Linus Heckemann
6673a4988e
gnupg: use libusb1 ( #85374 )
...
* gnupg: use libusb1
This fixes scdaemon's direct ccid support.
* systemd: fix gnupg-minimal
2020-04-21 08:35:40 +02:00
Frederik Rietdijk
803b3d296c
Merge staging-next into staging
2020-04-21 08:29:51 +02:00
oxalica
7760cff5d7
util-linux: 2.33.2 -> 2.35.1
2020-04-21 08:12:29 +02:00
kraem
523fe98821
linux/hardened-patches/4.19.116: 4.19.116.NixOS-a -> 4.19.116.a
2020-04-20 10:05:36 -04:00
kraem
45343beffe
linux/hardened-patches/5.4.33: 5.4.33.NixOS-a -> 5.4.33.a
2020-04-20 10:05:36 -04:00
kraem
48d908b731
linux/hardened-patches/5.5.18: init at 5.5.18.a
2020-04-20 10:05:36 -04:00
kraem
0fd9293703
linux/hardened-patches/5.6.5: init at 5.6.5.a
2020-04-20 10:05:36 -04:00
kraem
e7a65e6c41
linux/hardened-patches/5.5.17: remove
2020-04-20 10:05:36 -04:00
kraem
eb41f8122e
linux/hardened-patches/5.6.4: remove
2020-04-20 10:05:36 -04:00
kraem
8879086cfc
linux: 5.5.17 -> 5.5.18
2020-04-20 10:05:36 -04:00
kraem
4307923b86
linux: 5.6.4 -> 5.6.5
2020-04-20 10:05:36 -04:00
Yegor Timoshenko
6f1165a0cb
Merge pull request #84522 from emilazy/add-linux-hardened-patches
...
linux_*_hardened: use linux-hardened patch set
2020-04-19 20:01:35 +03:00
Peter Simons
00222dbb0e
bbswitch: fix build with Linux kernel version >= 5.6.0
...
Fixes https://github.com/NixOS/nixpkgs/issues/85564 .
2020-04-19 16:25:48 +02:00
Maximilian Bosch
19de59a9be
Merge pull request #85334 from flokli/systemd-mainline2
...
systemd: 243.7 -> 245
2020-04-19 16:02:52 +02:00
Vladimír Čunát
e233a9d4dd
Merge #84442 : staging-next branch
2020-04-18 23:11:00 +02:00
John Ericson
1ea80c2cc3
Merge remote-tracking branch 'upstream/master' into staging
2020-04-18 15:40:49 -04:00
Jan Tojnar
09c4736405
Merge pull request #83755 from jtojnar/jcat-0.1
2020-04-18 20:38:24 +02:00
Mario Rodas
e5dd52b99d
Merge pull request #85422 from marsam/update-lxc
...
lxc: 4.0.1 -> 4.0.2
2020-04-18 13:24:22 -05:00
Jan Tojnar
06e5800a73
fwupd: 1.3.9 → 1.4.0
...
https://github.com/fwupd/fwupd/releases/tag/1.4.0
2020-04-18 19:51:08 +02:00
Pavol Rusnak
fadcfc3ea4
treewide: per RFC45, remove more unquoted URLs
2020-04-18 14:04:37 +02:00
Vladimír Čunát
d96487b9ca
Merge branch 'master' into staging-next
...
Hydra nixpkgs: ?compare=1582510
2020-04-18 07:42:26 +02:00
John Ericson
cc880cd91f
Merge remote-tracking branch 'upstream/master' into staging
2020-04-17 18:50:55 -04:00
John Ericson
e99a409065
Merge pull request #85190 from Ericson2314/fwupdate
...
fwupdate: Clean up -I flags
2020-04-17 18:50:22 -04:00
John Ericson
33c2a76c5e
Merge remote-tracking branch 'upstream/master' into staging
2020-04-17 18:40:51 -04:00
Emily
7fdfe5381d
linux_*_hardened: don't set FORTIFY_SOURCE
...
Upstreamed in anthraxx/linux-hardened@d12c0d5f0c .
2020-04-17 16:13:39 +01:00
Emily
ed89b5b3f1
linux_*_hardened: don't set PANIC_ON_OOPS
...
Upstreamed in anthraxx/linux-hardened@366e0216f1 .
2020-04-17 16:13:39 +01:00
Emily
0d5f1697b7
linux_*_hardened: don't set SLAB_FREELIST_{RANDOM,HARDENED}
...
Upstreamed in anthraxx/linux-hardened@786126f177 ,
anthraxx/linux-hardened@44822ebeb7 .
2020-04-17 16:13:39 +01:00
Emily
4fb796e341
linux_*_hardened: don't set HARDENED_USERCOPY_FALLBACK
...
Upstreamed in anthraxx/linux-hardened@c1fe7a68e3 ,
anthraxx/linux-hardened@2c553a2bb1 .
2020-04-17 16:13:39 +01:00
Emily
3eeb5240ac
linux_*_hardened: don't set DEBUG_LIST
...
Upstreamed in anthraxx/linux-hardened@6b20124185 .
2020-04-17 16:13:39 +01:00
Emily
0611462e33
linux_*_hardened: don't set {,IO_}STRICT_DEVMEM
...
STRICT_DEVMEM is on by default in upstream 5.6.2; IO_STRICT_DEVMEM is
turned on by anthraxx/linux-hardened@103d23cb66 .
Note that anthraxx/linux-hardened@db1d27e10e
disables DEVMEM by default, so this is only relevant if that default is
overridden to turn it back on.
2020-04-17 16:13:39 +01:00
Emily
303bb60fb1
linux_*_hardened: don't set DEBUG_WX
...
Upstreamed in anthraxx/linux-hardened@55ee7417f3 .
2020-04-17 16:13:39 +01:00
Emily
33b94e5a44
linux_*_hardened: don't set BUG_ON_DATA_CORRUPTION
...
Upstreamed in anthraxx/linux-hardened@3fcd15014c .
2020-04-17 16:13:39 +01:00
Emily
db6b327508
linux_*_hardened: don't set LEGACY_VSYSCALL_NONE
...
Upstreamed in anthraxx/linux-hardened@d300b0fdad .
2020-04-17 16:13:39 +01:00
Emily
130f6812be
linux_*_hardened: don't set RANDOMIZE_{BASE,MEMORY}
...
These are on by default for x86 in upstream linux-5.6.2, and turned on
for arm64 by anthraxx/linux-hardened@90f9670bc3 .
2020-04-17 16:13:39 +01:00
Emily
8c68055432
linux_*_hardened: don't set MODIFY_LDT_SYSCALL
...
Upstreamed in anthraxx/linux-hardened@05644876fa .
2020-04-17 16:13:39 +01:00
Emily
8efe83c22e
linux_*_hardened: don't set DEFAULT_MMAP_MIN_ADDR
...
Upstreamed in anthraxx/linux-hardened@f1fe0a64dd .
2020-04-17 16:13:39 +01:00
Emily
3d4c8ae901
linux_*_hardened: don't set VMAP_STACK
...
This has been on by default upstream for as long as it's been an option.
2020-04-17 16:13:39 +01:00
Emily
7d5352df31
linux_*_hardened: don't set X86_X32
...
As far as I can tell, this has never defaulted to on upstream, and our
common kernel configuration doesn't turn it on, so the attack surface
reduction here is somewhat homeopathic.
2020-04-17 16:13:39 +01:00
Emily
0d4f35efd4
linux_*_hardened: use linux-hardened patch set
...
This is an updated version of the former upstream,
https://github.com/AndroidHardeningArchive/linux-hardened , and provides
a minimal set of additional hardening patches on top of upstream.
The patch already incorporates many of our hardened profile defaults,
and releases are timely (Linux 5.5.15 and 5.6.2 were released on
2020-04-02; linux-hardened patches for them came out on 2020-04-03 and
2020-04-04 respectively).
2020-04-17 16:13:39 +01:00
Emily
3d01e802bd
linux: explicitly enable SYSVIPC
...
The linux-hardened patch set removes this default, probably because of
its original focus on Android kernel hardening.
2020-04-17 16:12:29 +01:00
Tim Steinbach
e341107367
linux: 5.4.32 -> 5.4.33
2020-04-17 08:34:01 -04:00
Tim Steinbach
d9258d33be
linux: 4.19.115 -> 4.19.116
2020-04-17 08:34:01 -04:00
Vladimír Čunát
acb4710214
alsaTools: 1.1.7 -> 1.2.2
...
Fixes build regression (after alsa update, I assume).
Despite the version number change, the diff is trivial:
https://git.alsa-project.org/?p=alsa-tools.git;a=log;h=refs/tags/v1.2.2
2020-04-17 13:49:20 +02:00
Florian Klink
b3f14109a8
systemd: explicitly disable portabled for now
...
This hasn't worked with 243, let's disable it for now, until we have
tests and can ensure it works and keeps working.
2020-04-17 00:31:03 +02:00
Florian Klink
ce7c1230ea
systemd: explicitly disable homed for now
...
We don't currently have tests to ensure it works and keeps working.
So instead of having it accidentially working, and possibly breaking it
in the future, disable it for now.
2020-04-17 00:30:52 +02:00
Jörg Thalheim
c18ceab106
systemd: remove myself as maintainer
2020-04-17 00:30:52 +02:00
Florian Klink
b0b7f673dc
systemd: 245 -> 245.3
2020-04-17 00:30:52 +02:00
Florian Klink
d2871a723a
systemd: 244.3 -> 245
2020-04-17 00:30:51 +02:00
Florian Klink
9de0ac3770
systemd: 243.7 -> 244.3
...
This required some changes in how we treat DEFAULT_PATH_NORMAL.
2020-04-17 00:30:51 +02:00
Florian Klink
b4cbcba5b1
systemd: update paths kmod-static-nodes.service
...
The previous patch just removed a `ConditionFileNotEmpty=…` line from
`kmod-static-nodes.service` referring to a location not existing on
NixOS. We know better, and can actually replace this Condition to point
to `run/booted-system/kernel-modules/lib/modules/%v/`, instead of just
patching it out.
2020-04-17 00:28:58 +02:00