about summary refs log tree commit diff
path: root/nixos
Commit message (Collapse)AuthorAge
* nixos/all-firmware: include raspberrypiWirelessFirmware when buildingMatthew Bauer2019-01-03
|
* treewide: remove cross assertionsMatthew Bauer2019-01-02
| | | | | sd-image-raspberrypi, sd-image-aarch64, and sd-image-armv7l-multiplatform can all be cross compiled now.
* treewide: use buildPackages for config buildersMatthew Bauer2019-01-02
|
* Merge branch 'master' into stagingVladimír Čunát2019-01-02
|\
| * cpufreq: add option for setting the cpu max and min frequencies(cdep)illabout2019-01-01
| | | | | | | | | | | | | | | | | | | | | | | | | | This adds a NixOS option for setting the CPU max and min frequencies with `cpufreq`. The two options that have been added are: - `powerManagement.cpufreq.max` - `powerManagement.cpufreq.min` It also adds an alias to the `powerManagement.cpuFreqGovernor` option as `powerManagement.cpufreq.governor`. This updates the installer to use the new option name. It also updates the manual with a note about the new name.
* | Merge master into staging-nextFrederik Rietdijk2018-12-31
|\|
| * Remove composableDerivation, closes #18763Frederik Rietdijk2018-12-30
| |
| * Merge pull request #52930 from Ekleog/low-prio-syspathSilvan Mosberger2018-12-30
| |\ | | | | | | system-path: set implicitly installed packages to be low-priority
| | * system-path: set implicitly installed packages to be low-priorityLéo Gaspard2018-12-26
| | | | | | | | | | | | | | | | | | The aim is to minimize surprises: when the user explicitly installs a package in their configuration, it should override any package implicitly installed by NixOS.
| * | Revert "nixos/ddclient: make RuntimeDirectory and configFile private"Silvan Mosberger2018-12-29
| | |
| * | fish: 2.7.1 -> 3.0.0adisbladis2018-12-28
| | |
* | | Merge staging-next into stagingFrederik Rietdijk2018-12-27
|\| |
| * | Merge pull request #51294 from eadwu/nvidia_x11/legacy_390Dmitry Kalinkin2018-12-27
| |\ \ | | | | | | | | nvidia: expose nvidia_x11_legacy390
| | * | nvidia: expose nvidia_x11_legacy390Edmund Wu2018-11-30
| | | |
| * | | nixos/security/misc: expose SMT control optionJoachim Fasting2018-12-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For the hardened profile disable symmetric multi threading. There seems to be no *proven* method of exploiting cache sharing between threads on the same CPU core, so this may be considered quite paranoid, considering the perf cost. SMT can be controlled at runtime, however. This is in keeping with OpenBSD defaults. TODO: since SMT is left to be controlled at runtime, changing the option definition should take effect on system activation. Write to /sys/devices/system/cpu/smt/control
| * | | nixos/security/misc: expose l1tf mitigation optionJoachim Fasting2018-12-27
| | | | | | | | | | | | | | | | | | | | | | | | For the hardened profile enable flushing whenever the hypervisor enters the guest, but otherwise leave at kernel default (conditional flushing as of writing).
| * | | nixos/security/misc: factor out protectKernelImageJoachim Fasting2018-12-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduces the option security.protectKernelImage that is intended to control various mitigations to protect the integrity of the running kernel image (i.e., prevent replacing it without rebooting). This makes sense as a dedicated module as it is otherwise somewhat difficult to override for hardened profile users who want e.g., hibernation to work.
| * | | nixos/security/misc: use mkMerge for easier extensionJoachim Fasting2018-12-27
| | |/ | |/|
| * | nixos/sd-image-aarch64-new-kernel: Added to releaseSamuel Dionne-Riel2018-12-26
| | | | | | | | | | | | | | | | | | This, paired with the previous commit, ensures the channel won't be held back from a kernel upgrade and a non-building sd image, while still having a new-kernel variant available.
| * | nixos/sd-image-aarch64: Configures it to use the default kernelSamuel Dionne-Riel2018-12-26
| | |
* | | Merge staging-next into stagingFrederik Rietdijk2018-12-26
|\| |
| * | Merge pull request #52896 from veprbl/pr/gmane_wo_net-snmpDmitry Kalinkin2018-12-25
| |\ \ | | | | | | | | treewide: Fix broken Gmane URLs
| | * | treewide: Fix broken Gmane URLsCraig Younkins2018-12-25
| | | |
| * | | Merge pull request #52592 from worldofpeace/geoclue/correct-sysconfworldofpeace2018-12-25
| |\ \ \ | | |/ / | |/| | geoclue2: correct sysconfdir
| | * | geoclue2: correct sysconfdirworldofpeace2018-12-25
| | | |
* | | | gcr: rename from gnome3.gcrworldofpeace2018-12-25
| | | |
* | | | Merge branch 'master' into stagingJan Tojnar2018-12-25
|\| | |
| * | | Merge pull request #50596 from svanderburg/mobile-updatesSander van der Burg2018-12-24
| |\ \ \ | | | | | | | | | | Mobile updates
| | * | | Remove relatedPackages to fix ofborg evaluationSander van der Burg2018-12-20
| | | | |
| | * | | Fix adb program moduleSander van der Burg2018-12-18
| | | | |
* | | | | Merge branch 'master' into stagingJan Tojnar2018-12-24
|\| | | |
| * | | | Merge pull request #51566 from adisbladis/google-osloginzimbatm2018-12-24
| |\ \ \ \ | | | | | | | | | | | | GCE OSLogin module: init
| | * | | | release-notes/rl-1903: add security.googleOsLoginFlorian Klink2018-12-21
| | | | | |
| | * | | | nixos/modules/virtualisation/google-compute-config.nix: remove ↵Florian Klink2018-12-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | google-accounts-daemon Use googleOsLogin for login instead. This allows setting users.mutableUsers back to false, and to strip the security.sudo.extraConfig. security.sudo.enable is default anyhow, so we can remove that as well.
| | * | | | nixos/tests: add google-oslogin testFlorian Klink2018-12-21
| | | | | |
| | * | | | config.nsswitch: load cache_oslogin and oslogin nss modules if ↵Florian Klink2018-12-21
| | | | | | | | | | | | | | | | | | | | | | | | config.security.googleOsLogin.enable is set
| | * | | | config.security.googleOsLogin: add moduleFlorian Klink2018-12-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OS Login package enables the following components: AuthorizedKeysCommand to query valid SSH keys from the user's OS Login profile during ssh authentication phase. NSS Module to provide user and group information PAM Module for the sshd service, providing authorization and authentication support, allowing the system to use data stored in Google Cloud IAM permissions to control both, the ability to log into an instance, and to perform operations as root (sudo).
| | * | | | security.pam.services.<name?>.: add ↵Florian Klink2018-12-21
| | | | | | | | | | | | | | | | | | | | | | | | googleOsLogin(AccountVerification|Authentication)
| * | | | | fix infinite recursion caused by the unnecessary inspection of options + fix ↵msteen2018-12-24
| | | | | | | | | | | | | | | | | | | | | | | | is parent of mount point check (#51541)
| * | | | | Merge pull request #52721 from samueldr/aarch64/limited-supportSamuel Dionne-Riel2018-12-23
| |\ \ \ \ \ | | | | | | | | | | | | | | Fixes eval issues in hydra by setting AArch64 as limited support
| | * | | | | nixos/release-combined.nix: makes aarch64-linux limited supportSamuel Dionne-Riel2018-12-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is because it will not eval properly with `hydra-eval-jobs`. ``` $ ...hydra/result/bin/hydra-eval-jobs \ --arg nixpkgs '{ outPath = ./.; revCount = 123; shortRev = "4567"; }' \ -I "$PWD" \ nixos/release-combined.nix ``` It fails with: ``` Too many heap sections: Increase MAXHINCR or MAX_HEAP_SECTS ```
| | * | | | | nixos/release-combined.nix: Adds missing aarch64 constituentsSamuel Dionne-Riel2018-12-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This will block channel advancing, even if it is limited support.
| * | | | | | nixos/vdr: don't delete recordingsJörg Thalheim2018-12-23
| | | | | | |
| * | | | | | Merge pull request #52686 from Mic92/vdrJörg Thalheim2018-12-23
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | vdr: revisited version of https://github.com/NixOS/nixpkgs/pull/32050
| | * | | | | | nixos/vdr: create video directory automaticallyJörg Thalheim2018-12-22
| | | | | | | |
| | * | | | | | vdr: initial at 2.4.0 and nixos moduleChristian Kögler2018-12-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | used same plugin mechanism as kodi does
| * | | | | | | Add IPFS warningEmery Hemingway2018-12-22
| | | | | | | |
| * | | | | | | nixos/displayManager: only install wayland sessions if they exist in ↵worldofpeace2018-12-22
| | |_|/ / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | extraSessionFilePackages Not everyone is using wayland just yet.
| * | | | | | security.pam: make pam_unix.so required, not sufficientFlorian Klink2018-12-21
| | |/ / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Having pam_unix set to "sufficient" means early-succeeding account management group, as soon as pam_unix.so is succeeding. This is not sufficient. For example, nixos modules might install nss modules for user lookup, so pam_unix.so succeeds, and we end the stack successfully, even though other pam account modules might want to do more extensive checks. Other distros seem to set pam_unix.so to 'required', so if there are other pam modules in that management group, they get a chance to do some validation too. For SSSD, @PsyanticY already added a workaround knob in https://github.com/NixOS/nixpkgs/pull/31969, while stating this should be the default anyway. I did some thinking in what could break - after this commit, we require pam_unix to succeed, means we require `getent passwd $username` to return something. This is the case for all local users due to the passwd nss module, and also the case for all modules installing their nss module to nsswitch.conf - true for ldap (if not explicitly disabled) and sssd. I'm not so sure about krb5, cc @eqyiel for opinions. Is there some nss module loaded? Should the pam account module be placed before pam_unix? We don't drop the `security.pam.services.<name?>.sssdStrictAccess` option, as it's also used some lines below to tweak error behaviour inside the pam sssd module itself (by changing it's 'control' field). This is also required to get admin login for Google OS Login working (#51566), as their pam_oslogin_admin accounts module takes care of sudo configuration.
| * | | | | Merge pull request #51813 from samueldr/aarch64/disable-non-arm-builds-part-1Samuel Dionne-Riel2018-12-20
| |\ \ \ \ \ | | | | | | | | | | | | | | aarch64: ZHF for aarch64 (1/??)
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-11 16:28:59 +0000