8 files changed, 16 insertions, 41 deletions
diff --git a/pkgs/os-specific/linux/apparmor/cross.patch b/pkgs/os-specific/linux/apparmor/cross.patch
deleted file mode 100644
index f7e95ecfb404..000000000000
--- a/pkgs/os-specific/linux/apparmor/cross.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/parser/libapparmor_re/Makefile	2018-10-14 07:38:06.000000000 +0800
-+++ b/parser/libapparmor_re/Makefile	2019-06-28 16:16:33.741916660 +0800
-@@ -10,6 +10,7 @@
- 
- TARGET=libapparmor_re.a
- 
-+AR ?= ar
- CFLAGS ?= -g -Wall -O2 ${EXTRA_CFLAGS} -std=gnu++0x
- CXXFLAGS := ${CFLAGS} ${INCLUDE_APPARMOR}
- 
-@@ -22,7 +23,7 @@
- UNITTESTS = tst_parse
- 
- libapparmor_re.a: parse.o expr-tree.o hfa.o chfa.o aare_rules.o
--	ar ${ARFLAGS} $@ $^
-+	${AR} ${ARFLAGS} $@ $^
- 
- expr-tree.o: expr-tree.cc expr-tree.h
- 
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index de9601dc85e8..9bdd1ae029f8 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -14,7 +14,7 @@
 
 let
   apparmor-series = "2.13";
-  apparmor-patchver = "3";
+  apparmor-patchver = "4";
   apparmor-version = apparmor-series + "." + apparmor-patchver;
 
   apparmor-meta = component: with stdenv.lib; {
@@ -27,7 +27,7 @@ let
 
   apparmor-sources = fetchurl {
     url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "0fbnk9fzjsffwcijsv2wwykmybvfdckpqk99qlib3kb89him6w16";
+    sha256 = "03nislxccnbxld89giak2s8xa4mdbwscfxbdwhmw5qpvgz08dgwh";
   };
 
   prePatchCommon = ''
@@ -49,13 +49,6 @@ let
       sha256 = "1m4dx901biqgnr4w4wz8a2z9r9dxyw7wv6m6mqglqwf2lxinqmp4";
     })
     # (alpine patches {1,4,5,6,8} are needed for apparmor 2.11, but not 2.12)
-    ] ++ [
-      ./cross.patch
-      # Support Python 3.8
-      (fetchpatch {
-        url = https://gitlab.com/apparmor/apparmor/commit/ccbf1e0bf1bf5c3bbab47029fbbc5415ef73bac1.patch;
-        sha256 = "0kfzc0wyjybj38n10yvwakaaqvglalzigd3kk7gcrbp1xdn70pq2";
-      })
     ];
 
   # Set to `true` after the next FIXME gets fixed or this gets some
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index e925068421d6..2c8b8de65b31 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -16,11 +16,12 @@
 }:
 
 with stdenv.lib;
-
-  with import ../../../../lib/kernel.nix { inherit (stdenv) lib; inherit version; };
+with stdenv.lib.kernel;
+with (stdenv.lib.kernel.whenHelpers version);
 
 let
 
+
   # configuration items have to be part of a subattrs
   flattenKConf =  nested: mapAttrs (_: head) (zipAttrs (attrValues nested));
 
diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix
index 156a4cf44234..3010d87a178a 100644
--- a/pkgs/os-specific/linux/kernel/hardened-config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened-config.nix
@@ -11,15 +11,15 @@
 { stdenv, version }:
 
 with stdenv.lib;
-with import ../../../../lib/kernel.nix { inherit (stdenv) lib; inherit version; };
+with stdenv.lib.kernel;
+with (stdenv.lib.kernel.whenHelpers version);
 
 assert (versionAtLeast version "4.9");
 
 optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
   DEFAULT_MMAP_MIN_ADDR = freeform "65536";  # Prevent allocation of first 64K of memory
 
-  # Reduce attack surface by disabling various emulations
-  IA32_EMULATION     = no;
+  # Reduce attack surface by disabling X32
   X86_X32            = no;
   # Note: this config depends on EXPERT y and so will not take effect, hence
   # it is left "optional" for now.
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 2dedc1592e88..5773b171f744 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.24";
+  version = "5.4.25";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1cvy3mxwzll4f9j8i3hfmi0i0zq75aiafq1jskp9n4kq9iwar83z";
+    sha256 = "09ay0adc3s3m7qk0nj5lkmrp5i0q76a9kax0xix8914d115rgvf0";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/mptcp-config.nix b/pkgs/os-specific/linux/kernel/mptcp-config.nix
index e5e3ee283fff..9752e63d9f94 100644
--- a/pkgs/os-specific/linux/kernel/mptcp-config.nix
+++ b/pkgs/os-specific/linux/kernel/mptcp-config.nix
@@ -1,5 +1,5 @@
 { stdenv }:
-with import ../../../../lib/kernel.nix { inherit (stdenv) lib; version = null; };
+with stdenv.lib.kernel;
 {
     # DRM_AMDGPU = yes;
 
diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index 3cd8f224ce46..7b1a0234a4f5 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "net-tools";
-  version = "1.60_p20170221182432";
+  version = "1.60_p20180626073013";
 
   src = fetchurl {
     url = "mirror://gentoo/distfiles/${pname}-${version}.tar.xz";
-    sha256 = "08r4r2a24g5bm8jwgfa998gs1fld7fgbdf7pilrpsw1m974xn04a";
+    sha256 = "0mzsjjmz5kn676w2glmxwwd8bj0xy9dhhn21aplb435b767045q4";
   };
 
   preBuild =
diff --git a/pkgs/os-specific/linux/sdparm/default.nix b/pkgs/os-specific/linux/sdparm/default.nix
index 5517f163b3e0..e0392e442bf5 100644
--- a/pkgs/os-specific/linux/sdparm/default.nix
+++ b/pkgs/os-specific/linux/sdparm/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "sdparm";
-  version = "1.10";
+  version = "1.11";
 
   src = fetchurl {
     url = "http://sg.danny.cz/sg/p/${pname}-${version}.tar.xz";
-    sha256 = "1jjq3lzgfy4r76rc26q02lv4wm5cb4dx5nh913h489zjrr4f3jbx";
+    sha256 = "1nqjc4w2w47zavcbf5xmm53x1zbwgljaw1lpajcdi537cgy32fa8";
   };
 
   meta = with stdenv.lib; {
-    homepage = http://sg.danny.cz/sg/sdparm.html;
+    homepage = "http://sg.danny.cz/sg/sdparm.html";
     description = "A utility to access SCSI device parameters";
     license = licenses.bsd3;
     platforms = with platforms; linux;