···528 '';
529 };
530531+ virtualisation.restrictNetwork =
532+ mkOption {
533+ type = types.bool;
534+ default = false;
535+ example = true;
536+ description =
537+ lib.mdDoc ''
538+ If this option is enabled, the guest will be isolated, i.e. it will
539+ not be able to contact the host and no guest IP packets will be
540+ routed over the host to the outside. This option does not affect
541+ any explicitly set forwarding rules.
542+ '';
543+ };
544+545 virtualisation.vlans =
546 mkOption {
547 type = types.listOf types.ints.unsigned;
···950 else "'guestfwd=${proto}:${guest.address}:${toString guest.port}-" +
951 "cmd:${pkgs.netcat}/bin/nc ${host.address} ${toString host.port}',"
952 );
953+ restrictNetworkOption = lib.optionalString cfg.restrictNetwork "restrict=on,";
954 in
955 [
956 "-net nic,netdev=user.0,model=virtio"
957+ "-netdev user,id=user.0,${forwardingOptions}${restrictNetworkOption}\"$QEMU_NET_OPTS\""
958 ];
959960 # FIXME: Consolidate this one day.
···1+import ./make-test-python.nix ({
2+ name = "qemu-vm-restrictnetwork";
3+4+ nodes = {
5+ unrestricted = { config, pkgs, ... }: {
6+ virtualisation.restrictNetwork = false;
7+ };
8+9+ restricted = { config, pkgs, ... }: {
10+ virtualisation.restrictNetwork = true;
11+ };
12+ };
13+14+ testScript = ''
15+ import os
16+17+ if os.fork() == 0:
18+ # Start some HTTP server on the qemu host to test guest isolation.
19+ from http.server import HTTPServer, BaseHTTPRequestHandler
20+ HTTPServer(("", 8000), BaseHTTPRequestHandler).serve_forever()
21+22+ else:
23+ start_all()
24+ unrestricted.wait_for_unit("network-online.target")
25+ restricted.wait_for_unit("network-online.target")
26+27+ # Guests should be able to reach each other on the same VLAN.
28+ unrestricted.succeed("ping -c1 restricted")
29+ restricted.succeed("ping -c1 unrestricted")
30+31+ # Only the unrestricted guest should be able to reach host services.
32+ # 10.0.2.2 is the gateway mapping to the host's loopback interface.
33+ unrestricted.succeed("curl -s http://10.0.2.2:8000")
34+ restricted.fail("curl -s http://10.0.2.2:8000")
35+ '';
36+})
···1+# expr and script based on our lsb_release
2+{ stdenv
3+, lib
4+, substituteAll
5+, coreutils
6+, getopt
7+, modDirVersion ? ""
8+}:
9+10+substituteAll {
11+ name = "uname";
12+13+ src = ./deterministic-uname.sh;
14+15+ dir = "bin";
16+ isExecutable = true;
17+18+ inherit coreutils getopt;
19+20+ uSystem = if stdenv.buildPlatform.uname.system != null then stdenv.buildPlatform.uname.system else "unknown";
21+ inherit (stdenv.buildPlatform.uname) processor;
22+23+ # uname -o
24+ # maybe add to lib/systems/default.nix uname attrset
25+ # https://github.com/coreutils/coreutils/blob/7fc84d1c0f6b35231b0b4577b70aaa26bf548a7c/src/uname.c#L373-L374
26+ # https://stackoverflow.com/questions/61711186/where-does-host-operating-system-in-uname-c-comes-from
27+ # https://github.com/coreutils/gnulib/blob/master/m4/host-os.m4
28+ operatingSystem =
29+ if stdenv.buildPlatform.isLinux
30+ then "GNU/Linux"
31+ else if stdenv.buildPlatform.isDarwin
32+ then "Darwin" # darwin isn't in host-os.m4 so where does this come from?
33+ else "unknown";
34+35+ # in os-specific/linux module packages
36+ # --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
37+ # is a common thing to do.
38+ modDirVersion = if modDirVersion != "" then modDirVersion else "unknown";
39+40+ meta = with lib; {
41+ description = "Print certain system information (hardcoded with <nixpkgs/lib/system> values)";
42+ longDescription = ''
43+ This package provides a replacement for `uname` whose output depends only
44+ on `stdenv.buildPlatform`. It is meant to be used from within derivations.
45+ Many packages' build processes run `uname` at compile time and embed its
46+ output into the result of the build. Since `uname` calls into the kernel,
47+ and the Nix sandbox currently does not intercept these calls, builds made
48+ on different kernels will produce different results.
49+ '';
50+ license = [ licenses.mit ];
51+ maintainers = with maintainers; [ artturin ];
52+ platforms = platforms.all;
53+ };
54+}
···14 ];
15in
1617-callPackage ./common.nix { inherit stdenv; } {
18- pname = "glibc" + lib.optionalString withGd "-gd";
19-20- inherit withLinuxHeaders profilingLibraries withGd withLibcrypt;
2122 # Note:
23 # Things you write here override, and do not add to,
24 # the values in `common.nix`.
25 # (For example, if you define `patches = [...]` here, it will
26- # override the patches in `common.nix`.)
02728 NIX_NO_SELF_RPATH = true;
29···74 # - dejagnu: during linux bootstrap tcl SIGSEGVs
75 # - clang-wrapper in cross-compilation
76 # Last attempt: https://github.com/NixOS/nixpkgs/pull/36948
77- preInstall = ''
78 if [ -f ${stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
79 mkdir -p $out/lib
80 cp ${stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
···153154 separateDebugInfo = true;
155156- meta.description = "The GNU C Library";
157- }
0
···14 ];
15in
1617+(callPackage ./common.nix { inherit stdenv; } {
18+ inherit withLinuxHeaders withGd profilingLibraries withLibcrypt;
19+ pname = "glibc" + lib.optionalString withGd "-gd";
20+}).overrideAttrs(previousAttrs: {
2122 # Note:
23 # Things you write here override, and do not add to,
24 # the values in `common.nix`.
25 # (For example, if you define `patches = [...]` here, it will
26+ # override the patches in `common.nix` -- so instead you should
27+ # write `patches = (previousAttrs.patches or []) ++ [ ... ]`.
2829 NIX_NO_SELF_RPATH = true;
30···75 # - dejagnu: during linux bootstrap tcl SIGSEGVs
76 # - clang-wrapper in cross-compilation
77 # Last attempt: https://github.com/NixOS/nixpkgs/pull/36948
78+ preInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
79 if [ -f ${stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
80 mkdir -p $out/lib
81 cp ${stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
···154155 separateDebugInfo = true;
156157+ meta = (previousAttrs.meta or {}) // { description = "The GNU C Library"; };
158+})
159+
···1112stdenv.mkDerivation rec {
13 pname = "cutemaze";
14- version = "1.3.1";
1516 src = fetchurl {
17- url = "https://gottcode.org/cutemaze/${pname}-${version}-src.tar.bz2";
18- sha256 = "6944931cd39e9ef202c11483b7b2b7409a068c52fa5fd4419ff938b1158c72ab";
19 };
2021 nativeBuildInputs = [
···36 '';
3738 meta = with lib; {
0039 homepage = "https://gottcode.org/cutemaze/";
40- description = "Simple, top-down game in which mazes are randomly generated";
41 license = licenses.gpl3Plus;
42 maintainers = with maintainers; [ dotlambda ];
43 platforms = platforms.unix;
···1112stdenv.mkDerivation rec {
13 pname = "cutemaze";
14+ version = "1.3.2";
1516 src = fetchurl {
17+ url = "https://gottcode.org/cutemaze/${pname}-${version}.tar.bz2";
18+ hash = "sha256-hjDlY18O+VDJR68vwrIZwsQAa40xU+V3bCAA4GFHJEQ=";
19 };
2021 nativeBuildInputs = [
···36 '';
3738 meta = with lib; {
39+ changelog = "https://github.com/gottcode/cutemaze/blob/v${version}/ChangeLog";
40+ description = "Simple, top-down game in which mazes are randomly generated";
41 homepage = "https://gottcode.org/cutemaze/";
042 license = licenses.gpl3Plus;
43 maintainers = with maintainers; [ dotlambda ];
44 platforms = platforms.unix;
+1-1
pkgs/os-specific/linux/lsb-release/lsb_release.sh
···32@getopt@/bin/getopt --test > /dev/null && rc=$? || rc=$?
33if [[ $rc -ne 4 ]]; then
34 # This shouldn't happen.
35- echo "Warning: Enhanced getopt not supported, please open an issue." >&2
36else
37 # Define all short and long options.
38 SHORT=hvidrcas
···32@getopt@/bin/getopt --test > /dev/null && rc=$? || rc=$?
33if [[ $rc -ne 4 ]]; then
34 # This shouldn't happen.
35+ echo "Warning: Enhanced getopt not supported, please open an issue in nixpkgs." >&2
36else
37 # Define all short and long options.
38 SHORT=hvidrcas