···3## User Guide
45Several versions of Python are available on Nix as well as a high amount of
6-packages. The default interpreter is CPython 3.5.
78### Using Python
9···131132The output of the function is a derivation, which is an attribute with the name
133`toolz` of the set `pythonPackages`. Actually, sets are created for all interpreter versions,
134-so `python27Packages`, `python34Packages`, `python35Packages` and `pypyPackages`.
135136The above example works when you're directly working on
137`pkgs/top-level/python-packages.nix` in the Nixpkgs repository. Often though,
···422423### Interpreters
424425-Versions 2.6, 2.7, 3.3, 3.4 and 3.5 of the CPython interpreter are available as respectively
426-`python26`, `python27`, `python33`, `python34` and `python35`. The PyPy interpreter
427is available as `pypy`. The aliases `python2` and `python3` correspond to respectively `python27` and
428`python35`. The default interpreter, `python`, maps to `python2`.
429The Nix expressions for the interpreters can be found in
···472* `pkgs.python33Packages`
473* `pkgs.python34Packages`
474* `pkgs.python35Packages`
0475* `pkgs.pypyPackages`
476477and the aliases
···674those using Python in a `nix-shell`.
675676When the environment variable `DETERMINISTIC_BUILD` is set, all bytecode will have timestamp 1.
677-The `buildPythonPackage` function sets `DETERMINISTIC_BUILD` as well as
678-[PYTHONHASHSEED](https://docs.python.org/3.5/using/cmdline.html#envvar-PYTHONHASHSEED).
679Both are also exported in `nix-shell`.
680681
···3## User Guide
45Several versions of Python are available on Nix as well as a high amount of
6+packages. The default interpreter is CPython 2.7.
78### Using Python
9···131132The output of the function is a derivation, which is an attribute with the name
133`toolz` of the set `pythonPackages`. Actually, sets are created for all interpreter versions,
134+so e.g. `python27Packages`, `python35Packages` and `pypyPackages`.
135136The above example works when you're directly working on
137`pkgs/top-level/python-packages.nix` in the Nixpkgs repository. Often though,
···422423### Interpreters
424425+Versions 2.7, 3.3, 3.4, 3.5 and 3.6 of the CPython interpreter are available as
426+respectively `python27`, `python33`, `python34`, `python35` and `python36`. The PyPy interpreter
427is available as `pypy`. The aliases `python2` and `python3` correspond to respectively `python27` and
428`python35`. The default interpreter, `python`, maps to `python2`.
429The Nix expressions for the interpreters can be found in
···472* `pkgs.python33Packages`
473* `pkgs.python34Packages`
474* `pkgs.python35Packages`
475+* `pkgs.python36Packages`
476* `pkgs.pypyPackages`
477478and the aliases
···675those using Python in a `nix-shell`.
676677When the environment variable `DETERMINISTIC_BUILD` is set, all bytecode will have timestamp 1.
678+The `buildPythonPackage` function sets `DETERMINISTIC_BUILD=1` and
679+[PYTHONHASHSEED=0](https://docs.python.org/3.5/using/cmdline.html#envvar-PYTHONHASHSEED).
680Both are also exported in `nix-shell`.
681682
···11<command>dd if=<replaceable>path-to-image</replaceable>
12of=<replaceable>/dev/sdb</replaceable></command>. Be careful about specifying the
13correct drive; you can use the <command>lsblk</command> command to get a list of
14-block devices.</para>
001516<para>The <command>dd</command> utility will write the image verbatim to the drive,
17making it the recommended option for both UEFI and non-UEFI installations. For
···11<command>dd if=<replaceable>path-to-image</replaceable>
12of=<replaceable>/dev/sdb</replaceable></command>. Be careful about specifying the
13correct drive; you can use the <command>lsblk</command> command to get a list of
14+block devices. If you're on OS X you can run <command>diskutil list</command>
15+to see the list of devices; the device you'll use for the USB must be ejected
16+before writing the image.</para>
1718<para>The <command>dd</command> utility will write the image verbatim to the drive,
19making it the recommended option for both UEFI and non-UEFI installations. For
+7-9
nixos/doc/manual/release-notes/rl-1703.xml
···9798 <listitem>
99 <para>
100- The Yama LSM is now enabled by default in the kernel,
101- which prevents ptracing non-child processes.
102- This means you will not be able to attach gdb to an existing process,
103- but will need to start that process from gdb (so it is a child).
104- </para>
105- </listitem>
106-107- <listitem>
108- <para>
109 The <literal>stripHash</literal> bash function in <literal>stdenv</literal>
110 changed according to its documentation; it now outputs the stripped name to
111 <literal>stdout</literal> instead of putting it in the variable
···246 <literal>services.rmilter.bindSocket.*</literal>. The default is still
247 a unix socket in <literal>/run/rmilter/rmilter.sock</literal>. Refer to
248 the options documentation for more information.
0000000249 </para>
250 </listitem>
251
···9798 <listitem>
99 <para>
000000000100 The <literal>stripHash</literal> bash function in <literal>stdenv</literal>
101 changed according to its documentation; it now outputs the stripped name to
102 <literal>stdout</literal> instead of putting it in the variable
···237 <literal>services.rmilter.bindSocket.*</literal>. The default is still
238 a unix socket in <literal>/run/rmilter/rmilter.sock</literal>. Refer to
239 the options documentation for more information.
240+ </para>
241+ </listitem>
242+243+ <listitem>
244+ <para>
245+ The <literal>fetch*</literal> functions no longer support md5,
246+ please use sha256 instead.
247 </para>
248 </listitem>
249
+4
nixos/modules/config/sysctl.nix
···64 # Removed under grsecurity.
65 boot.kernel.sysctl."kernel.kptr_restrict" =
66 if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1;
000067 };
68}
···64 # Removed under grsecurity.
65 boot.kernel.sysctl."kernel.kptr_restrict" =
66 if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1;
67+68+ # Disable YAMA by default to allow easy debugging.
69+ boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
70+71 };
72}
···177 # programs to be wrapped.
178 WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
179180- # Remove the old /var/setuid-wrappers path from the system...
181- #
182- # TODO: this is only necessary for ugprades 16.09 => 17.x;
183- # this conditional removal block needs to be removed after
184- # the release.
185- if [ -d /var/setuid-wrappers ]; then
186- rm -rf /var/setuid-wrappers
187- fi
188-189- # Remove the old /run/setuid-wrappers-dir path from the
190- # system as well...
191- #
192- # TODO: this is only necessary for ugprades 16.09 => 17.x;
193- # this conditional removal block needs to be removed after
194- # the release.
195- if [ -d /run/setuid-wrapper-dirs ]; then
196- rm -rf /run/setuid-wrapper-dirs
197- fi
198-199 # We want to place the tmpdirs for the wrappers to the parent dir.
200 wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
201 chmod a+rx $wrapperDir
···177 # programs to be wrapped.
178 WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
1790000000000000000000180 # We want to place the tmpdirs for the wrappers to the parent dir.
181 wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
182 chmod a+rx $wrapperDir
+4-2
nixos/modules/services/hardware/udev.nix
···35 udevRules = pkgs.runCommand "udev-rules"
36 { preferLocalBuild = true;
37 allowSubstitutes = false;
038 }
39 ''
40 mkdir -p $out
···45 echo 'ENV{PATH}="${udevPath}/bin:${udevPath}/sbin"' > $out/00-path.rules
4647 # Add the udev rules from other packages.
48- for i in ${toString cfg.packages}; do
49 echo "Adding rules for package $i"
50 for j in $i/{etc,lib}/udev/rules.d/*; do
51 echo "Copying $j to $out/$(basename $j)"
···132 hwdbBin = pkgs.runCommand "hwdb.bin"
133 { preferLocalBuild = true;
134 allowSubstitutes = false;
0135 }
136 ''
137 mkdir -p etc/udev/hwdb.d
138- for i in ${toString ([udev] ++ cfg.packages)}; do
139 echo "Adding hwdb files for package $i"
140 for j in $i/{etc,lib}/udev/hwdb.d/*; do
141 ln -s $j etc/udev/hwdb.d/$(basename $j)
···35 udevRules = pkgs.runCommand "udev-rules"
36 { preferLocalBuild = true;
37 allowSubstitutes = false;
38+ packages = unique (map toString cfg.packages);
39 }
40 ''
41 mkdir -p $out
···46 echo 'ENV{PATH}="${udevPath}/bin:${udevPath}/sbin"' > $out/00-path.rules
4748 # Add the udev rules from other packages.
49+ for i in $packages; do
50 echo "Adding rules for package $i"
51 for j in $i/{etc,lib}/udev/rules.d/*; do
52 echo "Copying $j to $out/$(basename $j)"
···133 hwdbBin = pkgs.runCommand "hwdb.bin"
134 { preferLocalBuild = true;
135 allowSubstitutes = false;
136+ packages = unique (map toString ([udev] ++ cfg.packages));
137 }
138 ''
139 mkdir -p etc/udev/hwdb.d
140+ for i in $packages; do
141 echo "Adding hwdb files for package $i"
142 for j in $i/{etc,lib}/udev/hwdb.d/*; do
143 ln -s $j etc/udev/hwdb.d/$(basename $j)
···140 };
141142 privoxy.enable = mkOption {
0143 default = true;
144 description = ''
145 Whether to enable and configure the system Privoxy to use Tor's
···140 };
141142 privoxy.enable = mkOption {
143+ type = types.bool;
144 default = true;
145 description = ''
146 Whether to enable and configure the system Privoxy to use Tor's
···443my $tmpFile = $confFile . ".tmp";
444writeFile($tmpFile, $conf);
445000000000000000000000000000000446# Append entries detected by os-prober
447if (get("useOSProber") eq "true") {
448- system(get("shell"), "-c", "pkgdatadir=$grub/share/grub $grub/etc/grub.d/30_os-prober >> $tmpFile");
0449}
450451# Atomically switch to the new config
···498 }
499 return @devices;
500}
501-502-# check whether to install GRUB EFI or not
503-sub getEfiTarget {
504- if ($grubVersion == 1) {
505- return "no"
506- } elsif (($grub ne "") && ($grubEfi ne "")) {
507- # EFI can only be installed when target is set;
508- # A target is also required then for non-EFI grub
509- if (($grubTarget eq "") || ($grubTargetEfi eq "")) { die }
510- else { return "both" }
511- } elsif (($grub ne "") && ($grubEfi eq "")) {
512- # TODO: It would be safer to disallow non-EFI grub installation if no taget is given.
513- # If no target is given, then grub auto-detects the target which can lead to errors.
514- # E.g. it seems as if grub would auto-detect a EFI target based on the availability
515- # of a EFI partition.
516- # However, it seems as auto-detection is currently relied on for non-x86_64 and non-i386
517- # architectures in NixOS. That would have to be fixed in the nixos modules first.
518- return "no"
519- } elsif (($grub eq "") && ($grubEfi ne "")) {
520- # EFI can only be installed when target is set;
521- if ($grubTargetEfi eq "") { die }
522- else {return "only" }
523- } else {
524- # prevent an installation if neither grub nor grubEfi is given
525- return "neither"
526- }
527-}
528-529my @deviceTargets = getDeviceTargets();
530-my $efiTarget = getEfiTarget();
531my $prevGrubState = readGrubState();
532my @prevDeviceTargets = split/,/, $prevGrubState->devices;
533
···443my $tmpFile = $confFile . ".tmp";
444writeFile($tmpFile, $conf);
445446+447+# check whether to install GRUB EFI or not
448+sub getEfiTarget {
449+ if ($grubVersion == 1) {
450+ return "no"
451+ } elsif (($grub ne "") && ($grubEfi ne "")) {
452+ # EFI can only be installed when target is set;
453+ # A target is also required then for non-EFI grub
454+ if (($grubTarget eq "") || ($grubTargetEfi eq "")) { die }
455+ else { return "both" }
456+ } elsif (($grub ne "") && ($grubEfi eq "")) {
457+ # TODO: It would be safer to disallow non-EFI grub installation if no taget is given.
458+ # If no target is given, then grub auto-detects the target which can lead to errors.
459+ # E.g. it seems as if grub would auto-detect a EFI target based on the availability
460+ # of a EFI partition.
461+ # However, it seems as auto-detection is currently relied on for non-x86_64 and non-i386
462+ # architectures in NixOS. That would have to be fixed in the nixos modules first.
463+ return "no"
464+ } elsif (($grub eq "") && ($grubEfi ne "")) {
465+ # EFI can only be installed when target is set;
466+ if ($grubTargetEfi eq "") { die }
467+ else {return "only" }
468+ } else {
469+ # prevent an installation if neither grub nor grubEfi is given
470+ return "neither"
471+ }
472+}
473+474+my $efiTarget = getEfiTarget();
475+476# Append entries detected by os-prober
477if (get("useOSProber") eq "true") {
478+ my $targetpackage = ($efiTarget eq "no") ? $grub : $grubEfi;
479+ system(get("shell"), "-c", "pkgdatadir=$targetpackage/share/grub $targetpackage/etc/grub.d/30_os-prober >> $tmpFile");
480}
481482# Atomically switch to the new config
···529 }
530 return @devices;
531}
0000000000000000000000000000532my @deviceTargets = getDeviceTargets();
0533my $prevGrubState = readGrubState();
534my @prevDeviceTargets = split/,/, $prevGrubState->devices;
535
···39 server admins start using the new version?
40*/
4142-assert md5 != "" || sha256 != "";
43assert deepClone -> leaveDotGit;
4400045stdenv.mkDerivation {
46 inherit name;
47 builder = ./builder.sh;
48 fetcher = "${./nix-prefetch-git}"; # This must be a string to ensure it's called with bash.
49 buildInputs = [git];
5051- outputHashAlgo = if sha256 == "" then "md5" else "sha256";
52 outputHashMode = "recursive";
53- outputHash = if sha256 == "" then md5 else sha256;
5455 inherit url rev leaveDotGit fetchSubmodules deepClone branchName;
56
···39 server admins start using the new version?
40*/
41042assert deepClone -> leaveDotGit;
4344+if md5 != "" then
45+ throw "fetchgit does not support md5 anymore, please use sha256"
46+else
47stdenv.mkDerivation {
48 inherit name;
49 builder = ./builder.sh;
50 fetcher = "${./nix-prefetch-git}"; # This must be a string to ensure it's called with bash.
51 buildInputs = [git];
5253+ outputHashAlgo = "sha256";
54 outputHashMode = "recursive";
55+ outputHash = sha256;
5657 inherit url rev leaveDotGit fetchSubmodules deepClone branchName;
58
···87let
8889 hasHash = showURLs || (outputHash != "" && outputHashAlgo != "")
90- || md5 != "" || sha1 != "" || sha256 != "" || sha512 != "";
91 urls_ = if urls != [] then urls else [url];
9293in
9495-if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenv.lib.concatStringsSep ", " urls_}" else stdenv.mkDerivation {
0096 name =
97 if showURLs then "urls"
98 else if name != "" then name
···110111 # New-style output content requirements.
112 outputHashAlgo = if outputHashAlgo != "" then outputHashAlgo else
113- if sha512 != "" then "sha512" else if sha256 != "" then "sha256" else if sha1 != "" then "sha1" else "md5";
114 outputHash = if outputHash != "" then outputHash else
115- if sha512 != "" then sha512 else if sha256 != "" then sha256 else if sha1 != "" then sha1 else md5;
116117 outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
118
···87let
8889 hasHash = showURLs || (outputHash != "" && outputHashAlgo != "")
90+ || sha1 != "" || sha256 != "" || sha512 != "";
91 urls_ = if urls != [] then urls else [url];
9293in
9495+if md5 != "" then throw "fetchsvnssh does not support md5 anymore, please use sha256 or sha512"
96+else if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenv.lib.concatStringsSep ", " urls_}"
97+else stdenv.mkDerivation {
98 name =
99 if showURLs then "urls"
100 else if name != "" then name
···112113 # New-style output content requirements.
114 outputHashAlgo = if outputHashAlgo != "" then outputHashAlgo else
115+ if sha512 != "" then "sha512" else if sha256 != "" then "sha256" else "sha1";
116 outputHash = if outputHash != "" then outputHash else
117+ if sha512 != "" then sha512 else if sha256 != "" then sha256 else sha1;
118119 outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
120
···76 ++ optional langAda ../gnat-cflags.patch
77 ++ optional langFortran ../gfortran-driving.patch
7879- # This could be applied unconditionally but I don't want to cause a full Linux rebuild.
080 ++ optional stdenv.cc.isClang ./libcxx38-and-above.patch;
8182 javaEcj = fetchurl {
···233 NIX_NO_SELF_RPATH = true;
234235 libc_dev = stdenv.cc.libc_dev;
0000000236237 postPatch =
238 if (stdenv.isGNU
···76 ++ optional langAda ../gnat-cflags.patch
77 ++ optional langFortran ../gfortran-driving.patch
7879+ # This could be applied unconditionally but I don't want to cause a full
80+ # Linux rebuild.
81 ++ optional stdenv.cc.isClang ./libcxx38-and-above.patch;
8283 javaEcj = fetchurl {
···234 NIX_NO_SELF_RPATH = true;
235236 libc_dev = stdenv.cc.libc_dev;
237+238+ # This should kill all the stdinc frameworks that gcc and friends like to
239+ # insert into default search paths.
240+ prePatch = if stdenv.isDarwin then ''
241+ substituteInPlace gcc/config/darwin-c.c \
242+ --replace 'if (stdinc)' 'if (0)'
243+ '' else null;
244245 postPatch =
246 if (stdenv.isGNU
···1{ stdenv, fetchurl, xlibsWrapper, libpng, libjpeg, libtiff, zlib, bzip2, libXcursor, libXrandr, libXft
2, CoreServices ? null }:
34-let
5- version = "1.7.9";
6-in
7-8stdenv.mkDerivation rec {
9 name = "fox-${version}";
01011 src = fetchurl {
12 url = "ftp://ftp.fox-toolkit.org/pub/${name}.tar.gz";
13 sha256 = "1jb9368xsin3ppdf6979n5s7in3s9klbxqbwcp0z8misjixl7nzg";
14 };
001516 buildInputs = [ libpng xlibsWrapper libjpeg libtiff zlib bzip2 libXcursor libXrandr libXft ]
17- ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
1819 doCheck = true;
20···2223 hardeningDisable = [ "format" ];
2425- meta = {
26 description = "C++ based class library for building Graphical User Interfaces";
27 longDescription = ''
28- FOX stands for Free Objects for X.
29- It is a C++ based class library for building Graphical User Interfaces.
30- Initially, it was developed for LINUX, but the scope of this project has in the course of time become somewhat more ambitious.
31- Current aims are to make FOX completely platform independent, and thus programs written against the FOX library will be only a compile away from running on a variety of platforms.
32- '';
33 homepage = "http://fox-toolkit.org";
34- license = stdenv.lib.licenses.lgpl3;
35- maintainers = [ stdenv.lib.maintainers.bbenoist ];
36- platforms = stdenv.lib.platforms.all;
37 };
38}
···1{ stdenv, fetchurl, xlibsWrapper, libpng, libjpeg, libtiff, zlib, bzip2, libXcursor, libXrandr, libXft
2, CoreServices ? null }:
300004stdenv.mkDerivation rec {
5 name = "fox-${version}";
6+ version = "1.7.9";
78 src = fetchurl {
9 url = "ftp://ftp.fox-toolkit.org/pub/${name}.tar.gz";
10 sha256 = "1jb9368xsin3ppdf6979n5s7in3s9klbxqbwcp0z8misjixl7nzg";
11 };
12+13+ patches = [ ./clang.patch ];
1415 buildInputs = [ libpng xlibsWrapper libjpeg libtiff zlib bzip2 libXcursor libXrandr libXft ]
16+ ++ stdenv.lib.optional stdenv.isDarwin CoreServices;
1718 doCheck = true;
19···2122 hardeningDisable = [ "format" ];
2324+ meta = with stdenv.lib; {
25 description = "C++ based class library for building Graphical User Interfaces";
26 longDescription = ''
27+ FOX stands for Free Objects for X.
28+ It is a C++ based class library for building Graphical User Interfaces.
29+ Initially, it was developed for LINUX, but the scope of this project has in the course of time become somewhat more ambitious.
30+ Current aims are to make FOX completely platform independent, and thus programs written against the FOX library will be only a compile away from running on a variety of platforms.
31+ '';
32 homepage = "http://fox-toolkit.org";
33+ license = licenses.lgpl3;
34+ maintainers = [];
35+ platforms = platforms.all;
36 };
37}
···1+{ stdenv, lib, buildGoPackage, fetchFromGitLab }:
2+buildGoPackage rec {
3+ name = "loccount-${version}";
4+ version = "1.0";
5+6+ goPackagePath = "gitlab.com/esr/loccount";
7+ excludedPackages = "tests";
8+9+ src = fetchFromGitLab {
10+ owner = "esr";
11+ repo = "loccount";
12+ rev = version;
13+ sha256 = "081wf7fckn76m4x0jwq4h2fsbhpb6f67dha77ni3p6wg7q6sihqx";
14+ };
15+16+ meta = with stdenv.lib; {
17+ description = "Re-implementation of sloccount in Go";
18+ longDescription = ''
19+ loccount is a re-implementation of David A. Wheeler's sloccount tool
20+ in Go. It is faster and handles more different languages. Because
21+ it's one source file in Go, it is easier to maintain and extend than the
22+ multi-file, multi-language implementation of the original.
23+24+ The algorithms are largely unchanged and can be expected to produce
25+ identical numbers for languages supported by both tools. Python is
26+ an exception; loccount corrects buggy counting of single-quote multiline
27+ literals in sloccount 2.26.
28+ '';
29+ homepage="https://gitlab.com/esr/loccount";
30+ downloadPage="https://gitlab.com/esr/loccount/tree/master";
31+ license = licenses.bsd2;
32+ maintainers = with maintainers; [ calvertvl ];
33+ platforms = platforms.linux;
34+ };
35+}
···13 --replace "#include <msgtracer_client.h>" ''$'#include <asl.h>\nstatic void msgtracer_log_with_keys(...) { };'
1415 substituteInPlace Definitions.h \
16- --replace "#include <System/pthread_machdep.h>" ""
01718 # getspecific_direct is more efficient, but this should be equivalent...
19 substituteInPlace Zone.h \
···13 --replace "#include <msgtracer_client.h>" ''$'#include <asl.h>\nstatic void msgtracer_log_with_keys(...) { };'
1415 substituteInPlace Definitions.h \
16+ --replace "#include <System/pthread_machdep.h>" "" \
17+ --replace 'void * const, void * const' 'void * const, void *'
1819 # getspecific_direct is more efficient, but this should be equivalent...
20 substituteInPlace Zone.h \
+12-3
pkgs/os-specific/linux/kernel/common-config.nix
···33 DEBUG_KERNEL y
34 DYNAMIC_DEBUG y
35 BACKTRACE_SELF_TEST n
36- CPU_NOTIFIER_ERROR_INJECT? n
37 DEBUG_DEVRES n
38 DEBUG_STACK_USAGE n
39 DEBUG_STACKOVERFLOW n
40 RCU_TORTURE_TEST n
41 SCHEDSTATS n
42 DETECT_HUNG_TASK y
00004344 ${optionalString (versionOlder version "4.11") ''
45 TIMER_STATS y
···308 NLS_ISO8859_1 m # VFAT default for the iocharset= mount option
309310 # Runtime security tests
311- DEBUG_SET_MODULE_RONX? y # Detect writes to read-only module pages
00312313 # Security related features.
314 RANDOMIZE_BASE? y
···456 FTRACE_SYSCALLS y
457 SCHED_TRACER y
458 STACK_TRACER y
459- UPROBE_EVENT? y
0000460 ${optionalString (versionAtLeast version "4.4") ''
461 BPF_SYSCALL y
462 BPF_EVENTS y
···33 DEBUG_KERNEL y
34 DYNAMIC_DEBUG y
35 BACKTRACE_SELF_TEST n
036 DEBUG_DEVRES n
37 DEBUG_STACK_USAGE n
38 DEBUG_STACKOVERFLOW n
39 RCU_TORTURE_TEST n
40 SCHEDSTATS n
41 DETECT_HUNG_TASK y
42+43+ ${optionalString (versionOlder version "4.10") ''
44+ CPU_NOTIFIER_ERROR_INJECT? n
45+ ''}
4647 ${optionalString (versionOlder version "4.11") ''
48 TIMER_STATS y
···311 NLS_ISO8859_1 m # VFAT default for the iocharset= mount option
312313 # Runtime security tests
314+ ${optionalString (versionOlder version "4.11") ''
315+ DEBUG_SET_MODULE_RONX? y # Detect writes to read-only module pages
316+ ''}
317318 # Security related features.
319 RANDOMIZE_BASE? y
···461 FTRACE_SYSCALLS y
462 SCHED_TRACER y
463 STACK_TRACER y
464+465+ ${optionalString (versionOlder version "4.11") ''
466+ UPROBE_EVENT? y
467+ ''}
468+469 ${optionalString (versionAtLeast version "4.4") ''
470 BPF_SYSCALL y
471 BPF_EVENTS y
···1-{ fetchurl, stdenv }:
23stdenv.mkDerivation rec {
4 name = "pax-utils-${version}";
···9 sha512 = "26f7lqr1s2iywj8qfbf24sm18bl6f7cwsf77nxwwvgij1z88gvh6yx3gp65zap92l0xjdp8kwq9y96xld39p86zd9dmkm447czykbvb";
10 };
1112- makeFlags = [
13- "PREFIX=$(out)"
14- ];
1516 meta = with stdenv.lib; {
17- description = "A suite of tools for PaX/grsecurity";
18- homepage = "https://dev.gentoo.org/~vapier/dist/";
19- license = licenses.gpl2;
20- platforms = platforms.linux;
00000021 maintainers = with maintainers; [ thoughtpolice joachifm ];
22 };
23}
···1+{ stdenv, fetchurl }:
23stdenv.mkDerivation rec {
4 name = "pax-utils-${version}";
···9 sha512 = "26f7lqr1s2iywj8qfbf24sm18bl6f7cwsf77nxwwvgij1z88gvh6yx3gp65zap92l0xjdp8kwq9y96xld39p86zd9dmkm447czykbvb";
10 };
1112+ makeFlags = [ "PREFIX=$(out)" ];
001314 meta = with stdenv.lib; {
15+ description = "ELF utils that can check files for security relevant properties";
16+ longDescription = ''
17+ A suite of ELF tools to aid auditing systems. Contains
18+ various ELF related utils for ELF32, ELF64 binaries useful
19+ for displaying PaX and security info on a large groups of
20+ binary files.
21+ '';
22+ homepage = https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities;
23+ license = licenses.gpl2;
24+ platforms = platforms.unix;
25 maintainers = with maintainers; [ thoughtpolice joachifm ];
26 };
27}