10 files changed, 50 insertions, 20 deletions
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 69fe94a1fe47..71ad6203e325 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -32,14 +32,14 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.29.2";
+  name = "busybox-1.29.3";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "0qax9926qx9lpxiw75f4hkknz1pg0zcn5pkjx5gqfibs2ipgmlk7";
+    sha256 = "1dzg45vgy2w1xcd3p6h8d76ykhabbvk1h0lf8yb24ikrwlv8cr4p";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 2b5c3817ddf7..4eec4754ca9a 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -19,6 +19,9 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs tests
+    ${stdenv.lib.optionalString enablePython ''
+      patchShebangs ./python/pycryptsetup-test.py
+    ''}
 
     # O_DIRECT is filesystem dependent and fails in a sandbox (on tmpfs)
     # and on several filesystem types (btrfs, zfs) without sandboxing.
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
index 081996dfd42b..52333c109ee0 100644
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ b/pkgs/os-specific/linux/earlyoom/default.nix
@@ -1,19 +1,19 @@
 { lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "earlyoom-${version}";
-  version = "0.11";
+  name = "earlyoom-${VERSION}";
+  # This environment variable is read by make to set the build version.
+  VERSION = "0.11";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "earlyoom";
-    rev = "08b7ed8e72feed2eec2e558ba2cfacbf6d469594";
+    rev = "v${VERSION}";
     sha256 = "1k3xslb70fzk80wlka32l0k2v45qn1xgwyjkjiz85gv6v4mv92vl";
   };
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp earlyoom $out/bin
+    install -D earlyoom $out/bin/earlyoom
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index eee2b132ae29..58cc1ab25da4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.68";
+  version = "4.14.69";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1446sbyysrv6hws35nnippa1mz4g31w7sc433svg4fq3jwavy7br";
+    sha256 = "1w0r7g04q9ac14krm5dmvl8sv88avsmdirvnfk964cz3n3xxbgb1";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.18.nix b/pkgs/os-specific/linux/kernel/linux-4.18.nix
index 22bbd73f9859..f6f92d65938b 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.18.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.18.6";
+  version = "4.18.7";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1518q822fs28sfdqwsibj3bpibzj5r2dqfr0skv7l8cid3yrgnq5";
+    sha256 = "0cgpb8zx7ckd9lmmaas6r1vszbz9lhrn4w1njw3yaw9a4rg44fzh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 0872856c1190..66df462f5960 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.154";
+  version = "4.4.155";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1j00y6hgj4c82y3j0gaqj68kf46fwxz1y5wx6ry5sgxnr3xp12z0";
+    sha256 = "1nbd88x3m4w2ffwgjnf8ry5p2z7al54q1lvl2kv3fz8hmr5qq28q";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 068cf25f0053..1bd29569e011 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.125";
+  version = "4.9.126";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1jqi25ld83l57lzcbhrzdnmsj4isz686ivdj0wfsrgxyc7pxwr57";
+    sha256 = "1davk0c760if20h3f9r18lcvb7lqzlx0chxlph7ld5nlaz3ncskd";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 1f45348824a0..3be377205824 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.19-rc2";
-  modDirVersion = "4.19.0-rc2";
+  version = "4.19-rc3";
+  modDirVersion = "4.19.0-rc3";
   extraMeta.branch = "4.19";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0a5ip4dxv5y1mdi03m5rnz2l9k6kv30gciss6fag41lwsfwwln3z";
+    sha256 = "0n372r1j3m2q47hwl8b1r57jq1b4fdhmadgvcvik6fpsvcw74w27";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 9628ec516763..a24900ce337a 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation rec {
   name    = "musl-${version}";
-  version = "1.1.19";
+  version = "1.1.20";
 
   src = fetchurl {
     url    = "https://www.musl-libc.org/releases/musl-${version}.tar.gz";
-    sha256 = "1nf1wh44bhm8gdcfr75ayib29b99vpq62zmjymrq7f96h9bshnfv";
+    sha256 = "0q8dsjxl41dccscv9a0r78bs7jap57mn4mni5pwbbip6s1qqggj4";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/semodule-utils/default.nix b/pkgs/os-specific/linux/semodule-utils/default.nix
new file mode 100644
index 000000000000..10ba1a3c7d07
--- /dev/null
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, libsepol }:
+
+stdenv.mkDerivation rec {
+  name = "semodule-utils-${version}";
+  version = "2.7";
+
+  inherit (libsepol) se_release se_url;
+
+  src = fetchurl {
+    url = "${se_url}/${se_release}/${name}.tar.gz";
+    sha256 = "1fl60x4w8rn5bcwy68sy48aydwsn1a17d48slni4sfx4c8rqpjch";
+  };
+
+  buildInputs = [ libsepol ];
+
+  makeFlags = [
+    "PREFIX=$(out)"
+    "LIBSEPOLA=${stdenv.lib.getLib libsepol}/lib/libsepol.a"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "SELinux policy core utilities (packaging additions)";
+    license = licenses.gpl2;
+    inherit (libsepol.meta) homepage platforms;
+    maintainers = [ maintainers.e-user ];
+  };
+}