diff options
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r-- | pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch | 30 | ||||
-rw-r--r-- | pkgs/os-specific/linux/apparmor/default.nix | 4 | ||||
-rw-r--r-- | pkgs/os-specific/linux/kernel/patches.nix | 9 | ||||
-rw-r--r-- | pkgs/os-specific/linux/keyutils/default.nix | 2 | ||||
-rw-r--r-- | pkgs/os-specific/linux/shadow/default.nix | 4 | ||||
-rw-r--r-- | pkgs/os-specific/linux/systemd/default.nix | 5 |
6 files changed, 50 insertions, 4 deletions
diff --git a/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch b/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch new file mode 100644 index 000000000000..ce2a0e7cc5b3 --- /dev/null +++ b/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch @@ -0,0 +1,30 @@ +commit 166afaf144d6473464975438353257359dd51708 +Author: Andreas Wiese <andreas.wiese@kernkonzept.com> +Date: Thu Feb 1 11:35:02 2024 +0100 + + aa-remove-unknown: fix readability check + + This check is intended for ensuring that the profiles file can actually + be opened. The *actual* check is performed by the shell, not the read + utility, which won't even be executed if the input redirection (and + hence the test) fails. + + If the test succeeds, though, using `read` here might actually + jeopardize the test result if there are no profiles loaded and the file + is empty. + + This commit fixes that case by simply using `true` instead of `read`. + +diff --git a/utils/aa-remove-unknown b/utils/aa-remove-unknown +index 0e00d6a0..3351feef 100755 +--- a/utils/aa-remove-unknown ++++ b/utils/aa-remove-unknown +@@ -63,7 +63,7 @@ fi + # We have to do this check because error checking awk's getline() below is + # tricky and, as is, results in an infinite loop when apparmorfs returns an + # error from open(). +-if ! IFS= read -r _ < "$PROFILES" ; then ++if ! true < "$PROFILES" ; then + echo "ERROR: Unable to read apparmorfs profiles file" 1>&2 + exit 1 + elif [ ! -w "$REMOVE" ] ; then diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix index 97fb7f0a6190..cebae9b8402d 100644 --- a/pkgs/os-specific/linux/apparmor/default.nix +++ b/pkgs/os-specific/linux/apparmor/default.nix @@ -56,7 +56,9 @@ let --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" ''; - patches = lib.optionals stdenv.hostPlatform.isMusl [ + patches = [ + ./0001-aa-remove-unknown_empty-ruleset.patch + ] ++ lib.optionals stdenv.hostPlatform.isMusl [ (fetchpatch { url = "https://git.alpinelinux.org/aports/plain/testing/apparmor/0003-Added-missing-typedef-definitions-on-parser.patch?id=74b8427cc21f04e32030d047ae92caa618105b53"; name = "0003-Added-missing-typedef-definitions-on-parser.patch"; diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index a7bf7128f5ef..9c2b50f95952 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -79,4 +79,13 @@ name = "rust-1.75.patch"; patch = ./rust-1.75.patch; }; + + rust_1_76 = { + name = "rust-1.76.patch"; + patch = fetchurl { + name = "rust-1.76.patch"; + url = "https://lore.kernel.org/rust-for-linux/20240217002638.57373-2-ojeda@kernel.org/raw"; + hash = "sha256-q3iNBo8t4b1Rn5k5lau2myqOAqdA/9V9A+ok2jGkLdY="; + }; + }; } diff --git a/pkgs/os-specific/linux/keyutils/default.nix b/pkgs/os-specific/linux/keyutils/default.nix index 86b2535e1dde..342626624c7e 100644 --- a/pkgs/os-specific/linux/keyutils/default.nix +++ b/pkgs/os-specific/linux/keyutils/default.nix @@ -30,7 +30,7 @@ stdenv.mkDerivation rec { makeFlags = lib.optionals stdenv.hostPlatform.isStatic "NO_SOLIB=1"; - outputs = [ "out" "lib" "dev" ]; + outputs = [ "out" "lib" "dev" "man" ]; postPatch = '' # https://github.com/archlinux/svntogit-packages/blob/packages/keyutils/trunk/reproducible.patch diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix index 2f4e49062aef..946299366c0a 100644 --- a/pkgs/os-specific/linux/shadow/default.nix +++ b/pkgs/os-specific/linux/shadow/default.nix @@ -17,13 +17,13 @@ in stdenv.mkDerivation rec { pname = "shadow"; - version = "4.14.3"; + version = "4.14.5"; src = fetchFromGitHub { owner = "shadow-maint"; repo = pname; rev = version; - hash = "sha256-Y5wyvmTh66Bjb1/UPdDF78lgvH7HFTCFowhQQ+Fo9ak="; + hash = "sha256-ogkPp6dxWHdvJvWcb5iauH81CVTH7BbonFXG1gGysUE="; }; outputs = [ "out" "su" "dev" "man" ]; diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 064c465bd6e3..c304cb1dc2f8 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -404,6 +404,11 @@ stdenv.mkDerivation (finalAttrs: { outputs = [ "out" "dev" ] ++ (lib.optional (!buildLibsOnly) "man"); + hardeningDisable = [ + # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111523 + "trivialautovarinit" + ]; + nativeBuildInputs = [ pkg-config |