr - sandbox_client(sandbox::SetuidSandboxClient::Create()); - sandbox_client->SetupLaunchEnvironment(); -+ -+ if (!((st.st_uid == 0) && -+ (st.st_mode & S_ISUID) && -+ (st.st_mode & S_IXOTH))) { -+ userns_sandbox = true; -+ sandbox_client->SetNoSuid(); -+ } - } else { - LOG(FATAL) << "The SUID sandbox helper binary was found, but is not " - "configured correctly. Rather than run without sandboxing " -@@ -161,7 +167,19 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) { - base::ProcessHandle process = -1; - base::LaunchOptions options; - options.fds_to_remap = &fds_to_map; -+ if (userns_sandbox) -+ options.new_user_namespace = true; - base::LaunchProcess(cmd_line.argv(), options, &process); -+ -+ if (process == -1 && userns_sandbox) { -+ LOG(ERROR) << "User namespace sandbox failed to start, running without " -+ << "sandbox! You need at least kernel 3.8.0 with CONFIG_USER_NS " -+ << "enabled in order to use the sandbox without setuid bit."; -+ using_suid_sandbox_ = false; -+ options.new_user_namespace = false; -+ base::LaunchProcess(cmd_line_unwrapped, options, &process); -+ } -+ - CHECK(process != -1) << "Failed to launch zygote process"; - - if (using_suid_sandbox_) { -diff --git a/content/zygote/zygote_main_linux.cc b/content/zygote/zygote_main_linux.cc -index 1f0e9f5..ade5aab 100644 ---- a/content/zygote/zygote_main_linux.cc -+++ b/content/zygote/zygote_main_linux.cc -@@ -420,6 +420,13 @@ static bool EnterSandbox(sandbox::SetuidSandboxClient* setuid_sandbox, - *has_started_new_init = true; - } - -+ // Don't set non-dumpable, as it causes trouble when the host tries to find -+ // the zygote process (XXX: Not quite sure why this happens with user -+ // namespaces). Fortunately, we also have the seccomp filter sandbox which -+ // should disallow the use of ptrace. -+ if (setuid_sandbox->IsNoSuid()) -+ return true; -+ - #if !defined(OS_OPENBSD) - // Previously, we required that the binary be non-readable. This causes the - // kernel to mark the process as non-dumpable at startup. The thinking was -diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc -index 34231d4..36e3201 100644 ---- a/sandbox/linux/suid/client/setuid_sandbox_client.cc -+++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc -@@ -166,6 +166,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const { - return env_->HasVar(kSandboxNETNSEnvironmentVarName); - } - -+bool SetuidSandboxClient::IsNoSuid() const { -+ return env_->HasVar(kSandboxNoSuidVarName); -+} -+ - bool SetuidSandboxClient::IsSandboxed() const { - return sandboxed_; - } -@@ -175,5 +179,9 @@ void SetuidSandboxClient::SetupLaunchEnvironment() { - SetSandboxAPIEnvironmentVariable(env_); - } - -+void SetuidSandboxClient::SetNoSuid() { -+ env_->SetVar(kSandboxNoSuidVarName, "1"); -+} -+ - } // namespace sandbox - -diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.h b/sandbox/linux/suid/client/setuid_sandbox_client.h -index a9f6536..2e8113a 100644 ---- a/sandbox/linux/suid/client/setuid_sandbox_client.h -+++ b/sandbox/linux/suid/client/setuid_sandbox_client.h -@@ -39,6 +39,8 @@ class SetuidSandboxClient { - bool IsInNewPIDNamespace() const; - // Did the setuid helper create a new network namespace ? - bool IsInNewNETNamespace() const; -+ // Is sandboxed without SUID binary ? -+ bool IsNoSuid() const; - // Are we done and fully sandboxed ? - bool IsSandboxed() const; - -@@ -46,6 +48,8 @@ class SetuidSandboxClient { - // helper. - void SetupLaunchEnvironment(); - -+ void SetNoSuid(); -+ - private: - // Holds the environment. Will never be NULL. - base::Environment* env_; -diff --git a/sandbox/linux/suid/common/sandbox.h b/sandbox/linux/suid/common/sandbox.h -index aad4ff8..bd710d5 100644 ---- a/sandbox/linux/suid/common/sandbox.h -+++ b/sandbox/linux/suid/common/sandbox.h -@@ -18,6 +18,7 @@ static const char kAdjustLowMemMarginSwitch[] = "--adjust-low-mem"; - - static const char kSandboxDescriptorEnvironmentVarName[] = "SBX_D"; - static const char kSandboxHelperPidEnvironmentVarName[] = "SBX_HELPER_PID"; -+static const char kSandboxNoSuidVarName[] = "SBX_NO_SUID"; - - static const long kSUIDSandboxApiNumber = 1; - static const char kSandboxEnvironmentApiRequest[] = "SBX_CHROME_API_RQ"; diff --git a/pkgs/applications/networking/browsers/chromium/sources.nix b/pkgs/applications/networking/browsers/chromium/sources.nix index aae71e8dfb6..8ee5752f4ac 100644 --- a/pkgs/applications/networking/browsers/chromium/sources.nix +++ b/pkgs/applications/networking/browsers/chromium/sources.nix @@ -1,18 +1,18 @@ # This file is autogenerated from update.sh in the same directory. { dev = { - version = "32.0.1671.3"; - url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-32.0.1671.3.tar.xz"; - sha256 = "0bv86ig3mrd95zh78880bcyh9b8w46s7slxq3mwwmrmqp0s8qaq0"; + version = "33.0.1712.4"; + url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-33.0.1712.4.tar.xz"; + sha256 = "1c1m0y3nnz2lclqi21j6hgqmb46p1hv7c22zz9fn7dax7jkimydk"; }; beta = { - version = "31.0.1650.34"; - url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-31.0.1650.34.tar.xz"; - sha256 = "0c73kvp09cmq4x42rcf45v0mnbyb8rcyi5i4pj0pvfn451vbngdq"; + version = "32.0.1700.19"; + url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-32.0.1700.19.tar.xz"; + sha256 = "0d0kgy160pyg472ka43gxk7n09pqhhs9nd93jyxrp9qsyllfc425"; }; stable = { - version = "30.0.1599.114"; - url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-30.0.1599.114.tar.xz"; - sha256 = "0q5pq8bj4y0c7hd121db1fa9g3apkpkhb6cf14ag7abgrda2pzw2"; + version = "31.0.1650.57"; + url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-31.0.1650.57.tar.xz"; + sha256 = "1xv7frf47hhvqm6f3n2l308yfrs4d8ri70q6pndx7hslhyiixzl9"; }; } diff --git a/pkgs/applications/networking/browsers/firefox/default.nix b/pkgs/applications/networking/browsers/firefox/default.nix index 45606c9af82..1f37911b832 100644 --- a/pkgs/applications/networking/browsers/firefox/default.nix +++ b/pkgs/applications/networking/browsers/firefox/default.nix @@ -15,12 +15,11 @@ assert stdenv.gcc ? libc && stdenv.gcc.libc != null; -let optional = stdenv.lib.optional; -in rec { +rec { - firefoxVersion = "25.0"; + firefoxVersion = "25.0.1"; - xulVersion = "25.0"; # this attribute is used by other packages + xulVersion = "25.0.1"; # this attribute is used by other packages src = fetchurl { @@ -30,7 +29,7 @@ in rec { # Fall back to this url for versions not available at releases.mozilla.org. "http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${firefoxVersion}/source/firefox-${firefoxVersion}.source.tar.bz2" ]; - sha1 = "854722e283659d2b6b2eacd38f757b3c5b63a448"; + sha1 = "592ebd242c4839ef0e18707a7e959d8bed2a98f3"; }; commonConfigureFlags = diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix index 99589a3d71b..17703b2b3fc 100644 --- a/pkgs/applications/networking/dropbox/default.nix +++ b/pkgs/applications/networking/dropbox/default.nix @@ -25,9 +25,9 @@ let else if stdenv.system == "i686-linux" then "ld-linux.so.2" else throw "Dropbox client for: ${stdenv.system} not supported!"; - version = "2.4.3"; - sha256 = if stdenv.system == "x86_64-linux" then "0g8iqgc18qbw8fvdjf0fhbal34rvwr5izrf5acfzqjg99dgih81r" - else if stdenv.system == "i686-linux" then "1nhmk319whj6cil6wg9hrfln9bxin3fnf6sxb0zg2ycfpnnqi0la" + version = "2.4.7"; + sha256 = if stdenv.system == "x86_64-linux" then "08fh0zx9q83dvivnbx5zr1cwb69ihhlx9mkbd3ikynk1wd8df8n8" + else if stdenv.system == "i686-linux" then "0rhblpahg2axglpi8iavsglffw83rj71qy113wj2dh6q72124j2h" else throw "Dropbox client for: ${stdenv.system} not supported!"; # relative location where the dropbox libraries are stored diff --git a/pkgs/applications/networking/feedreaders/newsbeuter/default.nix b/pkgs/applications/networking/feedreaders/newsbeuter/default.nix index 3bca5cc91da..029a6f8e633 100644 --- a/pkgs/applications/networking/feedreaders/newsbeuter/default.nix +++ b/pkgs/applications/networking/feedreaders/newsbeuter/default.nix @@ -2,11 +2,11 @@ , gettext, libiconvOrEmpty, makeWrapper, perl }: stdenv.mkDerivation rec { - name = "newsbeuter-2.6"; + name = "newsbeuter-2.7"; src = fetchurl { url = "http://www.newsbeuter.org/downloads/${name}.tar.gz"; - sha256 = "1hywz5206k0ykjklkjvnfy9fm4jfv9phz8dkzzwhfcjvqv9zv29i"; + sha256 = "0flhzzlbdirjmrq738gmcxqqnifg3kb7plcwqcxshpizmjkhswp6"; }; buildInputs diff --git a/pkgs/applications/networking/feedreaders/newsbeuter/dev.nix b/pkgs/applications/networking/feedreaders/newsbeuter/dev.nix new file mode 100644 index 00000000000..17e97d92b89 --- /dev/null +++ b/pkgs/applications/networking/feedreaders/newsbeuter/dev.nix @@ -0,0 +1,45 @@ +{ stdenv, fetchgit, sqlite, curl, pkgconfig, libxml2, stfl, json-c-0-11, ncurses +, gettext, libiconvOrEmpty, makeWrapper, perl }: + +stdenv.mkDerivation rec { + name = "newsbeuter-dev-20131118"; + + src = fetchgit { + url = "https://github.com/akrennmair/newsbeuter.git"; + rev = "18b73f7d44a99a698d4878fe7d226f55842132c2"; + }; + + buildInputs + # use gettext instead of libintlOrEmpty so we have access to the msgfmt + # command + = [ pkgconfig sqlite curl libxml2 stfl json-c-0-11 ncurses gettext perl ] + ++ libiconvOrEmpty + ++ stdenv.lib.optional stdenv.isDarwin makeWrapper; + + preBuild = '' + sed -i -e 104,108d config.sh + sed -i "1 s%^.*$%#!${perl}/bin/perl%" txt2h.pl + export LDFLAGS=-lncursesw + ''; + + NIX_CFLAGS_COMPILE = + "-I${libxml2}/include/libxml2 -I${json-c-0-11}/include/json-c"; + + NIX_LDFLAGS = "-lsqlite3 -lcurl -lxml2 -lstfl -ljson"; + + installPhase = '' + DESTDIR=$out prefix=\"\" make install + '' + stdenv.lib.optionalString stdenv.isDarwin '' + for prog in $out/bin/*; do + wrapProgram "$prog" --prefix DYLD_LIBRARY_PATH : "${stfl}/lib" + done + ''; + + meta = with stdenv.lib; { + homepage = http://www.newsbeuter.org; + description = "An open-source RSS/Atom feed reader for text terminals"; + maintainers = with maintainers; [ lovek323 ]; + license = licenses.mit; + platforms = platforms.unix; + }; +} diff --git a/pkgs/applications/networking/instant-messengers/fuze/default.nix b/pkgs/applications/networking/instant-messengers/fuze/default.nix new file mode 100644 index 00000000000..9ccada87fe2 --- /dev/null +++ b/pkgs/applications/networking/instant-messengers/fuze/default.nix @@ -0,0 +1,53 @@ +{ stdenv, fetchurl, dpkg, openssl, alsaLib, libXext, libXfixes, libXrandr +, libjpeg, curl, libX11, libXmu, libXv, libXtst, qt4, mesa, zlib +, gnome, libidn, rtmpdump, c-ares, openldap, makeWrapper, cacert +}: +assert stdenv.system == "x86_64-linux"; +let + curl_custom = + stdenv.lib.overrideDerivation curl (args: { + configureFlags = args.configureFlags ++ ["--with-ca-bundle=${cacert}/etc/ca-bundle.crt"] ; + } ); +in +stdenv.mkDerivation { + name = "fuze-1.0.5"; + src = fetchurl { + url = http://apt.fuzebox.com/apt/pool/lucid/main/f/fuzelinuxclient/fuzelinuxclient_1.0.5.lucid_amd64.deb; + sha256 = "0gvxc8qj526cigr1lif8vdn1aawj621camkc8kvps23r7zijhnqv"; + }; + buildInputs = [ dpkg makeWrapper ]; + libPath = + stdenv.lib.makeLibraryPath [ + openssl alsaLib libXext libXfixes libXrandr libjpeg curl_custom + libX11 libXmu libXv qt4 libXtst mesa stdenv.gcc.gcc zlib + gnome.GConf libidn rtmpdump c-ares openldap + ]; + buildCommand = '' + dpkg-deb -x $src . + mkdir -p $out/lib $out/bin + cp -R usr/lib/fuzebox $out/lib + + patchelf \ + --set-interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \ + --set-rpath $out/lib/fuzebox:$libPath \ + $out/lib/fuzebox/FuzeLinuxApp + + wrapProgram $out/lib/fuzebox/FuzeLinuxApp --prefix LD_LIBRARY_PATH : $libPath + for f in $out/lib/fuzebox/*.so.*; do + patchelf \ + --set-rpath $out/lib/fuzebox:$libPath \ + $f + done + + ln -s ${openssl}/lib/libssl.so.1.0.0 $out/lib/fuzebox/libssl.so.0.9.8 + ln -s ${openssl}/lib/libcrypto.so.1.0.0 $out/lib/fuzebox/libcrypto.so.0.9.8 + + ln -s $out/lib/fuzebox/FuzeLinuxApp $out/bin/fuze + ''; + + meta = { + description = "Fuze for Linux"; + homepage = http://www.fuzebox.com; + license = "unknown"; + }; +} diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix index 108e549d01f..f3a88dee2cf 100644 --- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix +++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix @@ -1,23 +1,34 @@ -{ stdenv, fetchurl, zlib, glib, libpng, freetype, xorg, fontconfig, alsaLib }: +{ stdenv, fetchurl, zlib, glib, libpng, freetype, xorg, fontconfig, alsaLib, + qt4, pulseaudio ? null }: let + version = "3.0.13.1"; + + arch = if stdenv.is64bit then "amd64" else "x86"; + libDir = if stdenv.is64bit then "lib64" else "lib"; deps = [ zlib glib libpng freetype xorg.libSM xorg.libICE xorg.libXrender xorg.libXrandr xorg.libXfixes xorg.libXcursor xorg.libXinerama - fontconfig xorg.libXext xorg.libX11 alsaLib + fontconfig xorg.libXext xorg.libX11 alsaLib qt4 pulseaudio ]; in stdenv.mkDerivation { - name = "teamspeak-client-3.0.0-beta35"; + name = "teamspeak-client-${version}"; src = fetchurl { - url = http://ftp.4players.de/pub/hosted/ts3/releases/beta-35/TeamSpeak3-Client-linux_amd64-3.0.0-beta35.run; - sha256 = "0vygsvjs11lr5lv4x7awv7hvkycvmm9qs2vklfjs91w3f434cmrx"; + urls = [ + "http://dl.4players.de/ts/releases/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run" + "http://teamspeak.gameserver.gamed.de/ts3/releases/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run" + "http://files.teamspeak-services.com/releases/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run" + ]; + sha256 = if stdenv.is64bit + then "0mj8vpsnv906n3wgjwhiby5gk26jr5jbd94swmsf0s9kqwhsj6i1" + else "1hlw7lc0nl1mrsyd052s6ws64q5aabnw6qpv8mrdxb3hyp7g2qh1"; }; unpackPhase = @@ -28,22 +39,27 @@ stdenv.mkDerivation { buildPhase = '' - ls -l - for i in ts3client_linux_*; do - echo "patching $i..." - patchelf \ - --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \ - --set-rpath ${stdenv.lib.makeLibraryPath deps}:$(cat $NIX_GCC/nix-support/orig-gcc)/${libDir} \ - --force-rpath \ - $i - done + mv ts3client_linux_${arch} ts3client + echo "patching ts3client..." + patchelf \ + --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \ + --set-rpath ${stdenv.lib.makeLibraryPath deps}:$(cat $NIX_GCC/nix-support/orig-gcc)/${libDir} \ + --force-rpath \ + ts3client ''; - installPhase = '' + # Delete unecessary libraries - these are provided by nixos. + rm *.so.* + + # Install files. mkdir -p $out/lib/teamspeak mv * $out/lib/teamspeak/ + + # Make a symlink to the binary from bin. + mkdir -p $out/bin/ + ln -s $out/lib/teamspeak/ts3client $out/bin/ts3client ''; dontStrip = true; @@ -53,6 +69,7 @@ stdenv.mkDerivation { description = "The TeamSpeak voice communication tool"; homepage = http://teamspeak.com/; license = "http://www.teamspeak.com/?page=downloads&type=ts3_linux_client_latest"; + platforms = stdenv.lib.platforms.linux; }; } diff --git a/pkgs/applications/networking/jmeter/default.nix b/pkgs/applications/networking/jmeter/default.nix index c3212f6aa56..ddb7b63fc6f 100644 --- a/pkgs/applications/networking/jmeter/default.nix +++ b/pkgs/applications/networking/jmeter/default.nix @@ -1,10 +1,10 @@ { fetchurl, stdenv, ant }: stdenv.mkDerivation rec { - name = "jmeter-2.9"; + name = "jmeter-2.10"; src = fetchurl { - url = "http://ftp.unicamp.br/pub/apache//jmeter/binaries/apache-jmeter-2.9.tgz"; - sha256 = "14r3zn910m97jqrf6k5c4lwy214snaap2242qg76h65zk9qr20ni"; + url = "http://ftp.unicamp.br/pub/apache//jmeter/binaries/apache-${name}.tgz"; + sha256 = "1ygm0h02sllh4mfl5imj46v80wnbs1x7n88gfjm523ixmgsa0fvy"; }; installPhase = '' diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix index fa006dc5f0d..97722a51bb5 100644 --- a/pkgs/applications/networking/mailreaders/mutt/default.nix +++ b/pkgs/applications/networking/mailreaders/mutt/default.nix @@ -15,22 +15,16 @@ assert sslSupport -> openssl != null; assert saslSupport -> cyrus_sasl != null; let - gpgmePatch = fetchurl { - # Solution for gpgme >= 1.2: http://dev.mutt.org/trac/ticket/3300 - url = "http://dev.mutt.org/trac/raw-attachment/ticket/3300/mutt-1.5.21-gpgme-init.patch"; - sha256 = "1qa1c8gns4q3as1h2lk3x4di2k3hr804ar7xlc6xh9r0zjhzmlk4"; - }; + version = "1.5.22"; in stdenv.mkDerivation rec { - name = "mutt-1.5.21"; + name = "mutt-${version}"; src = fetchurl { url = "ftp://ftp.mutt.org/mutt/devel/${name}.tar.gz"; - sha256 = "1864cwz240gh0zy56fb47qqzwyf6ghg01037rb4p2kqgimpg6h91"; + sha256 = "19zk81spnb0gc8y5mwmcfn33g77wv1xz5bmgic8aan07xn8fislg"; }; - patches = [ (if gpgmeSupport then gpgmePatch else null) ]; - buildInputs = [ ncurses which perl (if headerCache then gdbm else null) @@ -58,8 +52,12 @@ stdenv.mkDerivation rec { (if gpgmeSupport then "--enable-gpgme" else "--disable-gpgme") ]; - meta = { + meta = with stdenv.lib; { + description = "A small but very powerful text-based mail client"; homepage = http://www.mutt.org; + license = "GPLv2+"; + platforms = platforms.unix; + maintainers = with maintainers; [ the-kenny ]; }; } diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix index ebab3a42af6..5797354d33b 100644 --- a/pkgs/applications/networking/mailreaders/notmuch/default.nix +++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix @@ -3,11 +3,11 @@ }: stdenv.mkDerivation rec { - name = "notmuch-0.15.2"; + name = "notmuch-0.16"; src = fetchurl { url = "http://notmuchmail.org/releases/${name}.tar.gz"; - sha256 = "03cwylm0y9xld0hn753v0hn62f96nagdmzxv8jlz8vdbh9iszs56"; + sha256 = "0i7k85lfp9l0grmq7cvai2f3pw15jcrhcp96mmamr15y2pn2syg7"; }; buildInputs = [ bash emacs gdb glib gmime gnupg pkgconfig talloc xapian ]; diff --git a/pkgs/applications/networking/newsreaders/liferea/default.nix b/pkgs/applications/networking/newsreaders/liferea/default.nix index 55e0ed88814..093b801401d 100644 --- a/pkgs/applications/networking/newsreaders/liferea/default.nix +++ b/pkgs/applications/networking/newsreaders/liferea/default.nix @@ -18,6 +18,9 @@ stdenv.mkDerivation rec { libnotify ]; + preFixup = '' + rm $out/share/icons/hicolor/icon-theme.cache''; + meta = { description = "A GTK-based news feed agregator"; homepage = http://lzone.de/liferea/; diff --git a/pkgs/applications/networking/remote/teamviewer/8.nix b/pkgs/applications/networking/remote/teamviewer/8.nix index 8113e33e0a7..ca938c08653 100644 --- a/pkgs/applications/networking/remote/teamviewer/8.nix +++ b/pkgs/applications/networking/remote/teamviewer/8.nix @@ -1,26 +1,20 @@ -{ stdenv, fetchurl, libX11, libXtst, libXext, libXdamage, libXfixes, wine, makeWrapper -, bash }: +{ stdenv, fetchurl, libX11, libXtst, libXext, libXdamage, libXfixes, wineUnstable, makeWrapper, libXau +, bash, patchelf }: -# Work in progress. - -# It doesn't want to start unless teamviewerd is running as root. -# I haven't tried to make the daemon run. - -assert stdenv.system == "i686-linux"; let - topath = "${wine}/bin"; + topath = "${wineUnstable}/bin"; toldpath = stdenv.lib.concatStringsSep ":" (map (x: "${x}/lib") - [ stdenv.gcc.gcc libX11 libXtst libXext libXdamage libXfixes wine ]); + [ stdenv.gcc.gcc libX11 libXtst libXext libXdamage libXfixes wineUnstable ]); in stdenv.mkDerivation { name = "teamviewer-8.0.17147"; src = fetchurl { url = "http://download.teamviewer.com/download/teamviewer_linux_x64.deb"; - sha256 = "01iynk954pphl5mq4avs843xyzvdfzng1lpsy7skgwvw0k9cx5ab"; + sha256 = "0s5m15f99rdmspzwx3gb9mqd6jx1bgfm0d6rfd01k9rf7gi7qk0k"; }; - buildInputs = [ makeWrapper ]; + buildInputs = [ makeWrapper patchelf ]; unpackPhase = '' ar x $src @@ -36,9 +30,13 @@ stdenv.mkDerivation { #!${bash}/bin/sh export LD_LIBRARY_PATH=${toldpath}\''${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH} export PATH=${topath}\''${PATH:+:\$PATH} - $out/share/teamviewer8/tv_bin/script/teamviewer + $out/share/teamviewer8/tv_bin/script/teamviewer "\$@" EOF chmod +x $out/bin/teamviewer + + patchelf --set-rpath "${stdenv.gcc.gcc}/lib64:${stdenv.gcc.gcc}/lib:${libX11}/lib:${libXext}/lib:${libXau}/lib:${libXdamage}/lib:${libXfixes}/lib" $out/share/teamviewer8/tv_bin/teamviewerd + patchelf --set-interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" $out/share/teamviewer8/tv_bin/teamviewerd + ln -s $out/share/teamviewer8/tv_bin/teamviewerd $out/bin/ ''; meta = { diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix index 599229753b5..7e5fdc6ccd3 100644 --- a/pkgs/applications/networking/sniffers/wireshark/default.nix +++ b/pkgs/applications/networking/sniffers/wireshark/default.nix @@ -4,14 +4,14 @@ , makeDesktopItem }: -let version = "1.8.7"; in +let version = "1.8.11"; in stdenv.mkDerivation { name = "wireshark-${version}"; src = fetchurl { url = "mirror://sourceforge/wireshark/wireshark-${version}.tar.bz2"; - sha256 = "0hm8zisy5dg7sfhh7rvgnpffq2qcw0syd8k5kns8j0j13sf44zjw"; + sha256 = "1nwgizs9z1dalicpp2fd9pqafidy49j0v3d1rml0spfqrkbjpfpw"; }; buildInputs = diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix index eddaf8f33e7..b399c80ebff 100644 --- a/pkgs/applications/office/gnucash/default.nix +++ b/pkgs/applications/office/gnucash/default.nix @@ -1,7 +1,7 @@ { fetchurl, stdenv, pkgconfig, libxml2, gconf, glib, gtk, libgnomeui, libofx , libgtkhtml, gtkhtml, libgnomeprint, goffice, enchant, gettext, libbonoboui , intltool, perl, guile, slibGuile, swig, isocodes, bzip2, makeWrapper, libglade -, libgsf, libart_lgpl +, libgsf, libart_lgpl, perlPackages }: /* If you experience GConf errors when running GnuCash on NixOS, see @@ -21,23 +21,31 @@ stdenv.mkDerivation rec { pkgconfig libxml2 gconf glib gtk libgnomeui libgtkhtml gtkhtml libgnomeprint goffice enchant gettext intltool perl guile slibGuile swig isocodes bzip2 makeWrapper libofx libglade libgsf libart_lgpl + perlPackages.DateManip perlPackages.FinanceQuote ]; configureFlags = "CFLAGS=-O3 CXXFLAGS=-O3 --disable-dbi --enable-ofx"; postInstall = '' - sed -i $out/bin/update-gnucash-gconf \ + # Auto-updaters don't make sense in Nix. + rm $out/bin/gnc-fq-update + + sed -i $out/bin/update-gnucash-gconf \ -e 's|--config-source=[^ ]* --install-schema-file|--makefile-install-rule|' - for prog in "$out/bin/"* + + for prog in $(echo "$out/bin/"*) do + # Don't wrap the gnc-fq-* scripts, since gnucash calls them as + # "perl