Merge branch 'master' into staging-next

21 files changed, 169 insertions, 93 deletions

diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
index 7986706cb647..fe68ee78d1f0 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
@@ -1,7 +1,7 @@
 { appleDerivation_, applePackage, pkgs, stdenv }:
 name: version: sha256: args: let
   n = stdenv.lib.removePrefix "lib" name;
-  makeFile = ../. + builtins.toPath "/${name}/GNUmakefile";
+  makeFile = ../. + "/${name}/GNUmakefile";
   appleDerivation = appleDerivation_ name version sha256;
   in applePackage name version sha256 (args // {
     appleDerivation = a:
diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 969168fa54ba..1dea55cccc9e 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -1,32 +1,78 @@
-{ stdenv, fetchFromGitHub, python, ninja, libxml2 }:
+{ stdenv, fetchFromGitHub, fetchurl, python, ninja, libxml2, objc4, ICU, curl }:
 
-stdenv.mkDerivation {
+let
+  # 10.12 adds a new sysdir.h that our version of CF in the main derivation depends on, but
+  # isn't available publicly, so instead we grab an older version of the same file that did
+  # not use sysdir.h, but provided the same functionality. Luckily it's simple :) hack hack
+  sysdir-free-system-directories = fetchurl {
+    url    = "https://raw.githubusercontent.com/apple/swift-corelibs-foundation/9a5d8420f7793e63a8d5ec1ede516c4ebec939f0/CoreFoundation/Base.subproj/CFSystemDirectories.c";
+    sha256 = "0krfyghj4f096arvvpf884ra5czqlmbrgf8yyc0b3avqmb613pcc";
+  };
+in stdenv.mkDerivation {
   name = "swift-corefoundation";
 
   src = fetchFromGitHub {
     owner  = "apple";
     repo   = "swift-corelibs-foundation";
-    rev    = "dce4233f583ec15190b240d6116396bf9641cd57";
-    sha256 = "0i2ldvy14x05k2vgl5z0g5l2i5llifdfbij5zwfdwb8jmmq215qr";
+    rev    = "85c640e7ce50e6ca61a134c72270e214bc63fdba"; # https://github.com/apple/swift-corelibs-foundation/pull/1686
+    sha256 = "0z2v278wy7jh0c92g1dszd8hj8naxari660sqx6yab5dwapd46qc";
   };
 
-  buildInputs = [ ninja python libxml2 ];
+  buildInputs = [ ninja python libxml2 objc4 ICU curl ];
+
+  sourceRoot = "source/CoreFoundation";
 
   patchPhase = ''
-    substituteInPlace CoreFoundation/build.py \
-      --replace '-I''${SYSROOT}/usr/include/libxml2' '-I${libxml2.dev}/include/libxml2' \
-  '';
+    cp ${sysdir-free-system-directories} Base.subproj/CFSystemDirectories.c
+
+    # In order, since I can't comment individual lines:
+    # 1. Disable dispatch support for now
+    # 2. For the linker too
+    # 3. Use the legit CoreFoundation.h, not the one telling you not to use it because of Swift
+    substituteInPlace build.py \
+      --replace "cf.CFLAGS += '-DDEPLOYMENT" '#' \
+      --replace "cf.LDFLAGS += '-ldispatch" '#' \
+      --replace "Base.subproj/SwiftRuntime/CoreFoundation.h" 'Base.subproj/CoreFoundation.h'
+
+    # Includes xpc for some initialization routine that they don't define anyway, so no harm here
+    substituteInPlace PlugIn.subproj/CFBundlePriv.h \
+      --replace '#if (TARGET_OS_MAC' '#if (0'
+
+    # Why do we define __GNU__? Is that normal?
+    substituteInPlace Base.subproj/CFAsmMacros.h \
+      --replace '#if defined(__GNU__) ||' '#if 0 &&'
 
-  configurePhase = ":";
+    # The MIN macro doesn't seem to be defined sensibly for us. Not sure if our stdenv or their bug
+    substituteInPlace Base.subproj/CoreFoundation_Prefix.h \
+      --replace '#if DEPLOYMENT_TARGET_WINDOWS || DEPLOYMENT_TARGET_LINUX' '#if 1'
 
-  buildPhase = ''
-    cd CoreFoundation
-    ../configure --sysroot unused
-    ninja
+    # Somehow our ICU doesn't have this, probably because it's too old (we'll update it soon when we update the rest of the SDK)
+    substituteInPlace Locale.subproj/CFLocale.c \
+      --replace '#if U_ICU_VERSION_MAJOR_NUM' '#if 0 //'
   '';
 
+  BUILD_DIR = "./Build";
+  CFLAGS = "-DINCLUDE_OBJC -I${libxml2.dev}/include/libxml2"; # They seem to assume we include objc in some places and not in others, make a PR; also not sure why but libxml2 include path isn't getting picked up from buildInputs
+  LDFLAGS = "-install_name ${placeholder "out"}/Frameworks/CoreFoundation.framework/CoreFoundation -current_version 1234.56.7 -compatibility_version 150.0.0 -init ___CFInitialize";
+  configurePhase = "../configure --sysroot unused";
+
+  enableParallelBuilding = true;
+  buildPhase = "ninja -j $NIX_BUILD_CORES";
+
+  # TODO: their build system sorta kinda can do this, but it doesn't seem to work right now
+  # Also, this includes a bunch of private headers in the framework, which is not what we want
   installPhase = ''
-    mkdir -p $out/lib
-    cp ../Build/CoreFoundation/libCoreFoundation.a $out/lib
+    base="$out/Library/Frameworks/CoreFoundation.framework"
+    mkdir -p $base/Versions/A/{Headers,PrivateHeaders,Modules}
+
+    cp ./Build/CoreFoundation/libCoreFoundation.dylib $base/Versions/A/CoreFoundation
+    cp ./Build/CoreFoundation/usr/include/CoreFoundation/*.h $base/Versions/A/Headers
+    cp ./Build/CoreFoundation/usr/include/CoreFoundation/module.modulemap $base/Versions/A/Modules
+
+    ln -s A $base/Versions/Current
+
+    for i in CoreFoundation Headers Modules; do
+      ln -s Versions/Current/$i $base/$i
+    done
   '';
 }
diff --git a/pkgs/os-specific/darwin/swift-corelibs/default.nix b/pkgs/os-specific/darwin/swift-corelibs/default.nix
index dd652dc56273..0d96b8fd008e 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/default.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/default.nix
@@ -1,7 +1,7 @@
-{callPackage, darwin}:
+{ callPackage, darwin }:
 
 rec {
-  corefoundation = callPackage ./corefoundation.nix {};
+  corefoundation = callPackage ./corefoundation.nix { inherit (darwin) objc4 ICU; };
   libdispatch = callPackage ./libdispatch.nix {
    inherit (darwin) apple_sdk_sierra xnu;
   };
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index a02127ab7989..5a40368f3ceb 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -4,14 +4,14 @@
 }:
 
 python.pkgs.buildPythonApplication rec {
-  version = "0.6.1";
+  version = "0.7.0";
   name = "bcc-${version}";
 
   src = fetchFromGitHub {
     owner  = "iovisor";
     repo   = "bcc";
     rev    = "v${version}";
-    sha256 = "1rfqjbq8ah8zrsnpbx0h5irq3h2snncfvi4pvaxl7574kciprjxj";
+    sha256 = "1ww7l0chx2ivw9d2ahxjyhxmh6hz3w5z69r4lz02f0361rnrvk7f";
   };
 
   format = "other";
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 69fe94a1fe47..71ad6203e325 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -32,14 +32,14 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.29.2";
+  name = "busybox-1.29.3";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "0qax9926qx9lpxiw75f4hkknz1pg0zcn5pkjx5gqfibs2ipgmlk7";
+    sha256 = "1dzg45vgy2w1xcd3p6h8d76ykhabbvk1h0lf8yb24ikrwlv8cr4p";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 178fc7d91408..4eec4754ca9a 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -14,8 +14,19 @@ stdenv.mkDerivation rec {
     sha256 = "0d2p9g2wqcv6l3671gvw96p16jadbgyh21ddy2bhqgi96dq3qflx";
   };
 
+  # Disable 4 test cases that fail in a sandbox
+  patches = [ ./disable-failing-tests.patch ];
+
   postPatch = ''
     patchShebangs tests
+    ${stdenv.lib.optionalString enablePython ''
+      patchShebangs ./python/pycryptsetup-test.py
+    ''}
+
+    # O_DIRECT is filesystem dependent and fails in a sandbox (on tmpfs)
+    # and on several filesystem types (btrfs, zfs) without sandboxing.
+    # Remove it, see discussion in #46151
+    substituteInPlace tests/unit-utils-io.c --replace "| O_DIRECT" ""
   '';
 
   NIX_LDFLAGS = "-lgcc_s";
@@ -30,6 +41,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ lvm2 json_c openssl libuuid popt ]
     ++ stdenv.lib.optional enablePython python2;
 
+  doCheck = true;
+
   meta = {
     homepage = https://gitlab.com/cryptsetup/cryptsetup/;
     description = "LUKS for dm-crypt";
diff --git a/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch b/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
new file mode 100644
index 000000000000..1504bf3e1511
--- /dev/null
+++ b/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
@@ -0,0 +1,19 @@
+diff -ur a/tests/blockwise-compat b/tests/blockwise-compat
+--- a/tests/blockwise-compat	2018-09-08 12:23:11.706555098 +0200
++++ b/tests/blockwise-compat	2018-09-08 12:24:24.444393460 +0200
+@@ -148,15 +148,11 @@
+ 	# device/file fn_name length
+ 	RUN "P" $1 read_buffer $BSIZE
+ 	RUN "P" $1 read_buffer $((2*BSIZE))
+-	RUN "F" $1 read_buffer $((BSIZE-1))
+-	RUN "F" $1 read_buffer $((BSIZE+1))
+ 	RUN "P" $1 read_buffer 0
+ 
+ 	RUN "P" $1 write_buffer $BSIZE
+ 	RUN "P" $1 write_buffer $((2*BSIZE))
+ 
+-	RUN "F" $1 write_buffer $((BSIZE-1))
+-	RUN "F" $1 write_buffer $((BSIZE+1))
+ 	RUN "F" $1 write_buffer 0
+ 
+ 	# basic blockwise functions
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
index 081996dfd42b..52333c109ee0 100644
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ b/pkgs/os-specific/linux/earlyoom/default.nix
@@ -1,19 +1,19 @@
 { lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "earlyoom-${version}";
-  version = "0.11";
+  name = "earlyoom-${VERSION}";
+  # This environment variable is read by make to set the build version.
+  VERSION = "0.11";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "earlyoom";
-    rev = "08b7ed8e72feed2eec2e558ba2cfacbf6d469594";
+    rev = "v${VERSION}";
     sha256 = "1k3xslb70fzk80wlka32l0k2v45qn1xgwyjkjiz85gv6v4mv92vl";
   };
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp earlyoom $out/bin
+    install -D earlyoom $out/bin/earlyoom
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 000764eca9b3..58cc1ab25da4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.67";
+  version = "4.14.69";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1fkha288nv5vk2l13dj0xj09c2pxvipysdaaga7sfcvjq9nhajrz";
+    sha256 = "1w0r7g04q9ac14krm5dmvl8sv88avsmdirvnfk964cz3n3xxbgb1";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.17.nix b/pkgs/os-specific/linux/kernel/linux-4.17.nix
deleted file mode 100644
index 5c13f366221e..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.17.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
-
-with stdenv.lib;
-
-buildLinux (args // rec {
-  version = "4.17.19";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "05wz76qq70bfhfwd1zwzfmzq4rlgz40jpi9plb31njx1y7vkx6xs";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.18.nix b/pkgs/os-specific/linux/kernel/linux-4.18.nix
index e76beadc27bf..f6f92d65938b 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.18.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.18.5";
+  version = "4.18.7";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1ga7ys6s5d9dk1ly9722sbik1y6kbc3w6nw9pw86zpzdh0v0l2gv";
+    sha256 = "0cgpb8zx7ckd9lmmaas6r1vszbz9lhrn4w1njw3yaw9a4rg44fzh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 7c5f345e3400..66df462f5960 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.153";
+  version = "4.4.155";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "00jlajwbq7w5cxzzaa5mib5qvihqab3ysfq401b71ji2bi8ma8qg";
+    sha256 = "1nbd88x3m4w2ffwgjnf8ry5p2z7al54q1lvl2kv3fz8hmr5qq28q";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index ed0075b7876b..1bd29569e011 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.124";
+  version = "4.9.126";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "04a3iqy6divkd9bamn60d0v8jkls2jbip7qn0m82dlcdikab19jw";
+    sha256 = "1davk0c760if20h3f9r18lcvb7lqzlx0chxlph7ld5nlaz3ncskd";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 1f45348824a0..3be377205824 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.19-rc2";
-  modDirVersion = "4.19.0-rc2";
+  version = "4.19-rc3";
+  modDirVersion = "4.19.0-rc3";
   extraMeta.branch = "4.19";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0a5ip4dxv5y1mdi03m5rnz2l9k6kv30gciss6fag41lwsfwwln3z";
+    sha256 = "0n372r1j3m2q47hwl8b1r57jq1b4fdhmadgvcvik6fpsvcw74w27";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 2cc83e62d11e..97921f07e82c 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -247,6 +247,7 @@ let
           maintainers.thoughtpolice
         ];
         platforms = platforms.linux;
+        timeout = 7200; # 2 hours
       } // extraMeta;
     };
 in
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 9628ec516763..a24900ce337a 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation rec {
   name    = "musl-${version}";
-  version = "1.1.19";
+  version = "1.1.20";
 
   src = fetchurl {
     url    = "https://www.musl-libc.org/releases/musl-${version}.tar.gz";
-    sha256 = "1nf1wh44bhm8gdcfr75ayib29b99vpq62zmjymrq7f96h9bshnfv";
+    sha256 = "0q8dsjxl41dccscv9a0r78bs7jap57mn4mni5pwbbip6s1qqggj4";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/s6-linux-utils/default.nix b/pkgs/os-specific/linux/s6-linux-utils/default.nix
index dbef7c41c067..0d208a6eb55f 100644
--- a/pkgs/os-specific/linux/s6-linux-utils/default.nix
+++ b/pkgs/os-specific/linux/s6-linux-utils/default.nix
@@ -1,24 +1,19 @@
-{ stdenv, fetchurl, skalibs }:
+{ stdenv, skawarePackages }:
 
-let
+with skawarePackages;
 
-  version = "2.4.0.2";
+buildPackage {
+  pname = "s6-linux-utils";
+  version = "2.5.0.0";
+  sha256 = "04q2z71dkzahd2ppga2zikclz2qk014c23gm7rigqxjc8rs1amvq";
 
-in stdenv.mkDerivation rec {
-
-  name = "s6-linux-utils-${version}";
-
-  src = fetchurl {
-    url = "https://www.skarnet.org/software/s6-linux-utils/${name}.tar.gz";
-    sha256 = "0245rmk7wfyyfsi4g7f0niprwlvqlwkbyjxflb8kkbvhwfdavqip";
-  };
+  description = "A set of minimalistic Linux-specific system utilities";
+  platforms = stdenv.lib.platforms.linux;
 
   outputs = [ "bin" "dev" "doc" "out" ];
 
-  dontDisableStatic = true;
-
+  # TODO: nsss support
   configureFlags = [
-    "--enable-absolute-paths"
     "--bindir=\${bin}/bin"
     "--includedir=\${dev}/include"
     "--with-sysdeps=${skalibs.lib}/lib/skalibs/sysdeps"
@@ -28,16 +23,10 @@ in stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    mkdir -p $doc/share/doc/s6-networking/
-    mv doc $doc/share/doc/s6-networking/html
-  '';
+    # remove all s6 executables from build directory
+    rm $(find -name "s6-*" -type f -mindepth 1 -maxdepth 1 -executable)
 
-  meta = {
-    homepage = http://www.skarnet.org/software/s6-linux-utils/;
-    description = "A set of minimalistic Linux-specific system utilities";
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.isc;
-    maintainers = with stdenv.lib.maintainers; [ pmahoney Profpatsch ];
-  };
+    mv doc $doc/share/doc/s6-linux-utils/html
+  '';
 
 }
diff --git a/pkgs/os-specific/linux/semodule-utils/default.nix b/pkgs/os-specific/linux/semodule-utils/default.nix
new file mode 100644
index 000000000000..10ba1a3c7d07
--- /dev/null
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, libsepol }:
+
+stdenv.mkDerivation rec {
+  name = "semodule-utils-${version}";
+  version = "2.7";
+
+  inherit (libsepol) se_release se_url;
+
+  src = fetchurl {
+    url = "${se_url}/${se_release}/${name}.tar.gz";
+    sha256 = "1fl60x4w8rn5bcwy68sy48aydwsn1a17d48slni4sfx4c8rqpjch";
+  };
+
+  buildInputs = [ libsepol ];
+
+  makeFlags = [
+    "PREFIX=$(out)"
+    "LIBSEPOLA=${stdenv.lib.getLib libsepol}/lib/libsepol.a"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "SELinux policy core utilities (packaging additions)";
+    license = licenses.gpl2;
+    inherit (libsepol.meta) homepage platforms;
+    maintainers = [ maintainers.e-user ];
+  };
+}
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 146e1c276965..6e22de4bcf62 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -10,13 +10,13 @@ assert kernel != null;
 
 stdenv.mkDerivation rec {
   name = "spl-${version}-${kernel.version}";
-  version = "0.7.9";
+  version = "0.7.10";
 
   src = fetchFromGitHub {
     owner = "zfsonlinux";
     repo = "spl";
     rev = "spl-${version}";
-    sha256 = "0540m1dv9jvrzk9kw61glg0h0cwj976mr9zb42y3nh17k47ywff0";
+    sha256 = "1jkv6sdrd6yvaqx0jg86fjwnsqyxqb2061k7yrka7iyivgjzpi26";
   };
 
   patches = [ ./install_prefix.patch ];
@@ -52,6 +52,5 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ jcumming wizeman wkennington fpletz globin ];
-    broken = stdenv.lib.versionAtLeast kernel.version "4.18";
   };
 }
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 9b0f3ff767c2..20ecdb5b5773 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -3,13 +3,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "sysdig-${version}";
-  version = "0.22.1";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "1wbvpsalm2ccwh8xz6fa4gqviilvjd8lnwvdryixhsdsf7j8w0j0";
+    sha256 = "0q52yfag97n6cvrnzgx7inx11zdg7bgwkvqn2idsg9874fd2wkzh";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index c689faad492f..e7cca579d624 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -158,12 +158,12 @@ in {
   # to be adapted
   zfsStable = common {
     # comment/uncomment if breaking kernel versions are known
-    incompatibleKernelVersion = "4.18";
+    # incompatibleKernelVersion = null;
 
     # this package should point to the latest release.
-    version = "0.7.9";
+    version = "0.7.10";
 
-    sha256 = "0krpxrvnda2jx6l71xhw9fsksyp2a6h9l9asppac3szsd1n7fp9n";
+    sha256 = "1kq35ij29fag77dxq21jf9ghbl4nkyjgc2bxzyry9rawznq542v1";
 
     extraPatches = [
       (fetchpatch {
@@ -180,10 +180,10 @@ in {
     incompatibleKernelVersion = null;
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2018-08-13";
+    version = "2018-09-02";
 
-    rev = "64e96969a88c21aebb2f8d982a8c345e55a2ae6c";
-    sha256 = "164fvsf9zqvq3vafnvjxafjl8gihmfqfsjwsmky16i90a6hs96gf";
+    rev = "c197a77c3cf36531e4cf79e524e1ccf7ec00cc4c";
+    sha256 = "0rk835nnl4w5km8qxcr1wdpr9xasssnrmsxhjlqjy0ry3qcb2197";
     isUnstable = true;
 
     extraPatches = [