JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
57,025 Commits 1 Branch 0 Tags 12 GiB
f93ba51469
Commit Graph

71 Commits

Author SHA1 Message Date
Ricardo M. Correia
a11dc2f0a3 grsecurity: Add denyUSB option to grsec NixOS module 
The option had been added to the grsec build-support code,
but it hadn't been added to the grsec module.

After this commit, grsec module users will be able to change
the default value. It also serves to document that this option
exists and that NixOS will disable it by default.
 2015-01-20 19:18:06 +01:00
Luca Bruno
804a958663 pam: add pam_wheel 2015-01-14 18:32:08 +01:00
Shea Levy
cca8bae86e Merge branch 'rngd-fix' of git://github.com/abbradar/nixpkgs 2015-01-08 09:36:29 -05:00
Nikolay Amiantov
dbc0395b2b nixos/rngd: some fixes 2015-01-06 17:27:07 +03:00
Nikolay Amiantov
a164a0b4c5 nixos/fprintd: add service and pam support 2015-01-03 19:50:40 +03:00
Tobias Geerinckx-Rice
c64257b8e5 Fix user-facing typos (mainly in descriptions) 2014-12-30 03:31:03 +01:00
Ricardo M. Correia
1d44322d53 grsecurity: Update stable and test patches 
stable: 3.0-3.14.27-201412211908 -> 3.0-3.14.27-201412280859
test:   3.0-3.17.7-201412211910  -> 3.0-3.18.1-201412281149
 2014-12-29 03:00:47 +01:00
Eelco Dolstra
89697b0fc1 Improve /etc/sudoers message 2014-12-18 11:51:42 +01:00
wmertens
3cecef15d7 Revert $GIT_SSL_CAINFO removal 
Users have an older git in their user environment and it doesn't work without it. We should keep it around for a while.
 2014-12-01 23:07:50 +01:00
wmertens
45c1b9147f Merge pull request #5130 from wmertens/git-ssl-env 
Let git use $SSL_CERT_FILE
 2014-11-27 13:24:08 +01:00
Wout Mertens
72b81cf8bb Remove unnecessary $GIT_SSL_CAINFO from sys env 2014-11-26 00:30:07 +01:00
Ricardo M. Correia
389143d808 grsecurity: Update assertion msg to correct major kernel versions 2014-11-16 18:52:39 +01:00
Mathijs Kwik
f356cee747 sudo: allow adding extra configuration options to the bottom of sudoers 
from sudoers (5):
When multiple entries match for a user, they are applied in order.
Where there are multiple matches, the last match is used (which is not necessarily the most specific match).
 2014-11-02 13:27:05 +01:00
Ricardo M. Correia
10348a0f2c grsecurity: Update documentation to mention correct kernels 2014-10-22 16:50:36 +02:00
Eelco Dolstra
bb9ee6a13f Remove some setuid wrappers for non-standard programs 2014-09-05 14:46:36 +02:00
Eelco Dolstra
cd7129a037 Revert "nixos: add setuid wrappers for some networked filesystems' helpers" 
This reverts commit 26a4001a98. It
breaks the NFS test:

  http://hydra.nixos.org/build/13943148

Also, having more setuid programs is a bad thing security-wise.
 2014-09-05 14:43:11 +02:00
Michael Raskin
419031bcfc Merge pull request #2644 from lethalman/pam_tally 
pam: Add logFailures option for adding pam_tally to su
 2014-09-02 00:58:30 +04:00
Jan Malakhovski
26a4001a98 nixos: add setuid wrappers for some networked filesystems' helpers 
So that `user` mount option would work allowing normal users to mount
and umount stuff marked with it in `fileSystems.<name>.options`.
 2014-09-01 10:33:48 +04:00
Jan Malakhovski
8f50d803ef nixos: add support for mkhomedir in PAM 2014-09-01 10:33:48 +04:00
Eelco Dolstra
785ed2b528 Don't silently ignore errors from the activation script 2014-08-15 02:14:34 +02:00
Vladimír Čunát
87c3c0e885 Merge master into #2129 
Conflicts (easy, just UID shifted):
	nixos/modules/misc/ids.nix
	nixos/modules/module-list.nix
 2014-08-12 19:24:08 +02:00
Eelco Dolstra
36f99a9a82 Set $SSL_CERT_FILE 
It's more standard than $OPENSSL_X509_CERT_FILE (which I guess was a
totally unnecessary patch to OpenSSL). Since curl respects
$SSL_CERT_FILE, it's no longer needed to set $CURL_CA_BUNDLE. Git
unfortunately doesn't.
 2014-07-28 19:09:32 +02:00
Rastus Vernon
d5daa8ae6f Fix repeated typo 
"Can either by" should be "Can either be". There are three occurrences of this mistake, all in descriptions of configuration options.
 2014-07-11 23:14:53 -04:00
Jaka Hudoklin
16f801cba9 nixos/pam: make pam_loginuid optional if in container 2014-06-30 11:08:39 +02:00
Austin Seipp
0399c5ee24 grsecurity: update stable/testing kernels, refactoring 
This updates the new stable kernel to 3.14, and the new testing kernel
to 3.15.

This also removes the vserver kernel, since it's probably not nearly as
used.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-06-22 22:29:10 -05:00
William A. Kennington III
ef4ea24420 sudo: Always keepVisudo in order to simplify sudo build 2014-06-17 22:41:32 -05:00
Ricardo M. Correia
f8e108c865 nixos.tests.installer: Fix test failures due to network being disabled 2014-06-17 18:41:26 +02:00
Eelco Dolstra
f5055e2ef6 Rename environment.systemVariables -> environment.sessionVariables 
This makes it clearer that they're part of PAM sessions.
 2014-06-13 17:57:04 +02:00
Eelco Dolstra
8ae659f16c Revert "Revert "Merge #2692: Use pam_env to properly setup system-wide env"" 
This reverts commit 491c088731.
 2014-06-10 13:07:10 +02:00
Eelco Dolstra
491c088731 Revert "Merge #2692: Use pam_env to properly setup system-wide env" 
This reverts commit 18a0cdd864.
 2014-06-10 13:03:44 +02:00
Vladimír Čunát
18a0cdd864 Merge #2692: Use pam_env to properly setup system-wide env 2014-06-10 11:42:59 +02:00
Michael Raskin
e68a5b265a Enable checking sudoers syntax. Fixes #2850, probably. 2014-06-09 00:54:21 +04:00
Ricardo M. Correia
f0cf8f4140 grsecurity: Fix module evaluation 2014-05-22 20:17:34 +02:00
Austin Seipp
e31f212f6b nixos/duosec: Add an option to allow TCP forwarding 
Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-05-20 02:42:38 -05:00
Austin Seipp
67c309fe75 Fix fallout from 4f27ad14 
Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-05-18 07:38:13 -05:00
Austin Seipp
4f27ad14a1 grsec: refactor grsecurity packages 
This now provides a handful of different grsecurity kernels for slightly
different 'flavors' of packages. This doesn't change the grsecurity
module to use them just yet, however.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-05-17 14:09:43 -05:00
Austin Seipp
92abc4c610 kernel: enable AppArmor by default 
AppArmor only requires a few patches to the 3.2 and 3.4 kernels in order
to work properly (with the minor catch grsecurity -stable includes the
3.2 patches.) This adds them to the kernel builds by default, removes
features.apparmor (since it's always true) and makes it the default MAC
system.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-05-17 14:09:09 -05:00
Luca Bruno
1d5d7fdee2 pam: Add logFailures option for adding pam_tally to su 2014-05-14 17:54:21 +02:00
Aristid Breitkreuz
204fc0a397 sudo: env_keep TERMINFO for urxvt 2014-05-04 14:42:16 +02:00
Eelco Dolstra
4353220202 polkit: Remove unnecessary restart 
There already is a restart trigger that takes care of this.
 2014-04-28 23:57:37 +02:00
Eelco Dolstra
379c8ba237 polkit: Restart using systemctl 
The use of pkill is now particularly bad due to containers (it might
kill processes in containers).
 2014-04-28 12:38:50 +02:00
Alexander Kjeldaas
baf4faeddc Only disable TPM access by rngd when tcsd is enabled. 2014-04-22 14:05:09 +02:00
Alexander Kjeldaas
64311899db Don't let rngd read /dev/tpm0. 
Only one process can interact with the TPM module and
that process should be tcsd.  The tpm_rng kernel module
should instead be loaded and /dev/hwrnd be used to
read the TPM random generator.
Also, log which random generator devices are used by
rngd on startup.
 2014-04-22 14:05:09 +02:00
Rickard Nilsson
5db9287b7c rtkit: Update from 0.10 to 0.11 2014-04-21 23:22:10 +02:00
Ricardo M. Correia
5d5ca7b260 grsecurity: Update all patches 
stable:  3.0-3.2.57-201404131252            -> 3.0-3.2.57-201404182109
test:    3.0-3.13.10-201404141717           -> 3.0-3.14.1-201404201132
vserver: 3.0-3.2.57-vs2.3.2.16-201404131253 -> 3.0-3.2.57-vs2.3.2.16-201404182110
 2014-04-21 18:46:41 +02:00
Eelco Dolstra
fa9ed04997 Restart polkit if its configuration may have changed 2014-04-19 14:29:02 +02:00
Eelco Dolstra
9f1c9404da Put /var/setuid-wrappers on a tmpfs 
This allows all other filesystems to be mounted without the suid
option.
 2014-04-19 12:40:09 +02:00
Eelco Dolstra
fa1a46a01c setuid-wrapper: Fix broken string comparison 2014-04-19 10:58:30 +02:00
Eelco Dolstra
b80e6b27c7 setuid-wrapper: Drop runtime dependency on setuid-wrapper.c 2014-04-19 10:53:17 +02:00
Eelco Dolstra
a8aa9f3fd4 setuid-wrapper.c: Remove tabs 2014-04-19 10:53:05 +02:00