Commit Graph

512 Commits

Author SHA1 Message Date
obadz
24a9183f90 Merge branch 'hardened-stdenv' into staging
Closes #12895

Amazing work by @globin & @fpletz getting hardened compiler flags by
enabled default on the whole package set
2016-08-22 01:19:35 +01:00
obadz
ba50fd7170 Merge branch 'master' into staging 2016-08-22 01:18:11 +01:00
obadz
3d16af70bf nixos/stage-1: add mechanism which lustrates all impurities from / (#17784)
lustrate /ˈlʌstreɪt/ verb.
  purify by expiatory sacrifice, ceremonial washing, or some other
  ritual action.

- sudo touch /etc/NIXOS_LUSTRATE
  ⇒ on next reboot, during stage 1, everything but /nix and /boot
  is moved to /old-root
- echo "etc/passwd" | sudo tee -a /etc/NIXOS_LUSTRATE
  ⇒ on next reboot, during stage 1, everything but /nix and /boot
  is moved to /old-root; except /etc/passwd is copied back.

Useful for installing NixOS in place on another distro. For instance:

$ nix-env -iE '_: with import <nixpkgs/nixos> { configuration = {}; }; with config.system.build; [ nixos-generate-config manual.manpages ]'
$ sudo mkdir /etc/nixos
$ sudo `which nixos-generate-config`

… edit the configuration files in /etc/nixos using man configuration.nix
  if needed

  maybe add: users.extraUsers.root.initialHashedPassword = "" ?

… Build the entire NixOS system and link it to the system profile:
$ nix-env -p /nix/var/nix/profiles/system -f '<nixpkgs/nixos>' -A system --set

… If you were using a single user install:
$ sudo chown -R 0.0 /nix

… NixOS is about to take over
$ sudo touch /etc/NIXOS
$ sudo touch /etc/NIXOS_LUSTRATE

… Let's keep the configuration files we just created
$ echo etc/nixos | sudo tee -a /etc/NIXOS_LUSTRATE

$ sudo mv -v /boot /boot.bak &&
  sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot
$ sudo reboot

… NixOS boots, Stage 1 moves all the old distro stuff in /old-root.
2016-08-22 01:15:13 +01:00
Nikolay Amiantov
6b41f1132c nixos treewide: don't set MODULE_DIR 2016-08-19 17:56:54 +03:00
Nikolay Amiantov
5ff6e98486 modprobe service: drop kmod wrapper 2016-08-19 17:56:49 +03:00
Shea Levy
2942895d55 Merge branch 'install-bootloader-flag' 2016-08-17 21:16:29 -04:00
Julien Langlois
552c30c155 stage-1: exclude zram devices from resumeDevices 2016-08-17 00:21:47 -07:00
Shea Levy
b4954a8f38 Deprecate --install-grub in favor of --install-bootloader for nixos-rebuild.
Fixes #14293
2016-08-16 07:51:58 -04:00
Shea Levy
9adad8612b Revert "Merge branch 'modprobe-fix' of git://github.com/abbradar/nixpkgs"
Was meant to go into staging, sorry

This reverts commit 57b2d1e9b0, reversing
changes made to 760b2b9048.
2016-08-15 19:05:52 -04:00
Nikolay Amiantov
1f63958772 nixos treewide: don't set MODULE_DIR 2016-08-16 00:19:25 +03:00
Nikolay Amiantov
b2ebecd9e5 modprobe service: drop kmod wrapper 2016-08-16 00:19:25 +03:00
Robin Gloster
b7787d932e Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-08-12 09:46:53 +00:00
Thomas Tuegel
68922e3f74 nixos/stage-1: use readlink -e in builder
The builder has this convoluted `while` loop which just replicates
`readlink -e`. I'm sure there was a reason at one point, because the
loop has been there since time immemorial. It kept getting copied
around, I suspect because nobody bothered to understand what it actually
did.

Incidentally, this fixes #17513, but I have no idea why.
2016-08-08 09:45:45 -05:00
Thomas Tuegel
ee36bb8588 nixos/stage-1: fix antiquotation 2016-08-08 09:28:17 -05:00
Wout Mertens
db8401f603 Merge pull request #17100 from abbradar/resume-delay
nixos stage-1: wait for resume devices to appear
2016-08-08 11:34:38 +02:00
Nikolay Amiantov
986a40421a nixos stage-1: wait for devices during resumption attempt
Also a microimprovement -- use `test -n` instead of `test -e`
since we have already checked that the file exists.
2016-08-08 01:35:43 +03:00
Nikolay Amiantov
3ae468e835 nixos stage-1: move resumption below helper functions' definitions 2016-08-08 01:34:23 +03:00
Nikolay Amiantov
59aa3bb5c8 nixos stage-1: factor device waiting into a function 2016-08-08 01:32:18 +03:00
Tuomas Tynkkynen
2ea72fa9c8 nixos/luksroot: Reference correct output of openssl 2016-08-04 23:12:39 +03:00
Robin Gloster
1f04b4a566 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-07-21 00:56:43 +00:00
Nikolay Amiantov
3cc54bbad9 Merge pull request #17082 from abbradar/fix-early-kbd
Use new early kbd-setting code in initrd and fix layouts from external packages
2016-07-20 23:52:45 +04:00
Robin Gloster
203846b9de Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-07-19 10:37:02 +00:00
Christian Kauhaus
3530f3f20a systemd: make ctrl-alt-del target configurable. (#16911)
We currently only allow upstream's default of "reboot.target" due to the
way the symlinks are initialized. I made this configurable similar to the
default unit.
2016-07-19 09:42:53 +02:00
Nikolay Amiantov
7bed3d0cb3 nixos stage-1: move keymap handling to kbd module 2016-07-18 23:27:45 +03:00
Nikolay Amiantov
3d69653d6b plymouth service: stop splash screen before a failure prompt 2016-07-18 13:45:37 +03:00
Nikolay Amiantov
7513a1d2f5 plymouth service: update root fs before stage 2 2016-07-18 13:45:37 +03:00
Nikolay Amiantov
9cab592abd plymouth service: style fixes 2016-07-18 13:45:37 +03:00
Nikolay Amiantov
86ad25625f nixos stage-1: add custom pre failure dialog commands 2016-07-18 13:45:37 +03:00
Nikolay Amiantov
193ab8be67 Revert "nixos stage-1: try to quit plymouth if started on failure"
This reverts commit c69c76ca7e.

This patch was messed up during a rebase -- the commit title doesn't match what
it really does at all (it is actually a broken attempt to get LUKS passphrase
prompts in Plymouth).
2016-07-17 15:03:13 +03:00
Robin Gloster
5185bc1773 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-07-15 14:41:01 +00:00
Nikolay Amiantov
1848bfc92d Merge branch 'plymouth' into staging 2016-07-13 03:54:38 +03:00
Nikolay Amiantov
c69c76ca7e nixos stage-1: try to quit plymouth if started on failure 2016-07-12 22:22:29 +03:00
Nikolay Amiantov
a2d4235fe1 plymouth service: init 2016-07-12 22:22:29 +03:00
Nikolay Amiantov
d3e3e643cb nixos stage-1: set extraUtils variable 2016-07-12 22:22:29 +03:00
Nikolay Amiantov
3508918da2 nixos stage-1: replace udevadm in udevRules 2016-07-12 22:22:28 +03:00
Nikolay Amiantov
e02b5ace0b nixos stage-1: guard udevRules from extra references 2016-07-12 22:22:28 +03:00
Nikolay Amiantov
bd0ab027c1 nixos stage-1: recursively process binaries and libraries 2016-07-12 22:22:28 +03:00
Nikolay Amiantov
90ad879753 nixos stage-1: unconditionally mount /dev/pts 2016-07-12 22:22:28 +03:00
Bjørn Forsman
2eb8aab42c nixos/systemd: disable timer units with service
A disabled systemd service with a "startAt" attribute, like this:

  systemd.services.foo-service = {
    enable = false;
    startAt = "*-*-* 05:15:00";
    ...
  };

will cause the following errors in the system journal:

  systemd[1]: foo-service.timer: Refusing to start, unit to trigger not loaded.
  systemd[1]: Failed to start foo-service.timer.

Fix it by not generating the corresponding timer unit when the service
is disabled.
2016-07-11 22:42:47 +02:00
Jookia
b187c869f4 systemd-coredump: Add systemd service and fix sysctl pattern. 2016-07-10 18:07:37 +10:00
Tuomas Tynkkynen
931706cdc1 extlinux-conf-builder: Choose whether to use DTBs on per-generation basis
Previously, the value from stdenv.platform.kernelDTB was used. That
doesn't work well if both kinds (DTB and non-DTB) of generations exist
in the system profile.
2016-07-10 03:03:51 +03:00
Bjørn Forsman
aeb516c741 nixos/grub: change state file device separator from ':' to ','
':' is currently used as separator in /boot/grub/state for the list of
devices GRUB should be installed to. The problem is that ':' itself may
appear in a device path:

  /dev/disk/by-id/usb-SanDisk_Cruzer_20043512300546C0B317-0:0

With such a path, NixOS will install GRUB *every* time, because it
thinks the configuration differs from the state file (due to the wrong
list split). Fix it by using ',' as separator.

For existing systems with GRUB installed on multiple devices, this
change means that GRUB will be installed one extra time.
2016-07-06 00:11:57 +02:00
Guillaume Maudoux
86dfaafad2 systemd-logind: reload when logind.conf changed 2016-07-03 00:38:37 +02:00
Alexander Ried
a31e07fc11 modules.resolved: Enhance by upstream options (#15897) 2016-06-26 22:58:04 +02:00
Eelco Dolstra
d0b2524633 Merge pull request #16021 from Baughn/systemd-linger
systemd: Set KillUserProcesses=no in logind.conf
2016-06-20 14:54:03 +02:00
Robin Gloster
8031cba2ab Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-06-10 09:27:04 +00:00
Svein Ove Aas
93c160fabc systemd: Set KillUserProcesses=no in logind.conf
Full discussion at
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=825394

NixOS is even more of a server OS than Debian, and I can think of no
reason to make users jump through this sort of hoop.
2016-06-06 11:51:51 +01:00
Shea Levy
83c2629f15 Merge pull request #15895 from cerana/stage2-sysfs
stage2: if no /proc, also mount /sys
2016-06-03 11:32:57 -04:00
Nahum Shalman
9b0a5ced13 stage2: if no /proc, also mount /sys 2016-06-01 13:26:14 +00:00
Eelco Dolstra
e8ad22be12 Rename gummiboot module 2016-06-01 12:55:56 +02:00