···430430431431- `services.avahi.ipv6` now defaults to true.432432433433+- The Home Assistant module has new options {option}`services.home-assistant.blueprints.automation`, `services.home-assistant.blueprints.script`, and {option}`services.home-assistant.blueprints.template` that allow for the declarative installation of [blueprints](https://www.home-assistant.io/docs/blueprint/) into the appropriate configuration directories.434434+433435- For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default.434436435437- `services.kmonad` now creates a determinate symlink (in `/dev/input/by-id/`) to each of KMonad virtual devices.
+97-85
nixos/modules/profiles/hardened.nix
···1212 pkgs,1313 ...1414}:1515-1616-with lib;1717-1515+let1616+ inherit (lib)1717+ mkDefault1818+ mkOverride1919+ mkEnableOption2020+ mkIf2121+ maintainers2222+ ;2323+in1824{1919- meta = {2020- maintainers = [2121- maintainers.joachifm2222- maintainers.emily2323- ];2525+ options.profiles.hardened = mkEnableOption "hardened" // {2626+ default = true;2727+ example = false;2428 };2929+ config = mkIf config.profiles.hardened {3030+ meta = {3131+ maintainers = [3232+ maintainers.joachifm3333+ maintainers.emily3434+ ];3535+ };25362626- boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;3737+ boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;27382828- nix.settings.allowed-users = mkDefault [ "@users" ];3939+ nix.settings.allowed-users = mkDefault [ "@users" ];29403030- environment.memoryAllocator.provider = mkDefault "scudo";3131- environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";4141+ environment.memoryAllocator.provider = mkDefault "scudo";4242+ environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";32433333- security.lockKernelModules = mkDefault true;4444+ security.lockKernelModules = mkDefault true;34453535- security.protectKernelImage = mkDefault true;4646+ security.protectKernelImage = mkDefault true;36473737- security.allowSimultaneousMultithreading = mkDefault false;4848+ security.allowSimultaneousMultithreading = mkDefault false;38493939- security.forcePageTableIsolation = mkDefault true;5050+ security.forcePageTableIsolation = mkDefault true;40514141- # This is required by podman to run containers in rootless mode.4242- security.unprivilegedUsernsClone = mkDefault config.virtualisation.containers.enable;5252+ # This is required by podman to run containers in rootless mode.5353+ security.unprivilegedUsernsClone = mkDefault config.virtualisation.containers.enable;43544444- security.virtualisation.flushL1DataCache = mkDefault "always";5555+ security.virtualisation.flushL1DataCache = mkDefault "always";45564646- security.apparmor.enable = mkDefault true;4747- security.apparmor.killUnconfinedConfinables = mkDefault true;5757+ security.apparmor.enable = mkDefault true;5858+ security.apparmor.killUnconfinedConfinables = mkDefault true;48594949- boot.kernelParams = [5050- # Don't merge slabs5151- "slab_nomerge"6060+ boot.kernelParams = [6161+ # Don't merge slabs6262+ "slab_nomerge"52635353- # Overwrite free'd pages5454- "page_poison=1"6464+ # Overwrite free'd pages6565+ "page_poison=1"55665656- # Enable page allocator randomization5757- "page_alloc.shuffle=1"6767+ # Enable page allocator randomization6868+ "page_alloc.shuffle=1"58695959- # Disable debugfs6060- "debugfs=off"6161- ];7070+ # Disable debugfs7171+ "debugfs=off"7272+ ];62736363- boot.blacklistedKernelModules = [6464- # Obscure network protocols6565- "ax25"6666- "netrom"6767- "rose"7474+ boot.blacklistedKernelModules = [7575+ # Obscure network protocols7676+ "ax25"7777+ "netrom"7878+ "rose"68796969- # Old or rare or insufficiently audited filesystems7070- "adfs"7171- "affs"7272- "bfs"7373- "befs"7474- "cramfs"7575- "efs"7676- "erofs"7777- "exofs"7878- "freevxfs"7979- "f2fs"8080- "hfs"8181- "hpfs"8282- "jfs"8383- "minix"8484- "nilfs2"8585- "ntfs"8686- "omfs"8787- "qnx4"8888- "qnx6"8989- "sysv"9090- "ufs"9191- ];8080+ # Old or rare or insufficiently audited filesystems8181+ "adfs"8282+ "affs"8383+ "bfs"8484+ "befs"8585+ "cramfs"8686+ "efs"8787+ "erofs"8888+ "exofs"8989+ "freevxfs"9090+ "f2fs"9191+ "hfs"9292+ "hpfs"9393+ "jfs"9494+ "minix"9595+ "nilfs2"9696+ "ntfs"9797+ "omfs"9898+ "qnx4"9999+ "qnx6"100100+ "sysv"101101+ "ufs"102102+ ];921039393- # Hide kptrs even for processes with CAP_SYSLOG9494- boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;104104+ # Hide kptrs even for processes with CAP_SYSLOG105105+ boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;951069696- # Disable bpf() JIT (to eliminate spray attacks)9797- boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;107107+ # Disable bpf() JIT (to eliminate spray attacks)108108+ boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;981099999- # Disable ftrace debugging100100- boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;110110+ # Disable ftrace debugging111111+ boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;101112102102- # Enable strict reverse path filtering (that is, do not attempt to route103103- # packets that "obviously" do not belong to the iface's network; dropped104104- # packets are logged as martians).105105- boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true;106106- boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault "1";107107- boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true;108108- boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault "1";113113+ # Enable strict reverse path filtering (that is, do not attempt to route114114+ # packets that "obviously" do not belong to the iface's network; dropped115115+ # packets are logged as martians).116116+ boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true;117117+ boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault "1";118118+ boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true;119119+ boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault "1";109120110110- # Ignore broadcast ICMP (mitigate SMURF)111111- boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true;121121+ # Ignore broadcast ICMP (mitigate SMURF)122122+ boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true;112123113113- # Ignore incoming ICMP redirects (note: default is needed to ensure that the114114- # setting is applied to interfaces added after the sysctls are set)115115- boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false;116116- boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = mkDefault false;117117- boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = mkDefault false;118118- boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = mkDefault false;119119- boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = mkDefault false;120120- boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = mkDefault false;124124+ # Ignore incoming ICMP redirects (note: default is needed to ensure that the125125+ # setting is applied to interfaces added after the sysctls are set)126126+ boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false;127127+ boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = mkDefault false;128128+ boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = mkDefault false;129129+ boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = mkDefault false;130130+ boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = mkDefault false;131131+ boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = mkDefault false;121132122122- # Ignore outgoing ICMP redirects (this is ipv4 only)123123- boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;124124- boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;133133+ # Ignore outgoing ICMP redirects (this is ipv4 only)134134+ boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;135135+ boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;136136+ };125137}
···129129 ];130130 };131131 lovelaceConfigWritable = true;132132+133133+ blueprints.automation = [134134+ (pkgs.fetchurl {135135+ url = "https://github.com/home-assistant/core/raw/2025.1.4/homeassistant/components/automation/blueprints/motion_light.yaml";136136+ hash = "sha256-4HrDX65ycBMfEY2nZ7A25/d3ZnIHdpHZ+80Cblp+P5w=";137137+ })138138+ ];139139+ blueprints.template = [140140+ "${pkgs.home-assistant.src}/homeassistant/components/template/blueprints/inverted_binary_sensor.yaml"141141+ ];132142 };133143134144 # Cause a configuration change inside `configuration.yml` and verify that the process is being reloaded.···158148 configuration.services.home-assistant = {159149 customComponents = lib.mkForce [ ];160150 customLovelaceModules = lib.mkForce [ ];151151+ blueprints.automation = lib.mkForce [ ];152152+ blueprints.template = lib.mkForce [ ];161153 };162154 };163155 };···238226 with subtest("Check extra components are considered in systemd unit hardening"):239227 hass.succeed("systemctl show -p DeviceAllow home-assistant.service | grep -q char-ttyUSB")240228229229+ with subtest("Check that blueprints are installed"):230230+ hass.succeed("test -L '${configDir}/blueprints/automation/motion_light.yaml'")231231+ hass.succeed("test -L '${configDir}/blueprints/template/inverted_binary_sensor.yaml'")232232+241233 with subtest("Check service restart from SIGHUP"):242234 pid = hass.succeed("systemctl show --property=MainPID home-assistant.service")243235 cursor = get_journal_cursor()···263247 for domain in ["prometheus"]:264248 assert f"Setup of domain {domain} took" in journal, f"{domain} setup missing"265249266266- with subtest("Check custom components and custom lovelace modules get removed"):250250+ with subtest("Check custom components, custom lovelace modules, and blueprints get removed"):267251 cursor = get_journal_cursor()268252 hass.succeed("${system}/specialisation/removeCustomThings/bin/switch-to-configuration test")269253 hass.fail("grep -q 'mini-graph-card-bundle.js' '${configDir}/ui-lovelace.yaml'")270254 for integration in ("prometheus_sensor", "spook", "spook_inverse"):271255 hass.fail(f"test -f ${configDir}/custom_components/{integration}/manifest.json")256256+ hass.fail("test -e '${configDir}/blueprints/automation/motion_light.yaml'")257257+ hass.fail("test -e '${configDir}/blueprints/template/inverted_binary_sensor.yaml'")272258 wait_for_homeassistant(cursor)273259274260 with subtest("Check that no errors were logged"):
···11+diff --git a/rutabaga_gfx/build.rs b/rutabaga_gfx/build.rs22+index bd5a9be96..d2244c4c6 10064433+--- a/rutabaga_gfx/build.rs44++++ b/rutabaga_gfx/build.rs55+@@ -194,9 +194,14 @@ fn gfxstream() -> Result<()> {66+ pkg_config::Config::new().probe("libdrm")?;77+ }88+99++ let mut use_clang = target_os.contains("macos");1010++ if std::env::var("USE_CLANG").is_ok() {1111++ use_clang = true;1212++ }1313++1414+ // Need to link against libc++ or libstdc++. Apple is clang-only, while by default other1515+ // Unix platforms use libstdc++.1616+- if target_os.contains("macos") {1717++ if use_clang {1818+ println!("cargo:rustc-link-lib=dylib=c++");1919+ } else if target_os.contains("linux") || target_os.contains("nto") {2020+ println!("cargo:rustc-link-lib=dylib=stdc++");
+7
pkgs/by-name/ru/rutabaga_gfx/package.nix
···4040 })4141 # Install the dylib on Darwin.4242 ./darwin-install.patch4343+ # Patch for libc++, drop in next update4444+ # https://chromium.googlesource.com/crosvm/crosvm/+/8ae3c23b2e3899de33b973fc636909f1eb3dc98c4545+ ./link-cxx.patch4346 ];4747+4848+ env = lib.optionalAttrs stdenv.hostPlatform.useLLVM {4949+ USE_CLANG = true;5050+ };44514552 nativeBuildInputs = [4653 cargo
···11+{22+ lib,33+ stdenv,44+ fetchgit,55+}:66+77+stdenv.mkDerivation {88+ pname = "tt-rss-plugin-data-migration";99+ version = "0-unstable-2023-11-01";1010+1111+ src = fetchgit {1212+ url = "https://git.tt-rss.org/fox/ttrss-data-migration.git";1313+ rev = "e13d5f97b4887ce7b57b3d76228d838dec15963d";1414+ hash = "sha256-xnbR5IQ0h7ilxchNj55ROZdq1L7MIAwv3/00k09WTTs=";1515+ };1616+1717+ installPhase = ''1818+ runHook preInstall1919+2020+ install -D init.php $out/data_migration/init.php2121+2222+ runHook postInstall2323+ '';2424+2525+ meta = {2626+ description = "Plugin for TT-RSS to exports and imports *all* articles of a specific user via neutral format (JSON files in a ZIP archive)";2727+ # this plugin doesn't have a license file2828+ license = lib.licenses.unfree;2929+ homepage = "https://git.tt-rss.org/fox/ttrss-data-migration.git/";3030+ maintainers = with lib.maintainers; [ wrvsrx ];3131+ platforms = lib.platforms.all;3232+ };3333+}
···3939 };40404141 patches = [4242- # Update prisma to match the version in nixpkgs exactly (currently 6.0.1). To create this patch, change the4242+ # Update prisma to match the version in nixpkgs exactly (currently 6.3.0). To create this patch, change the4343 # versions in `package.json`, then run `nix run nixpkgs#yarn-berry -- install --mode update-lockfile`4444 # to update `yarn.lock`.4545 ./prisma6.patch···7070 yarn install --immutable --mode skip-build7171 '';72727373- outputHash = "sha256-kWE6YVhyH5Lk/SO0h624Zq9/6ztoUE3FNzHB0dyl5aI=";7373+ outputHash = "sha256-c7U/PMlulbjzWx0w4jstgfjeDYPkmfcXIRCDEQxhirA=";7474 outputHashMode = "recursive";7575 };7676
···1313 src = py;1414 format = "other";15151616- disabled = isPyPy;1717-1818- installPhase =1616+ # tkinter is included in PyPy, making this package a no-op.1717+ installPhase = lib.optionalString (!isPyPy) (1918 ''2019 # Move the tkinter module2120 mkdir -p $out/${py.sitePackages}···2526 old_rpath=$(patchelf --print-rpath $out/${py.sitePackages}/_tkinter*)2627 new_rpath=$(sed "s#${py}#${python}#g" <<< "$old_rpath" )2728 patchelf --set-rpath $new_rpath $out/${py.sitePackages}/_tkinter*2828- '';2929+ ''3030+ );29313032 meta = py.meta // {3133 # Based on first sentence from https://docs.python.org/3/library/tkinter.html