From f315259280b7e6df1a9c601f3158ab782a3bd064 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Thu, 21 Jan 2021 10:24:13 +0100 Subject: [PATCH 1/4] perl: remove obsolete parallel building patch --- pkgs/development/interpreters/perl/default.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix index 6b7d1d4d99cc..c39af361eaf1 100644 --- a/pkgs/development/interpreters/perl/default.nix +++ b/pkgs/development/interpreters/perl/default.nix @@ -39,12 +39,6 @@ let (if (versionOlder version "5.31.1") then ./no-sys-dirs-5.29.patch else ./no-sys-dirs-5.31.patch) ] - ++ optional (versionOlder version "5.29.6") - # Fix parallel building: https://rt.perl.org/Public/Bug/Display.html?id=132360 - (fetchurl { - url = "https://rt.perl.org/Public/Ticket/Attachment/1502646/807252/0001-Fix-missing-build-dependency-for-pods.patch"; - sha256 = "1bb4mldfp8kq1scv480wm64n2jdsqa3ar46cjp1mjpby8h5dr2r0"; - }) ++ optional stdenv.isSunOS ./ld-shared.patch ++ optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ] ++ optional crossCompiling ./MakeMaker-cross.patch; From fc8a3104064074e0302376dc8a9d5143baa5cb3b Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Thu, 21 Jan 2021 10:21:06 +0100 Subject: [PATCH 2/4] perldevel: 5.33.5 -> 5.33.6, perl-cross: b444794 -> 4c55233 --- pkgs/development/interpreters/perl/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix index 6b7d1d4d99cc..9268667c7930 100644 --- a/pkgs/development/interpreters/perl/default.nix +++ b/pkgs/development/interpreters/perl/default.nix @@ -174,11 +174,11 @@ let priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl` }; } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec { - crossVersion = "b4447944a0aeff9590dc023d64f8ddf3de7669fb"; # Dec 22, 2020 + crossVersion = "4c55233ae95a6aef4d93291fe8ad12709b11e575"; # Jan 21, 2021 perl-cross-src = fetchurl { url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz"; - sha256 = "1cignplkb29kcvkfwshakyij71w8srlfqbnb9pla98vya6r82rnb"; + sha256 = "04bxn43ir7b4c2bb1z1l71l93hrysjv00h879nm70m99q6vxq2hc"; }; depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ]; @@ -214,7 +214,7 @@ in { perldevel = common { perl = pkgs.perldevel; buildPerl = buildPackages.perldevel; - version = "5.33.5"; - sha256 = "04iprc8qz6vpbgzqgwja5rc3csvmgq1rnnnl382l39hy69fsdqpr"; + version = "5.33.6"; + sha256 = "1fx6b2q7wzd0xwy7qkmkvd5bdm09d3zfnynrb6afl9ghd8ww56fv"; }; } From b91284626711400eb6f7d8a6600604b9879d8b38 Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sat, 16 Jan 2021 23:15:52 +0100 Subject: [PATCH 3/4] nixos/tests/usbguard: init --- nixos/tests/all-tests.nix | 1 + nixos/tests/usbguard.nix | 62 +++++++++++++++++++++ pkgs/os-specific/linux/usbguard/default.nix | 3 + 3 files changed, 66 insertions(+) create mode 100644 nixos/tests/usbguard.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 902c3bbc65e9..966c78446574 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -402,6 +402,7 @@ in unbound = handleTest ./unbound.nix {}; unit-php = handleTest ./web-servers/unit-php.nix {}; upnp = handleTest ./upnp.nix {}; + usbguard = handleTest ./usbguard.nix {}; uwsgi = handleTest ./uwsgi.nix {}; v2ray = handleTest ./v2ray.nix {}; vault = handleTest ./vault.nix {}; diff --git a/nixos/tests/usbguard.nix b/nixos/tests/usbguard.nix new file mode 100644 index 000000000000..a5d78f316fb2 --- /dev/null +++ b/nixos/tests/usbguard.nix @@ -0,0 +1,62 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "usbguard"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ tnias ]; + }; + + machine = + { ... }: + { + services.usbguard = { + enable = true; + IPCAllowedUsers = [ "alice" "root" ]; + + # As virtual USB devices get attached to the "QEMU USB Hub" we need to + # allow Hubs. Otherwise we would have to explicitly allow them too. + rules = '' + allow with-interface equals { 09:00:00 } + ''; + }; + imports = [ ./common/user-account.nix ]; + }; + + testScript = '' + # create a blank disk image for our fake USB stick + with open(machine.state_dir + "/usbstick.img", "wb") as stick: + stick.write(b"\x00" * (1024 * 1024)) + + # wait for machine to have started and the usbguard service to be up + machine.wait_for_unit("usbguard.service") + + with subtest("IPC access control"): + # User "alice" is allowed to access the IPC interface + machine.succeed("su alice -c 'usbguard list-devices'") + + # User "bob" is not allowed to access the IPC interface + machine.fail("su bob -c 'usbguard list-devices'") + + with subtest("check basic functionality"): + # at this point we expect that no USB HDD is connected + machine.fail("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'") + + # insert usb device + machine.send_monitor_command( + f"drive_add 0 id=stick,if=none,file={stick.name},format=raw" + ) + machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick") + + # the attached USB HDD should show up after a short while + machine.wait_until_succeeds("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'") + + # at this point there should be a **blocked** USB HDD + machine.succeed("usbguard list-devices | grep -E 'block.*QEMU USB HARDDRIVE'") + machine.fail("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'") + + # allow storage devices + machine.succeed("usbguard allow-device 'with-interface { 08:*:* }'") + + # at this point there should be an **allowed** USB HDD + machine.succeed("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'") + machine.fail("usbguard list-devices | grep -E ' block .*QEMU USB HARDDRIVE'") + ''; +}) diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix index 55832dc7adeb..7d4563baee44 100644 --- a/pkgs/os-specific/linux/usbguard/default.nix +++ b/pkgs/os-specific/linux/usbguard/default.nix @@ -3,6 +3,7 @@ , fetchFromGitHub , autoreconfHook , installShellFiles +, nixosTests , asciidoc , pkg-config , libxslt @@ -73,6 +74,8 @@ stdenv.mkDerivation rec { installShellCompletion --zsh --name _usbguard scripts/usbguard-zsh-completion ''; + passthru.tests = nixosTests.usbguard; + meta = with lib; { description = "The USBGuard software framework helps to protect your computer against BadUSB"; longDescription = '' From f8013960c6a3823685a175b7e8288b48e1921b6c Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Sat, 23 Jan 2021 09:45:55 +1000 Subject: [PATCH 4/4] minikube: 1.16.0 -> 1.17.0 https://github.com/kubernetes/minikube/releases/tag/v1.17.0 --- pkgs/applications/networking/cluster/minikube/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix index 9acb5f319ca4..570cb57a357e 100644 --- a/pkgs/applications/networking/cluster/minikube/default.nix +++ b/pkgs/applications/networking/cluster/minikube/default.nix @@ -11,9 +11,9 @@ buildGoModule rec { pname = "minikube"; - version = "1.16.0"; + version = "1.17.0"; - vendorSha256 = "0nc2f9h77h24f0nvai5wvgmf1gh09dqfwrb6d5qghmq03a459san"; + vendorSha256 = "sha256-cA0sgH00XawwaOAGCDbabmBE/+5Y87kThXgPe5zwlro="; doCheck = false; @@ -21,7 +21,7 @@ buildGoModule rec { owner = "kubernetes"; repo = "minikube"; rev = "v${version}"; - sha256 = "00dn8yy7mna0j8rdcnxbgnd5vkjdkqij8akgqhvbd32kxpqss890"; + sha256 = "sha256-IQ/AAr5b8ZOaQKkSrU8JsPxjqAwVmT4Kt3hf3e1dMeA="; }; nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];