about summary refs log tree commit diff
path: root/pkgs/applications/virtualization
Commit message (Collapse)AuthorAge
* Merge pull request #26503 from vdemeester/update-runcJörg Thalheim2017-06-10
|\ | | | | Update runc to 1.0.0-rc3
| * Update runc to 1.0.0-rc3Vincent Demeester2017-06-10
| | | | | | | | | | | | | | - Fix compilation problems - Remove patches as those are included in the sources now Signed-off-by: Vincent Demeester <vincent@sbr.pm>
* | Merge pull request #26489 from michalpalka/xen-securityGraham Christensen2017-06-09
|\ \ | | | | | | xen: patch for XSAs: 206, 211, 212, 213, 214 and 215
| * | xen: patch for XSAs: 206, 211, 212, 213, 214 and 215Michał Pałka2017-06-09
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | XSA-206 Issue Description: > xenstored supports transactions, such that if writes which would > invalidate assumptions of a transaction occur, the entire transaction > fails. Typical response on a failed transaction is to simply retry > the transaction until it succeeds. > > Unprivileged domains may issue writes to xenstore which conflict with > transactions either of the toolstack or of backends such as the driver > domain. Depending on the exact timing, repeated writes may cause > transactions made by these entities to fail indefinitely. More: https://xenbits.xen.org/xsa/advisory-206.html XSA-211 Issue Description: > When a graphics update command gets passed to the VGA emulator, there > are 3 possible modes that can be used to update the display: > > * blank - Clears the display > * text - Treats the display as showing text > * graph - Treats the display as showing graphics > > After the display geometry gets changed (i.e., after the CIRRUS VGA > emulation has resized the display), the VGA emulator will resize the > console during the next update command. However, when a blank mode is > also selected during an update, this resize doesn't happen. The resize > will be properly handled during the next time a non-blank mode is > selected during an update. > > However, other console components - such as the VNC emulation - will > operate as though this resize had happened. When the display is > resized to be larger than before, this can result in a heap overflow > as console components will expect the display buffer to be larger than > it is currently allocated. More: https://xenbits.xen.org/xsa/advisory-211.html XSA-212 Issue Description: > The XSA-29 fix introduced an insufficient check on XENMEM_exchange > input, allowing the caller to drive hypervisor memory accesses outside > of the guest provided input/output arrays. More: https://xenbits.xen.org/xsa/advisory-212.html XSA-213 Issue Description: > 64-bit PV guests typically use separate (root) page tables for their > kernel and user modes. Hypercalls are accessible to guest kernel > context only, which certain hypercall handlers make assumptions on. > The IRET hypercall (replacing the identically name CPU instruction) > is used by guest kernels to transfer control from kernel mode to user > mode. If such an IRET hypercall is placed in the middle of a multicall > batch, subsequent operations invoked by the same multicall batch may > wrongly assume the guest to still be in kernel mode. If one or more of > these subsequent operations involve operations on page tables, they may > be using the wrong root page table, confusing internal accounting. As > a result the guest may gain writable access to some of its page tables. More: https://xenbits.xen.org/xsa/advisory-213.html XSA-214 Issue Description: > The GNTTABOP_transfer operation allows one guest to transfer a page to > another guest. The internal processing of this, however, does not > include zapping the previous type of the page being transferred. This > makes it possible for a PV guest to transfer a page previously used as > part of a segment descriptor table to another guest while retaining the > "contains segment descriptors" property. > > If the destination guest is a PV one of different bitness, it may gain > access to segment descriptors it is not normally allowed to have, like > 64-bit code segments in a 32-bit PV guest. > > If the destination guest is a HVM one, that guest may freely alter the > page contents and then hand the page back to the same or another PV > guest. > > In either case, if the destination PV guest then inserts that page into > one of its own descriptor tables, the page still having the designated > type results in validation of its contents being skipped. More: https://xenbits.xen.org/xsa/advisory-214.html XSA-215 Issue Description: > Under certain special conditions Xen reports an exception resulting > from returning to guest mode not via ordinary exception entry points, > but via a so call failsafe callback. This callback, unlike exception > handlers, takes 4 extra arguments on the stack (the saved data > selectors DS, ES, FS, and GS). Prior to placing exception or failsafe > callback frames on the guest kernel stack, Xen checks the linear > address range to not overlap with hypervisor space. The range spanned > by that check was mistakenly not covering these extra 4 slots. More: https://xenbits.xen.org/xsa/advisory-215.html
* | virtualboxGuestAdditions: don't install setuid/setgidVladimír Čunát2017-06-09
| |
* | xen: fix pygrub by making sure it is wrappedMichał Pałka2017-06-09
|/ | | | | | Recent commit #c10af9e744c91dff1ccc07a52a0b57d1e4d339f3 changed the behaviour of wrapPythonPrograms, which caused pygrub to no longer being wrapped. This commit fixes this.
* virtmanager: Fix python import errormidchildan2017-06-05
|
* OVMF: fix buildRobin Gloster2017-05-29
| | | | $fd for the output was overwritten during the build
* rkt: 1.25.0 -> 1.26.0Tim Steinbach2017-05-25
|
* lkl: split outputsJoachim Fasting2017-05-24
| | | | | Breaking out lib allows users to link against lkl without pulling the kitchen sink into their closure.
* lkl: break description into longDescription and a briefer descrJoachim Fasting2017-05-24
|
* lkl: d747073 -> 2017-03-24Joachim Fasting2017-05-24
| | | | | | | | | - Moves to a more recent kernel (4.10, I think ...) - API break re the previous version - cptofs: fix root directory copy - add support for disks with custom ops - add LKL_HIJACK_NET_QDISC to configure qdisc policy - add LKL_HIJACK_SYSCTL to configure sysctl values
* lkl: bc & python are native build inputsJoachim Fasting2017-05-24
|
* lkl: add meta.homepageJoachim Fasting2017-05-24
|
* virtmanager-qt: 0.43.70 -> 0.43.70.2Peter Hoeg2017-05-23
|
* Merge pull request #25896 from joachifm/ovmfJoachim F2017-05-21
|\ | | | | ovmf: split firmware image files
| * OVMF: separate output for ovmf binariesJoachim Fasting2017-05-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OVMF{,CODE,VARS}.fd are now available in a dedicated fd output, greatly reducing the closure in the common case where only those files are used (a few MBs versus several hundred MBs for the full OVMF). Note: it's unclear why `dontPatchELF` is now necessary for the build to pass (on my end, at any rate) but it doesn't make much sense to run this fixup anyway, Note: my reading of xen's INSTALL suggests that --with-system-ovmf should point directly to the OVMF binary. As such, the previous invocation was incorrect (it pointed to the root of the OVMF tree). In any case, I have only built xen with `--with-system-ovmf`, I have not tested it. Fixes https://github.com/NixOS/nixpkgs/issues/25854 Closes https://github.com/NixOS/nixpkgs/pull/25855
* | treewide: s,enableParallelBuild(s),enableParallelBuilding,gJoachim Fasting2017-05-20
|/
* docker-proxy: remove go referencesJörg Thalheim2017-05-17
| | | | related to #25861
* virtmanager-qt: 0.42.67 -> 0.43.70Peter Hoeg2017-05-14
|
* docker-edge: 17.04 to 17.05Vincent Demeester2017-05-09
| | | | Signed-off-by: Vincent Demeester <vincent@sbr.pm>
* Python: replace requests2 with requests tree-wideFrederik Rietdijk2017-05-07
| | | | | | | See f63eb5857352705665411130d4f1638d55dd8c58 The `requests2` attribute now throws an error informing that `requests` should be used instead.
* virt-manager: add requests as dependencyOlegs Jeremejevs2017-05-07
|
* virtinst: do not depend on glanceclientFrederik Rietdijk2017-05-07
| | | | because its not a dependency and because its broken.
* virt-manager: do not depend on glanceclientFrederik Rietdijk2017-05-07
| | | | because its not a dependency and because its broken.
* virtualisation-xen: Fix xendomains startupMichał Pałka2017-04-27
| | | | | * Revert to using bash, not sh for the xendomains script to avoid syntax error * Rewrite /bin/ls to ls in the xendomains script
* OVMF: get version number from edk2Bjørn Forsman2017-04-23
| | | | | | | OVMF is built from edk2 sources so that's where its version number comes from (logically). The edk2 version number is 2014-12-10, so this change only ensures the version numbers won't drift apart in the future. (There is no hash change.)
* qemu: 2.8.1 -> 2.9.0Volth2017-04-23
|
* Merge pull request #24549 from volth/qemu-2.8.1Michael Raskin2017-04-23
|\ | | | | qemu: 2.8.0 -> 2.8.1
| * qemu: 2.8.0 -> 2.8.1Volth2017-04-02
| |
* | Merge pull request #24632 from NeQuissimus/docker_17_04Tim Steinbach2017-04-05
|\ \ | | | | | | docker-edge: init at 17.04
| * | docker-edge: init at 17.04Tim Steinbach2017-04-05
| | |
* | | docker-distribution: 2.5.1 -> 2.6.0Tim Steinbach2017-04-04
|/ /
* / docker: 17.03.0 -> 17.03.1Tim Steinbach2017-04-04
|/
* libvirt packages: fix & clean up dependenciesFranz Pletz2017-03-28
|
* virtualbox: a more maintenance-free way of patching refs to ↵Kosyrev Serge2017-03-28
| | | | dlopen()-affected dependencies
* virtualbox: wrap with Qt dependenciesNikolay Amiantov2017-03-28
| | | | | Fixes GTK file open dialogs. Also make sure that linked applications really exist, and update their list.
* virt-manager: needs file for building translationsFranz Pletz2017-03-25
|
* virt-manager: 1.4.0 -> 1.4.1 (#24149)volth2017-03-21
|
* virtualbox: 5.1.14 -> 5.1.18Robin Gloster2017-03-20
|
* Merge pull request #23624 from volth/virt-viewer-5.0Michael Raskin2017-03-18
|\ | | | | virt-viewer: 2.0 -> 5.0
| * virt-viewer: 2.0 -> 5.0Volth2017-03-14
| |
* | virtmanager-qt: 0.39.60 -> 0.42.67Peter Hoeg2017-03-18
| |
* | Merge pull request #23872 from NeQuissimus/docker_17_03_0Tim Steinbach2017-03-17
|\ \ | | | | | | docker: 1.13.1 -> 17.03.0-ce
| * | docker: 1.13.1 -> 17.03.0-ceTim Steinbach2017-03-14
| |/
* / xhyve: update and fix to use our Hypervisor frameworkDan Peebles2017-03-14
|/ | | | | | (this is a cherry-picked version of f3b65f67d98a2e67c739d4b76b3340eda1dd06f4, which got reverted because it depended on my 10.11 frameworks, which were flawed)
* runc: use removeReferencesToJoachim Fasting2017-03-11
|
* docker: use removeReferencesToJoachim Fasting2017-03-11
|
* containerd: use removeReferencesToJoachim Fasting2017-03-11
|
* qemu_test: Rebase force-uid0-on-9p.patchaszlig2017-03-11
| | | | | | | | | | | | | | This reverts commit 3a4e2376e444fd7664102af00a34c65b47e271ec. The reverted commit caused the fix for CVE-2016-9602 not to be applied for qemu_test because it conflicts with the force-uid0-on-9p.patch. So with the rebase of the patch on top of the changes of the CVE-2016-9602.patch, both patches no longer conflict with each other. I've tested this with the "misc" NixOS test and it succeeds. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-19 19:52:05 +0000