···60606161 # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
6262 # users as these make it easier to exploit kernel vulnerabilities.
6363- #
6464- # Removed under grsecurity.
6565- boot.kernel.sysctl."kernel.kptr_restrict" =
6666- if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1;
6363+ boot.kernel.sysctl."kernel.kptr_restrict" = 1;
67646865 # Disable YAMA by default to allow easy debugging.
6966 boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
···3030 cd $out/zones
31313232 for zoneFile in *; do
3333+ echo "|- checking zone '$out/zones/$zoneFile'"
3334 ${nsdPkg}/sbin/nsd-checkzone "$zoneFile" "$zoneFile" || {
3435 if grep -q \\\\\\$ "$zoneFile"; then
3536 echo zone "$zoneFile" contains escaped dollar signes \\\$
···113113 "--enable-system-sqlite"
114114 #"--enable-system-cairo"
115115 "--enable-startup-notification"
116116- "--enable-content-sandbox" # available since 26.0, but not much info available
116116+ #"--enable-content-sandbox" # TODO: probably enable after 54
117117 "--disable-tests"
118118 "--disable-necko-wifi" # maybe we want to enable this at some point
119119 "--disable-updater"
···5959 maintainers = with maintainers; [ wkennington ];
6060 # kernel 4.2 is the most recent supported kernel
6161 broken = kernel != null &&
6262- (builtins.compareVersions kernel.version "4.2" == 1 ||
6363- (kernel.features.grsecurity or false));
6262+ (builtins.compareVersions kernel.version "4.2" == 1);
6463 };
6564}
+2-1
pkgs/development/libraries/log4shib/default.nix
···12121313 nativeBuildInputs = [ autoreconfHook ];
14141515- meta = {
1515+ meta = with stdenv.lib; {
1616 description = "A forked version of log4cpp that has been created for the Shibboleth project";
1717+ maintainers = [ maintainers.jammerful ];
1718 };
1819}
···2222 description = "A low-level library written in C++ that provides support for producing and consuming SAML messages";
2323 platforms = platforms.unix;
2424 license = licenses.asl20;
2525+ maintainers = [ maintainers.jammerful ];
2526 };
2627}
···2727 description = "Enables SSO and Federation web applications written with any programming language or framework";
2828 platforms = platforms.unix;
2929 license = licenses.asl20;
3030+ maintainers = [ maintainers.jammerful ];
3031 };
3132}
···1919 description = "A low-level library that provides a high level interface to XML processing for OpenSAML 2";
2020 platforms = platforms.unix;
2121 license = licenses.asl20;
2222+ maintainers = [ maintainers.jammerful ];
2223 };
2324}
+32
pkgs/development/python-modules/3to2/default.nix
···11+{ lib
22+, buildPythonPackage
33+, fetchurl
44+, pytest
55+}:
66+77+buildPythonPackage rec {
88+ pname = "3to2";
99+ version = "1.1.1";
1010+ name = "${pname}-${version}";
1111+1212+ src = fetchurl {
1313+ url = "https://files.pythonhosted.org/packages/8f/ab/58a363eca982c40e9ee5a7ca439e8ffc5243dde2ae660ba1ffdd4868026b/${pname}-${version}.zip";
1414+ sha256 = "fef50b2b881ef743f269946e1090b77567b71bb9a9ce64b7f8e699b562ff685c";
1515+ };
1616+1717+ checkInputs = [ pytest ];
1818+1919+ checkPhase = ''
2020+ py.test lib3to2/tests
2121+ '';
2222+2323+ # Test failing due to upstream issue (https://bitbucket.org/amentajo/lib3to2/issues/50/testsuite-fails-with-new-python-35)
2424+ doCheck = false;
2525+2626+ meta = {
2727+ homepage = https://bitbucket.org/amentajo/lib3to2;
2828+ description = "Refactors valid 3.x syntax into valid 2.x syntax, if a syntactical conversion is possible";
2929+ license = lib.licenses.asl20;
3030+ maintainers = with lib.maintainers; [ mt-caret ];
3131+ };
3232+}
+38
pkgs/development/python-modules/cram/default.nix
···11+{lib, buildPythonPackage, fetchPypi, coverage, bash, which, writeText}:
22+33+buildPythonPackage rec {
44+ name = "${pname}-${version}";
55+ version = "0.7";
66+ pname = "cram";
77+88+ buildInputs = [ coverage which ];
99+1010+ src = fetchPypi {
1111+ inherit pname version;
1212+ sha256 = "0bvz6fwdi55rkrz3f50zsy35gvvwhlppki2yml5bj5ffy9d499vx";
1313+ };
1414+1515+ postPatch = ''
1616+ substituteInPlace tests/test.t \
1717+ --replace "/bin/bash" "${bash}/bin/bash"
1818+ '';
1919+2020+ # This testing is copied from Makefile. Simply using `make test` doesn't work
2121+ # because it uses the unpatched `scripts/cram` executable which has a bad
2222+ # shebang. Also, for some reason, coverage fails on one file so let's just
2323+ # ignore that one.
2424+ checkPhase = ''
2525+ # scripts/cram tests
2626+ #COVERAGE=${coverage}/bin/coverage $out/bin/cram tests
2727+ #${coverage}/bin/coverage report --fail-under=100
2828+ COVERAGE=coverage $out/bin/cram tests
2929+ coverage report --fail-under=100 --omit="*/_encoding.py"
3030+ '';
3131+3232+ meta = {
3333+ description = "A simple testing framework for command line applications";
3434+ homepage = https://bitheap.org/cram/;
3535+ license = lib.licenses.gpl2Plus;
3636+ maintainers = with lib.maintainers; [ jluttine ];
3737+ };
3838+}