···633634 : Predicate taking an attribute name and an attribute value, which returns `true` to include the attribute, or `false` to exclude the attribute.
6350000000000636 `set`
637638 : The attribute set to filter
···633634 : Predicate taking an attribute name and an attribute value, which returns `true` to include the attribute, or `false` to exclude the attribute.
635636+ <!-- TIP -->
637+ If possible, decide on `name` first and on `value` only if necessary.
638+ This avoids evaluating the value if the name is already enough, making it possible, potentially, to have the argument reference the return value.
639+ (Depending on context, that could still be considered a self reference by users; a common pattern in Nix.)
640+641+ <!-- TIP -->
642+ `filterAttrs` is occasionally the cause of infinite recursion in configuration systems that allow self-references.
643+ To support the widest range of user-provided logic, perform the `filterAttrs` call as late as possible.
644+ Typically that's right before using it in a derivation, as opposed to an implicit conversion whose result is accessible to the user's expressions.
645+646 `set`
647648 : The attribute set to filter
···23in
2425{
26- imports = [
27- (lib.mkRemovedOptionModule [ "programs" "bash" "enable" ] "")
28- ];
2930 options = {
3132 programs.bash = {
3334- /*
35- enable = lib.mkOption {
36- default = true;
37- description = ''
38- Whenever to configure Bash as an interactive shell.
39- Note that this tries to make Bash the default
40- {option}`users.defaultUserShell`,
41- which in turn means that you might need to explicitly
42- set this variable if you have another shell configured
43- with NixOS.
44- '';
45- type = lib.types.bool;
46- };
47- */
4849 shellAliases = lib.mkOption {
50 default = { };
···129130 };
131132- config = # lib.mkIf cfg.enable
133- {
134135- programs.bash = {
136137- shellAliases = builtins.mapAttrs (name: lib.mkDefault) cfge.shellAliases;
138139- shellInit = ''
140- if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]; then
141- . ${config.system.build.setEnvironment}
142- fi
143144- ${cfge.shellInit}
145- '';
146147- loginShellInit = cfge.loginShellInit;
148149- interactiveShellInit = ''
150- # Check the window size after every command.
151- shopt -s checkwinsize
152153- # Disable hashing (i.e. caching) of command lookups.
154- set +h
155156- ${cfg.promptInit}
157- ${cfg.promptPluginInit}
158- ${bashAliases}
159160- ${cfge.interactiveShellInit}
161- '';
162163- };
164165- environment.etc.profile.text = ''
166- # /etc/profile: DO NOT EDIT -- this file has been generated automatically.
167- # This file is read for login shells.
168169- # Only execute this file once per shell.
170- if [ -n "$__ETC_PROFILE_SOURCED" ]; then return; fi
171- __ETC_PROFILE_SOURCED=1
172173- # Prevent this file from being sourced by interactive non-login child shells.
174- export __ETC_PROFILE_DONE=1
175176- ${cfg.shellInit}
177- ${cfg.loginShellInit}
178179- # Read system-wide modifications.
180- if test -f /etc/profile.local; then
181- . /etc/profile.local
182- fi
183184- if [ -n "''${BASH_VERSION:-}" ]; then
185- . /etc/bashrc
186- fi
187- '';
188189- environment.etc.bashrc.text = ''
190- # /etc/bashrc: DO NOT EDIT -- this file has been generated automatically.
191192- # Only execute this file once per shell.
193- if [ -n "$__ETC_BASHRC_SOURCED" ] || [ -n "$NOSYSBASHRC" ]; then return; fi
194- __ETC_BASHRC_SOURCED=1
195196- # If the profile was not loaded in a parent process, source
197- # it. But otherwise don't do it because we don't want to
198- # clobber overridden values of $PATH, etc.
199- if [ -z "$__ETC_PROFILE_DONE" ]; then
200- . /etc/profile
201- fi
202203- # We are not always an interactive shell.
204- if [ -n "$PS1" ]; then
205- ${cfg.interactiveShellInit}
206- fi
207208- # Read system-wide modifications.
209- if test -f /etc/bashrc.local; then
210- . /etc/bashrc.local
211- fi
212- '';
213214- environment.etc.bash_logout.text = ''
215- # /etc/bash_logout: DO NOT EDIT -- this file has been generated automatically.
216217- # Only execute this file once per shell.
218- if [ -n "$__ETC_BASHLOGOUT_SOURCED" ] || [ -n "$NOSYSBASHLOGOUT" ]; then return; fi
219- __ETC_BASHLOGOUT_SOURCED=1
220221- ${cfg.logout}
222223- # Read system-wide modifications.
224- if test -f /etc/bash_logout.local; then
225- . /etc/bash_logout.local
226- fi
227- '';
228229- # Configuration for readline in bash. We use "option default"
230- # priority to allow user override using both .text and .source.
231- environment.etc.inputrc.source = lib.mkOptionDefault ./inputrc;
232233- users.defaultUserShell = lib.mkDefault pkgs.bashInteractive;
234235- environment.pathsToLink = lib.optionals cfg.completion.enable [
236- "/etc/bash_completion.d"
237- "/share/bash-completion"
238- ];
239240- environment.shells = [
241- "/run/current-system/sw/bin/bash"
242- "/run/current-system/sw/bin/sh"
243- "${pkgs.bashInteractive}/bin/bash"
244- "${pkgs.bashInteractive}/bin/sh"
245- ];
246247- };
248249}
···23in
2425{
0002627 options = {
2829 programs.bash = {
3031+ enable = lib.mkOption {
32+ default = true;
33+ description = ''
34+ Whenever to configure Bash as an interactive shell.
35+ Note that this tries to make Bash the default
36+ {option}`users.defaultUserShell`,
37+ which in turn means that you might need to explicitly
38+ set this variable if you have another shell configured
39+ with NixOS.
40+ '';
41+ type = lib.types.bool;
42+ };
004344 shellAliases = lib.mkOption {
45 default = { };
···124125 };
126127+ config = lib.mkIf cfg.enable {
0128129+ programs.bash = {
130131+ shellAliases = builtins.mapAttrs (name: lib.mkDefault) cfge.shellAliases;
132133+ shellInit = ''
134+ if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]; then
135+ . ${config.system.build.setEnvironment}
136+ fi
137138+ ${cfge.shellInit}
139+ '';
140141+ loginShellInit = cfge.loginShellInit;
142143+ interactiveShellInit = ''
144+ # Check the window size after every command.
145+ shopt -s checkwinsize
146147+ # Disable hashing (i.e. caching) of command lookups.
148+ set +h
149150+ ${cfg.promptInit}
151+ ${cfg.promptPluginInit}
152+ ${bashAliases}
153154+ ${cfge.interactiveShellInit}
155+ '';
156157+ };
158159+ environment.etc.profile.text = ''
160+ # /etc/profile: DO NOT EDIT -- this file has been generated automatically.
161+ # This file is read for login shells.
162163+ # Only execute this file once per shell.
164+ if [ -n "$__ETC_PROFILE_SOURCED" ]; then return; fi
165+ __ETC_PROFILE_SOURCED=1
166167+ # Prevent this file from being sourced by interactive non-login child shells.
168+ export __ETC_PROFILE_DONE=1
169170+ ${cfg.shellInit}
171+ ${cfg.loginShellInit}
172173+ # Read system-wide modifications.
174+ if test -f /etc/profile.local; then
175+ . /etc/profile.local
176+ fi
177178+ if [ -n "''${BASH_VERSION:-}" ]; then
179+ . /etc/bashrc
180+ fi
181+ '';
182183+ environment.etc.bashrc.text = ''
184+ # /etc/bashrc: DO NOT EDIT -- this file has been generated automatically.
185186+ # Only execute this file once per shell.
187+ if [ -n "$__ETC_BASHRC_SOURCED" ] || [ -n "$NOSYSBASHRC" ]; then return; fi
188+ __ETC_BASHRC_SOURCED=1
189190+ # If the profile was not loaded in a parent process, source
191+ # it. But otherwise don't do it because we don't want to
192+ # clobber overridden values of $PATH, etc.
193+ if [ -z "$__ETC_PROFILE_DONE" ]; then
194+ . /etc/profile
195+ fi
196197+ # We are not always an interactive shell.
198+ if [ -n "$PS1" ]; then
199+ ${cfg.interactiveShellInit}
200+ fi
201202+ # Read system-wide modifications.
203+ if test -f /etc/bashrc.local; then
204+ . /etc/bashrc.local
205+ fi
206+ '';
207208+ environment.etc.bash_logout.text = ''
209+ # /etc/bash_logout: DO NOT EDIT -- this file has been generated automatically.
210211+ # Only execute this file once per shell.
212+ if [ -n "$__ETC_BASHLOGOUT_SOURCED" ] || [ -n "$NOSYSBASHLOGOUT" ]; then return; fi
213+ __ETC_BASHLOGOUT_SOURCED=1
214215+ ${cfg.logout}
216217+ # Read system-wide modifications.
218+ if test -f /etc/bash_logout.local; then
219+ . /etc/bash_logout.local
220+ fi
221+ '';
222223+ # Configuration for readline in bash. We use "option default"
224+ # priority to allow user override using both .text and .source.
225+ environment.etc.inputrc.source = lib.mkOptionDefault ./inputrc;
226227+ users.defaultUserShell = lib.mkDefault pkgs.bashInteractive;
228229+ environment.pathsToLink = lib.optionals cfg.completion.enable [
230+ "/etc/bash_completion.d"
231+ "/share/bash-completion"
232+ ];
233234+ environment.shells = [
235+ "/run/current-system/sw/bin/bash"
236+ "/run/current-system/sw/bin/sh"
237+ "${pkgs.bashInteractive}/bin/bash"
238+ "${pkgs.bashInteractive}/bin/sh"
239+ ];
240241+ };
242243}
+31-2
nixos/modules/programs/fuse.nix
···1-{ config, lib, ... }:
0000023let
4 cfg = config.programs.fuse;
···7 meta.maintainers = with lib.maintainers; [ ];
89 options.programs.fuse = {
000010 mountMax = lib.mkOption {
11 # In the C code it's an "int" (i.e. signed and at least 16 bit), but
12 # negative numbers obviously make no sense:
···27 };
28 };
2930- config = {
000000000000000000031 environment.etc."fuse.conf".text = ''
32 ${lib.optionalString (!cfg.userAllowOther) "#"}user_allow_other
33 mount_max = ${builtins.toString cfg.mountMax}
34 '';
035 };
36}
···335 }
336 );
33700338 # SSH configuration. Slight duplication of the sshd_config
339 # generation in the sshd service.
340 environment.etc."ssh/ssh_config".text = ''
···335 }
336 );
337338+ environment.corePackages = [ cfg.package ];
339+340 # SSH configuration. Slight duplication of the sshd_config
341 # generation in the sshd service.
342 environment.etc."ssh/ssh_config".text = ''
-2
nixos/modules/security/wrappers/default.nix
···266 in
267 {
268 # These are mount related wrappers that require the +s permission.
269- fusermount = mkSetuidRoot "${lib.getBin pkgs.fuse}/bin/fusermount";
270- fusermount3 = mkSetuidRoot "${lib.getBin pkgs.fuse3}/bin/fusermount3";
271 mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
272 umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
273 };
···266 in
267 {
268 # These are mount related wrappers that require the +s permission.
00269 mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
270 umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
271 };
···461 # Add the mount helpers to the system path so that `mount' can find them.
462 system.fsPackages = [ pkgs.dosfstools ];
463464- environment.systemPackages =
465- with pkgs;
466- [
467- fuse3
468- fuse
469- ]
470- ++ config.system.fsPackages;
471472 environment.etc.fstab.text =
473 let
···461 # Add the mount helpers to the system path so that `mount' can find them.
462 system.fsPackages = [ pkgs.dosfstools ];
463464+ environment.systemPackages = config.system.fsPackages;
000000465466 environment.etc.fstab.text =
467 let
···5in
6{
7 name = "nixseparatedebuginfod";
8- # A binary cache with debug info and source for nix
9 nodes.cache =
10 { pkgs, ... }:
11 {
···15 openFirewall = true;
16 };
17 system.extraDependencies = [
18- pkgs.nix.debug
19- pkgs.nix.src
20 pkgs.sl
21 ];
22 };
···33 environment.systemPackages = [
34 pkgs.valgrind
35 pkgs.gdb
036 (pkgs.writeShellScriptBin "wait_for_indexation" ''
37 set -x
38- while debuginfod-find debuginfo /run/current-system/sw/bin/nix |& grep 'File too large'; do
39 sleep 1;
40 done
41 '')
···5657 # nixseparatedebuginfod needs .drv to associate executable -> source
58 # on regular systems this would be provided by nixos-rebuild
59- machine.succeed("nix-instantiate '<nixpkgs>' -A nix")
6061 machine.succeed("timeout 600 wait_for_indexation")
6263 # test debuginfod-find
64- machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/nix")
6566 # test that gdb can fetch source
67- out = machine.succeed("gdb /run/current-system/sw/bin/nix --batch -x ${builtins.toFile "commands" ''
68 start
69 l
70 ''}")
71 print(out)
72- assert 'int main(' in out
7374 # test that valgrind can display location information
75- # this relies on the fact that valgrind complains about nix
76- # libgc helps in this regard, and we also ask valgrind to show leak kinds
77 # which are usually false positives.
78- out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all nix-env --version 2>&1")
79 print(out)
80- assert 'main.cc' in out
81 '';
82}
···5in
6{
7 name = "nixseparatedebuginfod";
8+ # A binary cache with debug info and source for gnumake
9 nodes.cache =
10 { pkgs, ... }:
11 {
···15 openFirewall = true;
16 };
17 system.extraDependencies = [
18+ pkgs.gnumake.debug
19+ pkgs.gnumake.src
20 pkgs.sl
21 ];
22 };
···33 environment.systemPackages = [
34 pkgs.valgrind
35 pkgs.gdb
36+ pkgs.gnumake
37 (pkgs.writeShellScriptBin "wait_for_indexation" ''
38 set -x
39+ while debuginfod-find debuginfo /run/current-system/sw/bin/make |& grep 'File too large'; do
40 sleep 1;
41 done
42 '')
···5758 # nixseparatedebuginfod needs .drv to associate executable -> source
59 # on regular systems this would be provided by nixos-rebuild
60+ machine.succeed("nix-instantiate '<nixpkgs>' -A gnumake")
6162 machine.succeed("timeout 600 wait_for_indexation")
6364 # test debuginfod-find
65+ machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/make")
6667 # test that gdb can fetch source
68+ out = machine.succeed("gdb /run/current-system/sw/bin/make --batch -x ${builtins.toFile "commands" ''
69 start
70 l
71 ''}")
72 print(out)
73+ assert 'main (int argc, char **argv, char **envp)' in out
7475 # test that valgrind can display location information
76+ # this relies on the fact that valgrind complains about gnumake
77+ # because we also ask valgrind to show leak kinds
78 # which are usually false positives.
79+ out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all make --version 2>&1")
80 print(out)
81+ assert 'main.c' in out
82 '';
83}
···1+{ pkgs, lib, ... }:
2+{
3+ name = "nixseparatedebuginfod2";
4+ # A binary cache with debug info and source for gnumake
5+ nodes.cache =
6+ { pkgs, ... }:
7+ {
8+ services.nginx = {
9+ enable = true;
10+ virtualHosts.default = {
11+ default = true;
12+ addSSL = false;
13+ root = "/var/lib/thebinarycache";
14+ };
15+ };
16+ networking.firewall.allowedTCPPorts = [ 80 ];
17+ systemd.services.buildthebinarycache = {
18+ before = [ "nginx.service" ];
19+ wantedBy = [ "nginx.service" ];
20+ script = ''
21+ ${pkgs.nix}/bin/nix --extra-experimental-features nix-command copy --to file:///var/lib/thebinarycache?index-debug-info=true ${pkgs.gnumake.debug} ${pkgs.gnumake} ${pkgs.gnumake.src} ${pkgs.sl}
22+ '';
23+ serviceConfig = {
24+ User = "nginx";
25+ Group = "nginx";
26+ StateDirectory = "thebinarycache";
27+ Type = "oneshot";
28+ };
29+ };
30+ };
31+ # the machine where we need the debuginfo
32+ nodes.machine = {
33+ services.nixseparatedebuginfod2 = {
34+ enable = true;
35+ substituter = "http://cache";
36+ };
37+ environment.systemPackages = [
38+ pkgs.valgrind
39+ pkgs.gdb
40+ pkgs.gnumake
41+ ];
42+ };
43+ testScript = ''
44+ start_all()
45+ cache.wait_for_unit("nginx.service")
46+ cache.wait_for_open_port(80)
47+ machine.wait_for_unit("nixseparatedebuginfod2.service")
48+ machine.wait_for_open_port(1950)
49+50+ with subtest("check that the binary cache works"):
51+ machine.succeed("nix-store --extra-substituters http://cache --option require-sigs false -r ${pkgs.sl}")
52+53+ # test debuginfod-find
54+ machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/make")
55+56+ # test that gdb can fetch source
57+ out = machine.succeed("gdb /run/current-system/sw/bin/make --batch -x ${builtins.toFile "commands" ''
58+ start
59+ l
60+ ''}")
61+ print(out)
62+ assert 'main (int argc, char **argv, char **envp)' in out
63+64+ # test that valgrind can display location information
65+ # this relies on the fact that valgrind complains about gnumake
66+ # because we also ask valgrind to show leak kinds
67+ # which are usually false positives.
68+ out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all make --version 2>&1")
69+ print(out)
70+ assert 'main.c' in out
71+ '';
72+}
+24-5
nixos/tests/tayga.nix
···31 };
3233 nodes = {
34- # The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
35- # disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
36- # Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
37- # documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
38- # RFC 6589 (Carrier Grade NAT) is used here.
39 # To reach the IPv4 address pool of the NAT64 gateway, there is a static
40 # route configured. In normal cases, where the router would also source NAT
41 # the pool addresses to one IPv4 addresses, this would not be needed.
···63 };
64 };
65 programs.mtr.enable = true;
066 };
6768 # The router is configured with static IPv4 addresses towards the server
···87 ];
8889 networking = {
090 useDHCP = false;
91 useNetworkd = true;
92 firewall.enable = false;
···137 mappings = {
138 "192.0.2.42" = "2001:db8::2";
139 };
0000000140 };
0141 };
142143 router_nixos = {
···152 ];
153154 networking = {
0155 useDHCP = false;
156 firewall.enable = false;
157 interfaces.eth1 = lib.mkForce {
···201 mappings = {
202 "192.0.2.42" = "2001:db8::2";
203 };
0000000204 };
0205 };
206207 # The client is configured with static IPv6 addresses. It has also a static
···233 };
234 };
235 programs.mtr.enable = true;
0236 };
237 };
238
···31 };
3233 nodes = {
34+ # The server is configured with static IPv4 addresses. We have to disable the
35+ # well-known prefix restrictions (as required by RFC 6052 Section 3.1) because
36+ # we're using private space (TAYGA also considers documentation space non-global,
37+ # unfortunately).
038 # To reach the IPv4 address pool of the NAT64 gateway, there is a static
39 # route configured. In normal cases, where the router would also source NAT
40 # the pool addresses to one IPv4 addresses, this would not be needed.
···62 };
63 };
64 programs.mtr.enable = true;
65+ environment.systemPackages = [ pkgs.tcpdump ];
66 };
6768 # The router is configured with static IPv4 addresses towards the server
···87 ];
8889 networking = {
90+ hostName = "router-systemd";
91 useDHCP = false;
92 useNetworkd = true;
93 firewall.enable = false;
···138 mappings = {
139 "192.0.2.42" = "2001:db8::2";
140 };
141+ log = [
142+ "drop"
143+ "reject"
144+ "icmp"
145+ "self"
146+ ];
147+ wkpfStrict = false;
148 };
149+ environment.systemPackages = [ pkgs.tcpdump ];
150 };
151152 router_nixos = {
···161 ];
162163 networking = {
164+ hostName = "router-nixos";
165 useDHCP = false;
166 firewall.enable = false;
167 interfaces.eth1 = lib.mkForce {
···211 mappings = {
212 "192.0.2.42" = "2001:db8::2";
213 };
214+ log = [
215+ "drop"
216+ "reject"
217+ "icmp"
218+ "self"
219+ ];
220+ wkpfStrict = false;
221 };
222+ environment.systemPackages = [ pkgs.tcpdump ];
223 };
224225 # The client is configured with static IPv6 addresses. It has also a static
···251 };
252 };
253 programs.mtr.enable = true;
254+ environment.systemPackages = [ pkgs.tcpdump ];
255 };
256 };
257
···256 ./0019-meson-Don-t-link-ssh-dropins.patch
257258 ./0020-install-unit_file_exists_full-follow-symlinks.patch
000000000000000259 ]
260 ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
261 ./0021-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
···585 (lib.mesonEnable "gnutls" false)
586 (lib.mesonEnable "xkbcommon" false)
587 (lib.mesonEnable "man" true)
588+ # (lib.mesonEnable "nspawn" withNspawn) # nspawn build can be turned off on systemd 258, on 257.x it will just not be installed in systemdLibs but the build is unconditional
589590 (lib.mesonBool "analyze" withAnalyze)
591 (lib.mesonBool "logind" withLogind)
···682 ]
683 ++ lib.optionals withNspawn [
684 {
685+ # we only need to patch getent when nspawn will actually be built/installed
686+ # as of systemd 257.x, nspawn will not be installed on systemdLibs, so we don't need to patch it
687+ # patching getent unconditionally here introduces infinite recursion on musl
688 search = "/usr/bin/getent";
689 replacement = "${getent}/bin/getent";
690 where = [ "src/nspawn/nspawn-setuid.c" ];