This is espacially cruicial when it comes to Nix 1.9, where we even have
a more restrictive /nix/store. In any event, VirtualBox in hardenend
mode doesn't have to check the /nix/store path, because it's read-only
on NixOS systems. So this check would not introduce more security but
more hurdles, thus I'm removing it (of course _only_ for /nix/store).
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
New maintenance release, changes:
* VMM: emulation fix for the ENTER instruction under certain
conditions; fixes Solaris 10 guests (VT-x without unrestricted guest
execution)
* VMM: fix for handling NMIs on Linux hosts with X2APIC enabled
* NAT/NAT Network: fix connection drops when the host's DHCP lease was
renewed (4.3.22 regression; Windows hosts only)
* NAT: don't crash on an empty domain list when switching the DNS host
configuration (4.3.22 regression; Mac OS X hosts only)
* PXE: re-enable it on Windows hosts (4.3.22 regression; Windows hosts
only)
* Shared Folders: fixed a problem with Windows guests (4.3.22
regression)
* Audio: improved record quality when using the DirectSound audio
backend
* VBoxManage: when executing the controlvm command take care that the
corresponding VM runtime changes are saved permanently
* Windows Installer: properly install the 32-bit version of VBoxRes.dll
on 32-bit hosts
* Linux hosts / guests: Linux 4.0 fixes
* OS/2 Additions: fixed mouse integration (4.3.22 regression)
* X11 Additions: fixed a sporadic failure to deactivate virtual screens
Full changelog with bug IDs can be found at:
https://www.virtualbox.org/wiki/Changelog
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
The Nixos Qemu VM that are used for VM tests can now start without
boot menu even when using a bootloader.
The Nixos Qemu VM with bootloader can emulate a EFI boot now.
Because we have to rely on setuid wrappers on NixOS, we can't easily
hardcode the executable paths and set it 4755. So for all calls, we need
to change the runtime path executable directory to /var/setuid-wrappers/
and for verification we need to retain the executable directory.
Also note, that usually VBoxNetAdpCtl, VBoxNetDHCP, VBoxNetNAT, VBoxSDL
and VBoxVolInfo don't reside in directories that are commonly in PATH,
but in /usr/lib/virtualbox in most mainstream distros. But because the
names of these executables are distinctive enough to not cause
collisions with other setuid programs, I'll leave it like that and not
patch up setuid-wrappers.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Not really changes anything in functionality, but makes it easier to
change the build type to "debug", for example.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Just accidentally found this while debugging and it's needed for
fetching a few interface details, not sure however whether because of
this anything has been broken so far.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Instead of coping it to $out and later deleting it, we now exclude the
src directory during copy. Also, we no longer cd into the release
directory during installPhase, which should make sure that we are
constantly in $sourceRoot.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes this error, as seen when trying to open a guest VM when
virt-viewer is accessed over ssh with X forwarding:
GLib-GIO-ERROR **: Settings schema 'org.gnome.system.proxy' is not installed
A similar issue was fixed for virt-manager in commit
fb8a2b3be7 ("virt-manager: fix missing
schema error")
We divert to the $out/share/virtualbox directory only if we have
hardening enabled, so let's put the extension pack into
$out/libexec/virtualbox instead if we're compiling without hardening.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
* Add missing dependency on 'spice_protocol'
* Fix new build error which came now that ./configure enables SPICE support:
building virt-viewer
CCLD virt-viewer
/nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/ld: cannot find -lgdbm
/nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/ld: cannot find -lcap
collect2: error: ld returned 1 exit status
Fix by adding gddbm and libcap as inputs. Yes, libcap is needed
_in addition_ to libcap_ng (I tested removing libcap_ng, it failed).
Without this change, virt-viewer cannot be used with guests machines
that uses SPICE.
Yes, this is only on the package level, so it's possible to use
VirtualBox for example installed by nix-env -i, which of course doesn't
have access to the functionality provided by the various VirtualBox
kernel modules.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
With hardening, we need to go a bit further rather than just allowing
/nix/store being world-writable. We now use fakeroot to make sure the
VBoxExtPackHelperApp won't moan that the files are not owned by root.
They are, but only outside of the chrooted build process.
Another issue with using fakeroot is that it doesn't seem to cope well
with arguments that contain spaces. That's why I've piped the call into
${stdenv.shell}.
Now, the really gory and confusing part is the introduction of
VBOX_PATH_APP_PRIVATE_ARCH_TOP and the change of VBOX_PATH_APP_PRIVATE.
The VBOX_PATH_APP_PRIVATE_ARCH is *only* for modules and is checked by
the hardened implementation against whether things like VMMR0.r0 or
VBoxVMM.so reside in that directory. As a side note: I admit that the
whole libexec directory is quite polluted with stuff that shouldn't be
there, but for now we've broken enough things and will tear apart the
whole structure at some day in the future[TM].
For the confusing part we have VBOX_PATH_APP_PRIVATE_ARCH_TOP, which
_should_ be the same as VBOX_PATH_APP_PRIVATE_ARCH but unfortunately,
the hardened implementation is checking against this directory (in
IsValidBaseDir) for the extension pack(why!?).
Of course, we could put even that into the libexec directory, somewhat
similar as the official package, but after all, let's at least *try* to
separate things.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
We are already checking whether /nix/store has the sticky bit set, so if
it is world-writable as well it doesn't mean that the actual store path
is writable. Let alone the fact that it is only writable during the
build process.
This should fix installing the extension pack when enableExtensionPack
is used.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
VirtualBox with hardening support requires the main binaries to be
setuid root. Using VBOX_WITH_RUNPATH, we ensure that the RPATHs are
pointing to the libexec directory and we also need to unset
VBOX_WITH_ORIGIN to make sure that the build system is actually setting
those RPATHs.
The hardened.patch implements two things:
* Set the binary directory to the setuid-wrappers dir so that
VboxSVC calls them instead of the binaries from the store path. The
reason behind this is because nothing in the Nix store can have the
setuid flag.
* Excempt /nix/store from the group permission check, because while it
is group-writeable indeed it also has the sticky bit set (and also
the whole store is mounted read-only on most NixOS systems), so we're
checking on that as well.
Right now, the hardened.patch uses /nix/store and /var/setuid-wrappers
directly, so someone would ever want to change those on a NixOS system,
please provide a patch to set those paths on build time. However, for
simplicity, it's best to do it when we _really_ need it.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Traversing the full source tree is unneccessary, because the calls are
only done within make files. Hence we only substitute make files now.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
The dependency on gsettings_desktop_schemas wasn't specified correctly.
Now it works.
Fixes this error, as seen when trying to open a guest VM when
virt-manager is accessed over ssh with X forwarding:
GLib-GIO-ERROR **: Settings schema 'org.gnome.system.proxy' is not installed
Now, Bochs expression has a bunch of configurable options!
Unhappily, it is a big and complex project, and some configure options
are in constant clash. But the set created for now is very usable and
stable.
Closes#4366
This version of module has disabled socketActivation, because until
nixos upgrade systemd to at least 214, systemd does not support
SocketGroup. So socket is created with "root" group when
socketActivation enabled. Should be fixed as soon as systemd upgraded.
Includes changes from #3015 and supersedes #3028
Without this it'll complain and abort when clicking "Take Screenshot" or
"Browse Local" when creating a new VM and looking for an CD-ROM image to boot
from:
GLib-GIO-ERROR **: Settings schema 'org.gtk.Settings.FileChooser' is not installed
- Vte, add gtk3 support, enable introspection, update to 0.35.90
- Spice-gtk, add gtk3 support
- gtk-vnc, add gtk3 support
- Add libvirt-glib (thanks @bjornfor)
- Add usbredir
- qemu, enable usbredir
- spice-gtk, enable usbredir
- virt-manager, update to 1.0.1
[Bjørn:
* Set namePrefix = "" to preserve package name "virt-manager"
(instead of "python2.7-virt-manager")
* Add dconf to GIO_EXTRA_MODULES to get persistent settings in
virt-manager. Without it:
GLib-GIO-Message: Using the 'memory' GSettings backend. Your settings will not be saved or shared with other applications.
* Add ${gtk3}/share to XDG_DATA_DIRS to unbreak "Take Screenshot"
feature (fixes "Settings schema 'org.gtk.Settings.FileChooser' is not installed")
* gtk-vnc: don't pull "pkgs" attrset for optionalString, use stdenv.lib.optionalString instead.
]
Update VirtualBox (and implicitly VirtualBox Guest Additions) to 4.3.6
and Oracle VM VirtualBox Extension Pack to 91406
Conflicts due to minor upgrade in the mean time
Conflicts:
nixos/modules/virtualisation/virtualbox-guest.nix
pkgs/applications/virtualization/virtualbox/default.nix
pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
This is needed to compile the Virtual Box guest additions with the 3.13
kernel (and thus the grsecurity testing kernel).
Signed-off-by: Austin Seipp <aseipp@pobox.com>
This removes nixpkgs' custom runners and instead copies the main python source
files to the bin directory, then wraps them up as usual.
Hopefully this will be more reliable than other previous wrapping methods.
In most cases, this just meant changing kernelDev (now removed from
linuxPackagesFor) to kernel.dev. Some packages needed more work (though
whether that was because of my changes or because they were already
broken, I'm not sure). Specifics:
* psmouse-alps builds on 3.4 but not 3.10, as noted in the comments that
were already there
* blcr builds on 3.4 but not 3.10, as noted in comments that were
already there
* open-iscsi, ati-drivers, wis-go7007, and openafsClient don't build on
3.4 or 3.10 on this branch or on master, so they're marked broken
* A version-specific kernelHeaders package was added
The following packages were removed:
* atheros/madwifi is superceded by official ath*k modules
* aufs is no longer used by any of our kernels
* broadcom-sta v6 (which was already packaged) replaces broadcom-sta
* exmap has not been updated since 2011 and doesn't build
* iscis-target has not been updated since 2010 and doesn't build
* iwlwifi is part of mainline now and doesn't build
* nivida-x11-legacy-96 hasn't been updated since 2008 and doesn't build
Everything not specifically mentioned above builds successfully on 3.10.
I haven't yet tested on 3.4, but will before opening a pull request.
Signed-off-by: Shea Levy <shea@shealevy.com>
* Remove package name
* Start with upper case letter
* Remove trailing period
Also reword some descriptions and move some long descriptions to
longDescription.
I'm not touching generated packages.
We already enable VNC and SDL support by default and adding spice only
increases the closure size from 513 MB to 518 MB.
Closure size:
du -sch $(nix-store -qR ./result)
A recent X update broke VirtualBox guest additions (vboxvideo driver version
mismatch, desktop won't start). This fixes it.
Here is the error log:
(II) "glx" will be loaded by default.
(II) LoadModule: "glx"
(II) Loading /nix/store/kzvmnjlps51q4piqmwr7zbmxcg2z9vgk-xorg-server-1.13.4/lib/xorg/modules/extensions/libglx.so
(II) Module glx: vendor="X.Org Foundation"
compiled for 1.13.4, module version = 1.0.0
ABI class: X.Org Server Extension, version 7.0
(==) AIGLX enabled
Loading extension GLX
(II) LoadModule: "vboxvideo"
(II) Loading /nix/store/4kbxi00h8xsmfgbws2qqh674lcfp03h6-VirtualBox-GuestAdditions-4.2.14-3.2.46/lib/xorg/modules/drivers/vboxvideo_drv.so
(II) Module vboxvideo: vendor="Oracle Corporation"
compiled for 10.12.0, module version = 1.0.1
Module class: X.Org Video Driver
ABI class: X.Org Video Driver, version 12.0
(EE) module ABI major version (12) doesn't match the server's version (13)
(II) UnloadModule: "vboxvideo"
(II) Unloading vboxvideo
(EE) Failed to load module "vboxvideo" (module requirement mismatch, 0)
(II) LoadModule: "vboxmouse"
(WW) Warning, couldn't open module vboxmouse
(II) UnloadModule: "vboxmouse"
(II) Unloading vboxmouse
(EE) Failed to load module "vboxmouse" (module does not exist, 0)
(EE) No drivers available.
Fatal server error:
no screens found
All patch files dropped because they're fixed in this release. For a full list
of fixes that come with this maintenance release, please refer to:
https://www.virtualbox.org/wiki/Changelog
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
First, pass in `self' again so that overriding works properly (thanks
for pointing that out, @edolstra)
Second, instead of having linuxPackages*.kernel mean something different
inside the set and out, add a new attribute linuxPackages*.kernelDev,
which for the generic kernel is simply linuxPackages*.kernel but for the
manual-config kernel is the `dev' output (which has the build tree,
source tree, etc.)
The second change required trivial modifications in a bunch of
expressions, I verified that all of the linuxPackages* sets defined in
all-packages.nix have the same drv paths before and after the change.
Signed-off-by: Shea Levy <shea@shealevy.com>
Outrageous! They fixed the tarball by including the missing file.
Well, at least we now don't have that much cruft laying around and can remove
that rather long patch.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This patch is cherry-picked from VirtualBox Subversion, revision 44867.
It's rather small and only is in effect if kernel version is >= 3.9.0, so it
won't break existing kernels, so I'm adding it here despite we usually only care
about the latest stable upstream (kernel) versions.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This adds a patch to support CONFIG_UIDGID_STRICT_TYPE_CHECKS being activated in
the kernel config (selected by CONFIG_USER_NS for example).
When this kernel option is enabled, current->cred->uid is a structure rather
than a simple integer type (uid_t and gid_t), so we need to check for that and
also pass the current user namespace where needed.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
The tarball for this version is missing the file VRDEVideoIn.h, which is added
through the missing_files_4.2.8.patch and extracted from Subversion, revision
44528.
Upstream changelog(s) can be found at the usual place:
https://www.virtualbox.org/wiki/Changelog
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fortunately this time the upstream package was packaged correctly and we no
longer need the patch to remove the reference to the fa_IR locale.
In addition we need to add lvm2 to dependencies because VirtualBox now requires
libdevmapper with its default configuration. We could disable it but in order to
gain DM support I think it's necessary and at least could avoid some confusion
from users if it's not working "out of the box" :-)
This is a bugfix release, upstream changes are:
* VMM: don't inject stale VT-x events to prevent crashes after VM reset
* VMM: workaround for buggy BIOSes which enable MONITOR only for certain CPUs
* GUI: fixed trimming of anti-aliased text in details-view element headers
* GUI: fixed create-settings-file-alias functionality on Mac hosts
* GUI: fixed take-guest-screenshot functionality on Windows hosts
* GUI: several minor fixes, including palette fixes
* GUI: fixed Windows 2012 OS type
* GUI: allow to terminate the VM even if VBoxSVC crashed
* API: fixed cancelling of snapshots, previously this could lead to
inconsistent VM configs
* API: fixed identifying disk images by UUID
* 3D Support: several fixes
* VRDP: fixed occasional crash with external authentication
* VGA: fix for double scan text modes
* USB: fixed invalid pending request count at the time of service of DEVICE
POWER requests (Windows hosts only)
* USB keyboard: Korean keyboard workaround
* Storage: fixed hang with QCOW images and asynchronous I/O enabled
* Storage: fixed hang with newer VHD images
* Storage: actually write the non-rotational flag to the VM settings (4.2.0
regression)
* Virtio-net: fixed the problem with network statistics counters in Session
Information dialog (GUI)
* Metrics: introduced network rate and disk usage metrics
* Metrics: fixed a crash under certain conditions on Solaris hosts
* BIOS: fix for El Torito
* Shared Folders: if the host folder of a shared folder mapping does not exist,
keep it active but mark it as invalid to prevent inconsistent
saved states
* VBoxManage: fixed converting disks from raw images
* VBoxManage: show snapshot description in the VM or snapshot information
* VBoxManage: make implicit opening of media consistent in all places dealing
with media
* VBoxManage: the iSCSI initiator name was not stored in the settings file when
doing storageattach
* VBoxManage: metrics collect now properly handles 'CPU/MHz' and
'Net/*/LinkSpeed' metrics
* VBoxManage: changing the image UUID or parent UUID as part of storageattach
works now in all safe cases
* VBoxManage: introduced storageattach --medium additions as a shortcut to
mount the additions image
* OVF: fixed importing OVF files cerated by recent VMware products
* Linux hosts / Bridged Networking: fixed the problem with leaking connections
in conntrack
* Linux Additions: added support for ConsoleKit sessions in the vminfo service
of VBoxService
* Linux Additions: don't crash during remount under certain conditions
* Linux/Solaris Additions: fixed guest memory metrics collection
* Solaris hosts: added a dependency to ensure that the user directories are
reachable when starting VBox services
* Windows host installer: integrated user-contributed translations, thanks to
all contributors!
* Windows Additions: fixed auto-logon installation for Windows 8
* Windows Additions: don't fail if the shared folders host service is not
available
* Windows Additions: fixed Guest Additions startup on Windows 2000 guests
* Windows Additions: auto-resize fixes for Windows 8 guests
Upstream changelist with bug ids can be found here:
https://www.virtualbox.org/wiki/Changelog
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
The extension pack is needed in order to have USB 2.0, RDP and PXE boot support
and is _not_ part of the free version, so please read their conditions before
using it:
https://www.virtualbox.org/wiki/VirtualBox_PUEL
Further information and details about the extension pack is available here:
https://www.virtualbox.org/manual/ch01.html#intro-installing
I'm wimping out here and use requireFile to ask the user to fetch the extension
pack manually, simply because I'm not a lawyer. I've seen other distributions
that fetch the extension packs directly from upstream, but I'm not sure if that
is according to Oracle's PUEL.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This updates both virtualbox and guest additions.
Upstream changes in this release:
* GUI: fixed validation warning on global settings / proxy page (4.2.2
regression)
* GUI: fixed crash with multiple guest screens on certain conditions (OS X
hosts only)
* VBoxBalloonCtrl: fixed command line argument handling of ballooning module
* VRDP: fixed occasional crash during a video playback in the guest
* BIOS: fixed broken DMI information (4.2 regression)
* BIOS: workaround for booting from Windows 2000 floppy disks
* EFI: fixed video mode selection loss on VM reboot
* Parallel: fixed parallel port printing failure/ paper queue empty error
(Windows hosts only)
* NAT: fixed crash on alias-less DNS responses when host-resolver is used
* Storage: fixed hang under rare circumstances
With bug IDs: https://www.virtualbox.org/wiki/Changelog
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This should fix a few issues with charon and VMs crashing starting at an amount
of at least 4 running VMs in parallel.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This time, we need to patch, because the upstream tarball got messed up
somehow[TM]. You can find some details about the issue here:
https://www.virtualbox.org/pipermail/vbox-dev/2012-October/005408.html
Our patch is removing the language file, as it seems that even in SVN trunk it
isn't available anymore. So, let's hope we can remove this patch in the next
upstream release.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Upstream changes are:
* VMM: fixed a potential host crash triggered by shutting down a VM when
another VM was running (only affected 32-bit hosts and 64-bit OS X
hosts, 4.1 regression)
* VMM: fixed a potential host crash under a high guest memory pressure (seen
with Windows 8 guests)
* VMM: respect RAM preallocation while restoring saved state.
* VMM: fixed handling of task gates if VT-x/AMD-V is disabled
* Storage: fixed audio CD passthrough for certain media players
* USB: don't crash if a USB device is plugged or unplugged when saving or
loading the VM state (SMP guests only)
* RTC: fixed a potential corruption of CMOS bank 1
* Mac OS X hosts: installer fixes for Leopard (4.1.20 regression)
* Windows Additions: fixed memory leak in VBoxTray
Full changelogs with bug ids and links to it can be found at:
https://www.virtualbox.org/wiki/Changelog
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
First of all, modules won't install when there is no "make modules" prior to it,
so we're doing this now with a new function called forEachModule, so we can
avoid duplication as much as possible.
In addition this sets $sourcedir to the current directory of the configurePhase,
so we're able to find the source tree later on, after several chdir()s.
The scripts/depmod.sh checks whether the path in $DEPMOD is executable and only
executes it if that's the case. So, by setting DEPMOD to "/do_not_use_depmod"
the destination path doesn't exist _and_ thus isn't executable aswell.
The for loop didn't find $curdir, because it was set _after_ the directory has
been changed. The variable is now called $srcroot and is set before the
installPhase is changing directories.
Don't rely on VirtualBox's in-tree build scripts to set include paths correctly
and use the official way of the Linux kernel to build the modules. That way we
don't need to make ugly symlinks in the kernel tree or heavily patch VirtualBox.
Previous commit reverted Xen back to 4.0.3 because xend from 4.1.* and newer
hangs for unknown reasons.
The new "xl" toolstack from 4.1.* and unstable works, yet PCI passthrough is not
supported by xl in 4.1.* and is broken in the unstable.
With this patch I was able to passthrough ATI Radeon HD 6950 without 3D
acceleration, though, to both Linux and Windows guests. Which is the best
archived result with Xen PCI passthrough on NixOS after trying out all possible
Xen versions.
Same VGA card works fine if passed through into a guest with KVM (acceleration,
GPGPU, everything works). I should have tried KVM from the start.
longer seems needed. Optionally build the Python bindings. Disable
the Java bindings by default to prevent a gratuitous dependency on
the JDK.
svn path=/nixpkgs/trunk/; revision=33295
because Qt 4.8 doesn't propagate dependencies such as "which" and
"pkgconfig". Thanks to Yury for pointing this out.
* Also updated VirtualBox to 4.1.8.
svn path=/nixpkgs/trunk/; revision=32527
