xdg-dbus-proxy path is hardcoded in the common.h file in the firejail
source code. if this binary is not found, dbus filtering capabilities
of firejail get limited i.e. you can only entirely disable or entirely
enable dbus communication.
See https://www.redhat.com/sysadmin/fedora-31-control-group-v2 for
details on why this is desirable, and how it impacts containers.
Users that need to keep using the old cgroup hierarchy can re-enable it
by setting `systemd.unifiedCgroupHierarchy` to `false`.
Well-known candidates not supporting that hierarchy, like docker and
hidepid=… will disable it automatically.
Fixes#73800
We currently build CONFIG_IPV6=m.
This seems to be not really well-supported in mainline kernels - see
https://lore.kernel.org/netdev/20201115224509.2020651-1-flokli@flokli.de/T/#u
Compiling it as a module doesn't give too much benefit - even for people
who did explicitly set `enableIPv6` to false, the `ipv6` module was
still loaded, as soon as another module was loaded that requires it
(bridge,br_netfilter,wireguard,ip6table_mangle,sctp,…).
By compiling it in, we only loose the possibility to not add it to
`boot.kernelModules` anymore (as it's part of the kernel directly). The
space savings are negligible.
People wanting to disable IPv6 still get the appropriate sysctls and
options set (while having the kernel code loaded), nothing is really
changing here.
Patch copied from https://github.com/archlinux/svntogit-packages/blob/packages/wireguard-dkms/trunk/lts.diff
This fixes:
```
In file included from <command-line>:
/build/source/src/compat/compat-asm.h:44: warning: "SYM_FUNC_START" redefined
44 | #define SYM_FUNC_START ENTRY
|
In file included from /build/source/src/compat/compat-asm.h:9,
from <command-line>:
/nix/store/cz60577g5hwk78c2z7rhxl21bklaqr0d-linux-5.4.77-dev/lib/modules/5.4.77-hardened/source/include/linux/linkage.h:218: note: this is the location of the previous definition
218 | #define SYM_FUNC_START(name) \
|
In file included from <command-line>:
/build/source/src/compat/compat-asm.h:45: warning: "SYM_FUNC_END" redefined
45 | #define SYM_FUNC_END ENDPROC
|
In file included from /build/source/src/compat/compat-asm.h:9,
from <command-line>:
/nix/store/cz60577g5hwk78c2z7rhxl21bklaqr0d-linux-5.4.77-dev/lib/modules/5.4.77-hardened/source/include/linux/linkage.h:265: note: this is the location of the previous definition
265 | #define SYM_FUNC_END(name) \
|
/build/source/src/crypto/zinc/blake2s/blake2s-x86_64.S: Assembler messages:
/build/source/src/crypto/zinc/blake2s/blake2s-x86_64.S:50: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/blake2s/blake2s-x86_64.S:176: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/blake2s/blake2s-x86_64.S:180: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/blake2s/blake2s-x86_64.S:257: Error: invalid character '(' in mnemonic
make[3]: *** [/nix/store/cz60577g5hwk78c2z7rhxl21bklaqr0d-linux-5.4.77-dev/lib/modules/5.4.77-hardened/source/scripts/Makefile.build:348: /build/source/src/crypto/zinc/blake2s/blake2s-x86_64.o] Error 1
make[3]: *** Waiting for unfinished jobs....
In file included from <command-line>:
/build/source/src/compat/compat-asm.h:44: warning: "SYM_FUNC_START" redefined
44 | #define SYM_FUNC_START ENTRY
|
In file included from /build/source/src/compat/compat-asm.h:9,
from <command-line>:
/nix/store/cz60577g5hwk78c2z7rhxl21bklaqr0d-linux-5.4.77-dev/lib/modules/5.4.77-hardened/source/include/linux/linkage.h:218: note: this is the location of the previous definition
218 | #define SYM_FUNC_START(name) \
|
In file included from <command-line>:
/build/source/src/compat/compat-asm.h:45: warning: "SYM_FUNC_END" redefined
45 | #define SYM_FUNC_END ENDPROC
|
In file included from /build/source/src/compat/compat-asm.h:9,
from <command-line>:
/nix/store/cz60577g5hwk78c2z7rhxl21bklaqr0d-linux-5.4.77-dev/lib/modules/5.4.77-hardened/source/include/linux/linkage.h:265: note: this is the location of the previous definition
265 | #define SYM_FUNC_END(name) \
|
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S: Assembler messages:
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:123: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:185: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:187: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:319: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:1016: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:1616: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:1620: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:1810: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:1812: Error: invalid character '(' in mnemonic
/build/source/src/crypto/zinc/chacha20/chacha20-x86_64.S:1959: Error: invalid character '(' in mnemonic
make[3]: *** [/nix/store/cz60577g5hwk78c2z7rhxl21bklaqr0d-linux-5.4.77-dev/lib/modules/5.4.77-hardened/source/scripts/Makefile.build:348: /build/source/src/crypto/zinc/chacha20/chacha20-x86_64.o] Error 1
make[2]: *** [/nix/store/cz60577g5hwk78c2z7rhxl21bklaqr0d-linux-5.4.77-dev/lib/modules/5.4.77-hardened/source/Makefile:1729: /build/source/src] Error 2
make[1]: *** [/nix/store/cz60577g5hwk78c2z7rhxl21bklaqr0d-linux-5.4.77-dev/lib/modules/5.4.77-hardened/source/Makefile:179: sub-make] Error 2
make: *** [Makefile:26: module] Error 2
builder for '/nix/store/hll3sjyrwa55arzlsxnbacqdd8s842l1-wireguard-1.0.20200908.drv' failed with exit code 2
```
sudo the package is not suid, so remove it from the PATH. Extend
PATH with $PATH to fetch sudo from the outer PATH. Move the generation
of `path` in to Nix, so the sed expression can use single quotes,
which prevents $PATH being interpolated at build-time.
This makes curl optional if both remote and importd are disabled, and
makes some assertions more robust by switching from curl.dev != null to
lib.getDev curl != null.
upstreams TODO mentions iptables-dev (libiptc) is also used for nspawn,
but it seems like it only makes use of this via networkd anyways (or
does these days) - at least systemdMinimal compiles successfully without
iptables in the build closure.
This was only used to patch a circular output reference from lib to out
on aarch64, but was removed in b68bddfbda,
This commit forgot to remove perl, so remove it now.
This was introduced in https://github.com/NixOS/nixpkgs/pull/99621, but
didn't follow the process documented in
pkgs/os-specific/linux/systemd/default.nix, namely, the `git am` and
`git format-patch` workflow, which caused
`0019-revert-get-rid-of-seat_can_multi_session.patch` to not apply with
`git am` due to missing authorship information.
I did apply this patch manually, and copied authorship information from
4e384ddc11.
I made a mistake merge. Reverting it in c778945806 undid the state
on master, but now I realize it crippled the git merge mechanism.
As the merge contained a mix of commits from `master..staging-next`
and other commits from `staging-next..staging`, it got the
`staging-next` branch into a state that was difficult to recover.
I reconstructed the "desired" state of staging-next tree by:
- checking out the last commit of the problematic range: 4effe769e2
- `git rebase -i --preserve-merges a8a018ddc0` - dropping the mistaken
merge commit and its revert from that range (while keeping
reapplication from 4effe769e2)
- merging the last unaffected staging-next commit (803ca85c20)
- fortunately no other commits have been pushed to staging-next yet
- applying a diff on staging-next to get it into that state
This reverts commit c778945806.
I believe this is exactly what brings the staging branch into
the right shape after the last merge from master (through staging-next);
otherwise part of staging changes would be lost
(due to being already reachable from master but reverted).
This reverts commit fb6d63f3fd.
I really hope this finally fixes#99236: evaluation on Hydra.
This time I really did check basically the same commit on Hydra:
https://hydra.nixos.org/eval/1618011
Right now I don't have energy to find what exactly is wrong in the
commit, and it doesn't seem important in comparison to nixos-unstable
channel being stuck on a commit over one week old.
Related:
- 9fc5e7e473
- 593e11fd94
- 508ae42a0f
Since the last time I ran this script, the Repology API changed, so I had to
adapt the script used in the previous PR. The new API should be more robust, so
overall this is a positive (no more grepping the error messages for our relevant
data but just a nice json structure).
Here's the new script I used:
```sh
curl https://repology.org/api/v1/repository/nix_unstable/problems \
| jq -r '.[] | select(.type == "homepage_permanent_https_redirect") | .data | "s@\(.url)@\(.target)@"' \
| sort | uniq | tee script.sed
find -name '*.nix' | xargs -P4 -- sed -f script.sed -i
```
I will also add this script to `maintainers/scripts`.
Update to latest stable version. Changes:
d0f0f048ec sd-path: use ROOTPREFIX without suffixed slash
e662cf6d51 hashmap: make sure to initialize shared hash key atomically
da310c6b45 socket: downgrade log warnings about inability to set socket buffer sizes
ab6fcd9135 core: fix securebits setting
4f6925484d capability-util: add new function for raising setpcap
771436884d network: do not add prefix to RA if radv is not configured
fb2afc5f30 man: document the random delay of persistent timers
b2006ddc8f test-network: add test for ENOBUFS issue #17012
8758580ef5 backlight: do not claim that ID_BACKLIGHT_CLAMP= property is not set
57fc184a6c fs-util,tmpfiles: fix error handling of fchmod_opath()
db0f031e70 bootctl: don't accidentally propagate errors in "bootctl status"
3e2c806681 ethtool-util: don't pass error value that isn't used to log_syntax
b671730edb network: don't fail on various config parse errors
0ad86030c5 man: document that sd_bus_message_close_container() may only be called at end of container
f3da018017 cryptsetup: Fix null pointer dereference (#16987)
6f65eaf9c2 core: fix set keep caps for ambient capabilities
08338a234e core: fix comments on ambient capabilities
f0e6d9876d network: make log_link_error() or friends return void
35766dc61b core: make log_unit_error() or friends return void
3ed10b2ee8 core/slice: explicitly specify return value
2f6406914b udev: do not discard const qualifier
07671aa4cc sd-device: make log_device_error() or friends return void
d4bea73972 udev: explicitly specify return value
7db399be1e udev: return negative errno for invalid EVDEV_ABS_XXX= property
8c8d188e85 udev: make log_rule_error() or friends return void
4921375fd3 socket: fix copy/paste error
0f7fd97749 udev: warn if failed to set buffer size for device monitor
fc763d38d8 network: increase receive buffer size for device monitor
3bf7797f1f network: do not start device monitor if /sys is read-only
ebc0729c6a network: honor the buffer size specified in networkd.socket
ef3d2e178b core/socket: use fd_set_{rcv,snd}buf()
5dd4cc4b10 sd-device-monitor: use fd_set_rcvbuf()
fe9b92e566 util: introduce fd_set_{snd,rcv}buf()
4dcae66688 util: try to set with SO_{RCV,SND}BUFFORCE when requested size is larger than the kernel limit
4b6b523946 util: refuse to set too large value for socket buffer size
b4be8edb45 network: ignore error on increasing netlink receive buffer size
5ce47fb491 tree-wide: if get_block_device() returns zero devno, check for it in all cases
8ea6ec18e7 btrfs: if BTRFS_IOC_DEV_INFO returns /dev/root generate a friendly error message
e1ff4947d2 basic/log: make log_{info,warning,...} return void
8019995e9a tree-wide: correct cases where return log_{error,warning} is used without value
932f4c3e8b test-execute/exec-dynamicuser-statedir.service: fix quoting
16b9426f70 man: fix quickhelp listing in sysusers.d(5)
bde903d9e9 network: fix NDisc handling for the case when multiple routers exist
c965063b64 network: expose route_{hash,compare}_func()
6d24a40669 network: expose address_{hash,compare}_func()
054838a2e0 util: expose in6_addr_{hash,compare}_func()
58bd4a70de network: fixes gateway assignment through DHCPv4
8ad5382fe3 bash-completion: resolvectl: support 'log-level' command
a98bd75072 resolvectl: add 'log-level' to help message
78262fe807 core/socket: we may get ENOTCONN from socket_instantiate_service()
fecb3f00c4 homed: remember the secret even when the for_state is FIXATING_FOR_ACQUIRE
- This is fetched from a different URL, so allow passing that explicitly.
- There also isn't an nvidia-persistenced or nvidia-settings release for
this version, so use 450.57 instead. Also implement passing
persistenced and settings version explicitly.
Co-authored-by: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
required a bit of an overhaul to ensure we're compiling against *this*
kernel's headers, not those in glibc which are presumably from some other
random kernel version.
would be nice to update to a more recent version, the build of this tool
reportedly got broken soon after this release.
Debian has yanked the upstream tarball we use to get default.script. We
could simply bump the version number to get the new tarball, but to
avoid the problem in the future, we should instead fetch it from git.
This bumps systemd to the latest stable maintenance release.
- dc2e82af33 core: create per-user inaccessible node from the service manager
- 0b3c497347 nspawn,pid1: pass "inaccessible" nodes from cntr mgr to pid1 payload via /run/host
- 2239965c29 coredump: don't convert s → µs twice
- 61d29b7f8c firstboot: fill empty color if ansi_color unavailable from os-release
- 9678a3daf6 varlink: do not parse invalid messages twice
- 4e516dcbc1 userdbctl: add forgotten --output mode in help
- aee20dfbd8 shared/{user,group}-record-nss: adjust filtering of "valid" passwords
- 5933d77afe doc: cross link sd_listen_fd() docs a bit
- 97fdde3239 Rework how we cache mtime to figure out if units changed
- 0500968241 core: always try to reload not-found unit
- 8ae22f0d64 pid1: use the cache mtime not clock to "mark" load attempts
- 715507c277 core: rename manager_unit_file_maybe_loadable_from_cache()
- 20ad76d0a7 man: document fd ownership for sd-bus fd marshalling
- 38ae73fafd resolved: make sure we initialize t->answer_errno before completing the transaction
- a1ba0fbef6 homed: fix log message to honor real homework path
- d6b1e659b3 src/shared/dissect-image.c: fix build without blkdid (#16901)
- e42f9add21 analyze: fix error handling in one case
- 4804ce1488 units: add missing usb-gadget.target
- 5ad4e68c37 man: extend on the usec/sec discrepancy
- 2fb612371d login/logind: Include sys/stat.h for struct stat usage
- 5e884e7ee0 partition/makefs: Include missing sys/file.h header
- 7bbc3807da network: dhcp6: logs only new address
- 2056429e0f Don't run test-repart when loop devices are not available
- dcbea51c5a man: clarify that several networkctl commands takes device names
- 16e4cfcc82 networkctl: label command does not take any argument
- 2352921244 missing: Add new Linux capability
- 8b29c4a4f9 tty-ask-pw-agent: properly propagate error
- f7ce2e9839 tty-ask-pw-agent: the message string might not be set
- 29cba5c9ef tty-ask-pw-agent: make sure "--list" works correctly
- e1ce367d73 add "list" verb to autocompleted commands
- 1f4cb5da1e shell-completion/zsh: add missing verbs for networkctl
- a4236a2764 path: Improve $PATH search directory case
- b7cef386bd path: Skip directories when finalising $PATH search
- 122945f315 rules: don't install 80-drivers.rules when kmod is disabled
- 42fab2d454 zsh: correct journalctl command completion parsing
- ed3f97f962 basic/missing_syscall: fix syscall numbers for arm64 :(
- ba6e7f7c46 shared/install: fix preset operations for non-service instantiated units
- d39f139348 nss-resolve: treat BUS_ERROR_NO_SUCH_UNIT the same as SD_BUS_ERROR_SERVICE_UNKNOWN too
- 9bb3e64d71 various: treat BUS_ERROR_NO_SUCH_UNIT the same as SD_BUS_ERROR_SERVICE_UNKNOWN
- 6d802dd596 man: drop reference to long gone .busname unit type
- a29656804b man: fix a fix of a typo in systemd.service example
- 21ce0f5b33 network: can: Fix CAN initialization
- cab5cde8c9 man: update autogenerated dbus api lists
- 0d8000522b man: fix invalid tag place
- ea94f218be man: add conditionals to more man pages
- ef91325349 meson: add ENABLE_ANALYZE conditional
- 83f7c0a7ec core: add missing conditions/asserts to unit file parsing
- 716718155d analyze: rework condition testing
- 5c4c7581bc sd-bus: fix error handling on readv()
- 6cd058f305 user-runtime-dir: deal gracefully with missing logind properties
- 6a2d73638d shared/seccomp: do not use ifdef guards around textual syscall names
- 7355ac9689 machine-id-setup: don't use KVM or container manager supplied uuid if in chroot env
- 496a71f444 man: Fix typo in systemd-tmpfiles
- 6c5d216ad8 homework: downgrade chattr failure log message
- 1708f06a00 homework: explicitly close cryptsetup context, to not keep loopback device busy
- a21eaa2a3a homework: correct error passed into log message
- 3a2d169f36 homework: sync everything to disk before we rename LUKS loopback file into place
- 84e1ab74d2 homed: downgrade quota message in containers
- 8b62cadf36 analyze-security: do not assign badness to filtered-out syscalls
- 29854a5437 NEWS: clarify two points
- 4cb4fb82f7 meson: add min version for libfdisk
- 76331f86f6 load-fragment: fix grammar in error messages
- 1e53c2d70f Fix function description in logind man page
- 669066564d network: do not fail if UseMTU=yes on DHCP lease lost
- a2a3f16cdc missing_syscall: do not use function name that may conflict with glibc
- 4091dcd469 missing_syscall: fix pidfd_{send_signal,open} numbers for alpha
- 7875daf52b network: wait for previous address removal before configuring static addresses
- 120064b4a1 network: only process non-error message
- f44ec1de15 test: accept that char device 0/0 can now be created witout privileges
- 946e4c43bb tools/make-man-index: fix purpose text that contains tags
- dae0586e91 test-fs-util: skip encrypted path test if we get EACCES
- 0d026c9b0d Newer Glibc use faccessat2 to implement faccessat
- fde6520d46 namespace: fix minor memory leak
- 208ba581f4 man: fix incorrectly placed full stop
- 6c81d57828 man: fix typo
- 53a8d2588e bless-boot: add missing verb to --help
- 4cfa0ac4fd user-record: deal with invalid GECOS fields gracefully
- ae5234ef48 user-util: add mangle_gecos() call for turning strings into fields suitable as GECOS fields
- 972391ac39 fix typo in systemctl help
- 443aacfcda man: clarify that LogNamespace= is for system services only
- 5aec8fe54e _sd-common.h: avoid parsing errors with Coverity
- f9ad4ea2ca analyze: fix 'cat-config systemd/zram-generator.conf'
- dda6fec1df man: describe that changing Storage= does not move existing data
- 2bbd33e476 core: reset bus error before reuse
- b81504a3c7 nspawn: Fix incorrect usage of putenv
- cb263973ac man: fix typo in systemd.service
- 73b432e7ef network: fix DHCPv6 Prefix Delegation example after option rename
Now allows applying external overlays either in form of
.dts file, literal dts context added to store or precompiled .dtbo.
If overlays are defined, kernel device-trees are compiled with '-@'
so the .dtb files contain symbols which we can reference in our
overlays.
Since `fdtoverlay` doesn't respect `/ compatible` by itself
we query compatible strings of both `dtb` and `dtbo(verlay)`
and apply only if latter is substring of the former.
Also adds support for filtering .dtb files (as there are now nearly 1k
dtbs).
Co-authored-by: georgewhewell <georgerw@gmail.com>
Co-authored-by: Kai Wohlfahrt <kai.wohlfahrt@gmail.com>
- use pkg-config instead of pkgconfig alias
- use placeholders for cmakeFlags
- do not skip build rpath
- udev replacements no longer apply 47d4fb246b
There are some misplaced dependencies like gobject-introspection and orc that should probably go to nativeBuildInputs but upstream detects them incorrectly.
This fixes the `bcc` include directory (which was improperly set, and
warned about at build-time, but masked by some backwards compat code,
apparently) and also includes some missing libraries in `buildInputs`
Signed-off-by: Austin Seipp <aseipp@pobox.com>
The Deepin Desktop Environment (DDE) is not yet fully packaged in
nixpkgs and it has shown a very difficult task to complete, as
discussed in https://github.com/NixOS/nixpkgs/issues/94870. The
conclusion is that it is better to completely remove it.
Tim Steinbach
Florian Klink
André Silva
Michael Raskin
snicket2100
Luka Blaskovic
Frederik Rietdijk
Martin Weinelt
Christian Kampka
Arnout Engelen
Jan Tojnar
TredwellGit
Gabriel Ebner
Timothy Klim
Timo Kaufmann
Izorkin
Konrad Borowski
Michele Guerini Rocco
R. RyanTM
Aaron Janse
Edmund Wu
Daniel Fox Franke
Mario Rodas
Jonathan Ringer
Andreas Rammhold
Jörg Thalheim
Jonas Chevalier
Matthieu Coudron
Matthieu Coudron
Justin Humm
Ivan Kozik
Graham Christensen
Peter Hoeg
Markus S. Wamser
Daniël de Kok
Alyssa Ross
markuskowa
Tim Steinbach
Phillip Cloud
Jörg Thalheim
Anders Kaseorg
Ryan Mulligan
Frederik Rietdijk
ajs124
Finn Behrens
Kira Bruneau
Antoine Eiche
Austin Seipp
rnhmjoj
Vladimír Čunát
Masanori Ogino
Ben Siraphob
Janne Heß
Benjamin Hipple
Luflosi
Anderson Torres
Michael Weiss
Daniel Fullmer
ajs124
Dmitry Bogatov
Henri Menke
Jon
Luke Bentley-Fox
oxalica
Malte Brandy
zowoq
Benjamin Staffin
Yorick van Pelt
John Ericson
Ben Wolsieffer
Thomas Tuegel
Patrick Hilhorst
Henri Menke
Sridhar Ratnakumar
Shea Levy
Bernardo Meurer
Joe Hermaszewski
Robert Scott
WORLDofPEACE
Raghav Sood
Martin Weinelt
Markus Wamser
Julian Stecklina
Lassulus
Nick Hu
Tethys Svensson
Maxime Tréca
Maximilian Bosch
freezeboy
superherointj
Atemu
makefu
Richard Marko
edef
Julien Moutinho
Bryan Gardiner
SCOTT-HAMILTON
Orivej Desh
José Romildo Malaquias
Linus Heckemann
Matthew Bauer
Joachim F