Merge branch 'master' into staging

7 files changed, 42 insertions, 7 deletions

diff --git a/pkgs/os-specific/linux/gradm/default.nix b/pkgs/os-specific/linux/gradm/default.nix
index 7f64ed227719..2beb07094697 100644
--- a/pkgs/os-specific/linux/gradm/default.nix
+++ b/pkgs/os-specific/linux/gradm/default.nix
@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y5565rhil5ciprwz7nx4s4ah7dsxx7zrkg42dbq0mcg8m316xrb";
   };
 
+  patches = [ ./gradm_nix_store.patch ];
+
   nativeBuildInputs = [ bison flex ];
   buildInputs = [ pam ];
 
diff --git a/pkgs/os-specific/linux/gradm/gradm_nix_store.patch b/pkgs/os-specific/linux/gradm/gradm_nix_store.patch
new file mode 100644
index 000000000000..c1b7047324b1
--- /dev/null
+++ b/pkgs/os-specific/linux/gradm/gradm_nix_store.patch
@@ -0,0 +1,31 @@
+diff -ruN a/gradm_adm.c b/gradm_adm.c
+--- a/gradm_adm.c	2016-08-13 18:56:45.000000000 +0200
++++ b/gradm_adm.c	2016-11-26 02:47:05.829718770 +0100
+@@ -166,6 +166,8 @@
+ 	ADD_OBJ("/usr/libx32", "rx");
+ 	ADD_OBJ("/lib64", "rx");
+ 	ADD_OBJ("/usr/lib64", "rx");
++	ADD_OBJ("/nix/store", "h");
++	ADD_OBJ("/nix/store/*/lib", "rx");
+ 	ADD_OBJ(gradm_name, "x");
+ 	ADD_OBJ(grpam_path, "x");
+ 
+@@ -286,6 +288,8 @@
+ 	ADD_OBJ("/usr/lib32", "rx");
+ 	ADD_OBJ("/lib64", "rx");
+ 	ADD_OBJ("/usr/lib64", "rx");
++	ADD_OBJ("/nix/store", "h");
++	ADD_OBJ("/nix/store/*/lib", "rx");
+ 	ADD_OBJ("/tmp", "");
+ 	ADD_OBJ("/tmp/krb5cc_pam*", "rwcd");
+ 	ADD_OBJ(grpam_path, "x");
+@@ -369,6 +373,9 @@
+ 	ADD_OBJ("/lib", "rx");
+ 	ADD_OBJ("/lib32", "rx");
+ 	ADD_OBJ("/lib64", "rx");
++	ADD_OBJ("/nix/store", "h");
++	ADD_OBJ("/nix/store/*/bin", "rx");
++	ADD_OBJ("/nix/store/*/lib", "rx");
+ 	ADD_OBJ("/usr", "rx");
+ 	ADD_OBJ("/proc", "r");
+ 	ADD_OBJ("/boot", "h");
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index e650b7abc1c7..ab5af38d8b67 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -27,6 +27,8 @@ with stdenv.lib;
     MODULE_COMPRESS_XZ y
   ''}
 
+  KERNEL_XZ y
+
   # Debugging.
   DEBUG_KERNEL y
   TIMER_STATS y
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 489212f612f4..999b9dc260a0 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -87,8 +87,8 @@ rec {
 
   grsecurity_testing = grsecPatch
     { kver   = "4.8.10";
-      grrev  = "201611210813";
-      sha256 = "1an1fqzmh133hr6r9y4y9b5qkaf8xwlfgymg97ygbwqdygjvp81b";
+      grrev  = "201611232213";
+      sha256 = "13v3h6cjd5qz57rf242kpxhz5rk094lg5kyf86a852fk58apk6b6";
     };
 
   # This patch relaxes grsec constraints on the location of usermode helpers,
diff --git a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
index f4e7ad1f2344..8887237b3046 100644
--- a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = https://archlinux.org/;
+    homepage = "https://archlinux.org/";
     description = "ipconfig and nfsmount tools for root on NFS, ported from klibc";
     license = licenses.gpl2;
     platforms  = platforms.linux;
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 229865b49a31..69e4de69f9c9 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "367.57";
+  versionNumber = "375.20";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
@@ -30,12 +30,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "1fw87nvbf8dmy7clwmm7jwp842c78mkz9bcb060wbihsywkfkm23";
+        sha256 = "0da3mgfmkhs576wfkdmk8pbmvsksalkwz8a75vnhk0385fnd6yfc";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}.run";
-        sha256 = "0lc87bgr29l9idhy2a4bsplkwx9r0dz9kjhcc5xq2xqkkyr5sqd1";
+        sha256 = "02v20xns8w4flpllibc684g5yghi5dy28avsarccjyn5knhl03ni";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/os-specific/linux/pam_pgsql/default.nix b/pkgs/os-specific/linux/pam_pgsql/default.nix
index 42949a3557a6..10383a13e7e3 100644
--- a/pkgs/os-specific/linux/pam_pgsql/default.nix
+++ b/pkgs/os-specific/linux/pam_pgsql/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, postgresql, libgcrypt, pam }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.3.2";
   name = "pam_pgsql-${version}";
+  version = "0.7.3.2";
 
   src = fetchFromGitHub {
     owner = "pam-pgsql";