diff --git a/nixos/modules/config/mysql.nix b/nixos/modules/config/mysql.nix
new file mode 100644
index 000000000000..8e7ce2a307e5
--- /dev/null
+++ b/nixos/modules/config/mysql.nix
@@ -0,0 +1,519 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+ cfg = config.users.mysql;
+in
+{
+ options = {
+ users.mysql = {
+ enable = mkEnableOption "Authentication against a MySQL/MariaDB database";
+ host = mkOption {
+ type = types.str;
+ example = "localhost";
+ description = "The hostname of the MySQL/MariaDB server";
+ };
+ database = mkOption {
+ type = types.str;
+ example = "auth";
+ description = "The name of the database containing the users";
+ };
+ user = mkOption {
+ type = types.str;
+ example = "nss-user";
+ description = "The username to use when connecting to the database";
+ };
+ passwordFile = mkOption {
+ type = types.path;
+ example = "/run/secrets/mysql-auth-db-passwd";
+ description = "The path to the file containing the password for the user";
+ };
+ pam = mkOption {
+ description = "Settings for pam_mysql";
+ type = types.submodule {
+ options = {
+ table = mkOption {
+ type = types.str;
+ example = "users";
+ description = "The name of table that maps unique login names to the passwords.";
+ };
+ updateTable = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = "users_updates";
+ description = ''
+ The name of the table used for password alteration. If not defined, the value
+ of the table option will be used instead.
+ '';
+ };
+ userColumn = mkOption {
+ type = types.str;
+ example = "username";
+ description = "The name of the column that contains a unix login name.";
+ };
+ passwordColumn = mkOption {
+ type = types.str;
+ example = "password";
+ description = "The name of the column that contains a (encrypted) password string.";
+ };
+ statusColumn = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = "status";
+ description = ''
+ The name of the column or an SQL expression that indicates the status of
+ the user. The status is expressed by the combination of two bitfields
+ shown below:
+
+
+
+
+ bit 0 (0x01):
+ if flagged, pam_mysql deems the account to be expired and
+ returns PAM_ACCT_EXPIRED. That is, the account is supposed
+ to no longer be available. Note this doesn't mean that pam_mysql
+ rejects further authentication operations.
+
+
+
+
+ bit 1 (0x02):
+ if flagged, pam_mysql deems the authentication token
+ (password) to be expired and returns PAM_NEW_AUTHTOK_REQD.
+ This ends up requiring that the user enter a new password.
+
+
+
+ '';
+ };
+ passwordCrypt = mkOption {
+ example = "2";
+ type = types.enum [
+ "0" "plain"
+ "1" "Y"
+ "2" "mysql"
+ "3" "md5"
+ "4" "sha1"
+ "5" "drupal7"
+ "6" "joomla15"
+ "7" "ssha"
+ "8" "sha512"
+ "9" "sha256"
+ ];
+ description = ''
+ The method to encrypt the user's password:
+
+
+
+
+ 0 (or "plain"):
+ No encryption. Passwords are stored in plaintext. HIGHLY DISCOURAGED.
+
+
+
+
+ 1 (or "Y"):
+ Use crypt(3) function.
+
+
+
+
+ 2 (or "mysql"):
+ Use the MySQL PASSWORD() function. It is possible that the encryption function used
+ by pam_mysql is different from that of the MySQL server, as
+ pam_mysql uses the function defined in MySQL's C-client API
+ instead of using PASSWORD() SQL function in the query.
+
+
+
+
+ 3 (or "md5"):
+ Use plain hex MD5.
+
+
+
+
+ 4 (or "sha1"):
+ Use plain hex SHA1.
+
+
+
+
+ 5 (or "drupal7"):
+ Use Drupal7 salted passwords.
+
+
+
+
+ 6 (or "joomla15"):
+ Use Joomla15 salted passwords.
+
+
+
+
+ 7 (or "ssha"):
+ Use ssha hashed passwords.
+
+
+
+
+ 8 (or "sha512"):
+ Use sha512 hashed passwords.
+
+
+
+
+ 9 (or "sha256"):
+ Use sha256 hashed passwords.
+
+
+
+ '';
+ };
+ cryptDefault = mkOption {
+ type = types.nullOr (types.enum [ "md5" "sha256" "sha512" "blowfish" ]);
+ default = null;
+ example = "blowfish";
+ description = "The default encryption method to use for passwordCrypt = 1.";
+ };
+ where = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = "host.name='web' AND user.active=1";
+ description = "Additional criteria for the query.";
+ };
+ verbose = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ If enabled, produces logs with detailed messages that describes what
+ pam_mysql is doing. May be useful for debugging.
+ '';
+ };
+ disconnectEveryOperation = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ By default, pam_mysql keeps the connection to the MySQL
+ database until the session is closed. If this option is set to true it
+ disconnects every time the PAM operation has finished. This option may
+ be useful in case the session lasts quite long.
+ '';
+ };
+ logging = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = "Enables logging of authentication attempts in the MySQL database.";
+ };
+ table = mkOption {
+ type = types.str;
+ example = "logs";
+ description = "The name of the table to which logs are written.";
+ };
+ msgColumn = mkOption {
+ type = types.str;
+ example = "msg";
+ description = ''
+ The name of the column in the log table to which the description
+ of the performed operation is stored.
+ '';
+ };
+ userColumn = mkOption {
+ type = types.str;
+ example = "user";
+ description = ''
+ The name of the column in the log table to which the name of the
+ user being authenticated is stored.
+ '';
+ };
+ pidColumn = mkOption {
+ type = types.str;
+ example = "pid";
+ description = ''
+ The name of the column in the log table to which the pid of the
+ process utilising the pam_mysql's authentication
+ service is stored.
+ '';
+ };
+ hostColumn = mkOption {
+ type = types.str;
+ example = "host";
+ description = ''
+ The name of the column in the log table to which the name of the user
+ being authenticated is stored.
+ '';
+ };
+ rHostColumn = mkOption {
+ type = types.str;
+ example = "rhost";
+ description = ''
+ The name of the column in the log table to which the name of the remote
+ host that initiates the session is stored. The value is supposed to be
+ set by the PAM-aware application with pam_set_item(PAM_RHOST)
+ .
+ '';
+ };
+ timeColumn = mkOption {
+ type = types.str;
+ example = "timestamp";
+ description = ''
+ The name of the column in the log table to which the timestamp of the
+ log entry is stored.
+ '';
+ };
+ };
+ };
+ };
+ };
+ nss = mkOption {
+ description = ''
+ Settings for libnss-mysql.
+
+ All examples are from the minimal example
+ of libnss-mysql, but they are modified with NixOS paths for bash.
+ '';
+ type = types.submodule {
+ options = {
+ getpwnam = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT username,'x',uid,'5000','MySQL User', CONCAT('/home/',username),'/run/sw/current-system/bin/bash' \
+ FROM users \
+ WHERE username='%1$s' \
+ LIMIT 1
+ '';
+ description = ''
+ SQL query for the getpwnam
+ syscall.
+ '';
+ };
+ getpwuid = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT username,'x',uid,'5000','MySQL User', CONCAT('/home/',username),'/run/sw/current-system/bin/bash' \
+ FROM users \
+ WHERE uid='%1$u' \
+ LIMIT 1
+ '';
+ description = ''
+ SQL query for the getpwuid
+ syscall.
+ '';
+ };
+ getspnam = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT username,password,'1','0','99999','0','0','-1','0' \
+ FROM users \
+ WHERE username='%1$s' \
+ LIMIT 1
+ '';
+ description = ''
+ SQL query for the getspnam
+ syscall.
+ '';
+ };
+ getpwent = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT username,'x',uid,'5000','MySQL User', CONCAT('/home/',username),'/run/sw/current-system/bin/bash' FROM users
+ '';
+ description = ''
+ SQL query for the getpwent
+ syscall.
+ '';
+ };
+ getspent = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT username,password,'1','0','99999','0','0','-1','0' FROM users
+ '';
+ description = ''
+ SQL query for the getspent
+ syscall.
+ '';
+ };
+ getgrnam = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT name,password,gid FROM groups WHERE name='%1$s' LIMIT 1
+ '';
+ description = ''
+ SQL query for the getgrnam
+ syscall.
+ '';
+ };
+ getgrgid = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT name,password,gid FROM groups WHERE gid='%1$u' LIMIT 1
+ '';
+ description = ''
+ SQL query for the getgrgid
+ syscall.
+ '';
+ };
+ getgrent = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT name,password,gid FROM groups
+ '';
+ description = ''
+ SQL query for the getgrent
+ syscall.
+ '';
+ };
+ memsbygid = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT username FROM grouplist WHERE gid='%1$u'
+ '';
+ description = ''
+ SQL query for the memsbygid
+ syscall.
+ '';
+ };
+ gidsbymem = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ example = literalExpression ''
+ SELECT gid FROM grouplist WHERE username='%1$s'
+ '';
+ description = ''
+ SQL query for the gidsbymem
+ syscall.
+ '';
+ };
+ };
+ };
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ system.nssModules = [ pkgs.libnss-mysql ];
+ system.nssDatabases.shadow = [ "mysql" ];
+ system.nssDatabases.group = [ "mysql" ];
+ system.nssDatabases.passwd = [ "mysql" ];
+
+ environment.etc."security/pam_mysql.conf" = {
+ user = "root";
+ group = "root";
+ mode = "0600";
+ # password will be added from password file in activation script
+ text = ''
+ users.host=${cfg.host}
+ users.db_user=${cfg.user}
+ users.database=${cfg.database}
+ users.table=${cfg.pam.table}
+ users.user_column=${cfg.pam.userColumn}
+ users.password_column=${cfg.pam.passwordColumn}
+ users.password_crypt=${cfg.pam.passwordCrypt}
+ users.disconnect_every_operation=${if cfg.pam.disconnectEveryOperation then "1" else "0"}
+ verbose=${if cfg.pam.verbose then "1" else "0"}
+ '' + optionalString (cfg.pam.cryptDefault != null) ''
+ users.use_${cfg.pam.cryptDefault}=1
+ '' + optionalString (cfg.pam.where != null) ''
+ users.where_clause=${cfg.pam.where}
+ '' + optionalString (cfg.pam.statusColumn != null) ''
+ users.status_column=${cfg.pam.statusColumn}
+ '' + optionalString (cfg.pam.updateTable != null) ''
+ users.update_table=${cfg.pam.updateTable}
+ '' + optionalString cfg.pam.logging.enable ''
+ log.enabled=true
+ log.table=${cfg.pam.logging.table}
+ log.message_column=${cfg.pam.logging.msgColumn}
+ log.pid_column=${cfg.pam.logging.pidColumn}
+ log.user_column=${cfg.pam.logging.userColumn}
+ log.host_column=${cfg.pam.logging.hostColumn}
+ log.rhost_column=${cfg.pam.logging.rHostColumn}
+ log.time_column=${cfg.pam.logging.timeColumn}
+ '';
+ };
+
+ environment.etc."libnss-mysql.cfg" = {
+ mode = "0600";
+ user = config.services.nscd.user;
+ group = config.services.nscd.group;
+ text = optionalString (cfg.nss.getpwnam != null) ''
+ getpwnam ${cfg.nss.getpwnam}
+ '' + optionalString (cfg.nss.getpwuid != null) ''
+ getpwuid ${cfg.nss.getpwuid}
+ '' + optionalString (cfg.nss.getspnam != null) ''
+ getspnam ${cfg.nss.getspnam}
+ '' + optionalString (cfg.nss.getpwent != null) ''
+ getpwent ${cfg.nss.getpwent}
+ '' + optionalString (cfg.nss.getspent != null) ''
+ getspent ${cfg.nss.getspent}
+ '' + optionalString (cfg.nss.getgrnam != null) ''
+ getgrnam ${cfg.nss.getgrnam}
+ '' + optionalString (cfg.nss.getgrgid != null) ''
+ getgrgid ${cfg.nss.getgrgid}
+ '' + optionalString (cfg.nss.getgrent != null) ''
+ getgrent ${cfg.nss.getgrent}
+ '' + optionalString (cfg.nss.memsbygid != null) ''
+ memsbygid ${cfg.nss.memsbygid}
+ '' + optionalString (cfg.nss.gidsbymem != null) ''
+ gidsbymem ${cfg.nss.gidsbymem}
+ '' + ''
+ host ${cfg.host}
+ database ${cfg.database}
+ '';
+ };
+
+ environment.etc."libnss-mysql-root.cfg" = {
+ mode = "0600";
+ user = config.services.nscd.user;
+ group = config.services.nscd.group;
+ # password will be added from password file in activation script
+ text = ''
+ username ${cfg.user}
+ '';
+ };
+
+ # Activation script to append the password from the password file
+ # to the configuration files. It also fixes the owner of the
+ # libnss-mysql-root.cfg because it is changed to root after the
+ # password is appended.
+ system.activationScripts.mysql-auth-passwords = ''
+ if [[ -r ${cfg.passwordFile} ]]; then
+ org_umask=$(umask)
+ umask 0077
+
+ conf_nss="$(mktemp)"
+ cp /etc/libnss-mysql-root.cfg $conf_nss
+ printf 'password %s\n' "$(cat ${cfg.passwordFile})" >> $conf_nss
+ mv -fT "$conf_nss" /etc/libnss-mysql-root.cfg
+ chown ${config.services.nscd.user}:${config.services.nscd.group} /etc/libnss-mysql-root.cfg
+
+ conf_pam="$(mktemp)"
+ cp /etc/security/pam_mysql.conf $conf_pam
+ printf 'users.db_passwd=%s\n' "$(cat ${cfg.passwordFile})" >> $conf_pam
+ mv -fT "$conf_pam" /etc/security/pam_mysql.conf
+
+ umask $org_umask
+ fi
+ '';
+ };
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c1f435ec569c..3a849fcfec77 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -22,6 +22,7 @@
./config/ldap.nix
./config/locale.nix
./config/malloc.nix
+ ./config/mysql.nix
./config/networking.nix
./config/no-x-libs.nix
./config/nsswitch.nix
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 9a1acba00d0e..9f89508bd1fe 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -142,6 +142,16 @@ let
'';
};
+ mysqlAuth = mkOption {
+ default = config.users.mysql.enable;
+ defaultText = literalExpression "config.users.mysql.enable";
+ type = types.bool;
+ description = ''
+ If set, the pam_mysql module will be used to
+ authenticate users against a MySQL/MariaDB database.
+ '';
+ };
+
fprintAuth = mkOption {
default = config.services.fprintd.enable;
defaultText = literalExpression "config.services.fprintd.enable";
@@ -441,11 +451,13 @@ let
(
''
# Account management.
- account required pam_unix.so
'' +
optionalString use_ldap ''
account sufficient ${pam_ldap}/lib/security/pam_ldap.so
'' +
+ optionalString cfg.mysqlAuth ''
+ account sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
+ '' +
optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false) ''
account sufficient ${pkgs.sssd}/lib/security/pam_sss.so
'' +
@@ -459,7 +471,11 @@ let
account [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so
account [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so
'' +
+ # The required pam_unix.so module has to come after all the sufficient modules
+ # because otherwise, the account lookup will fail if the user does not exist
+ # locally, for example with MySQL- or LDAP-auth.
''
+ account required pam_unix.so
# Authentication management.
'' +
@@ -475,6 +491,9 @@ let
optionalString cfg.logFailures ''
auth required pam_faillock.so
'' +
+ optionalString cfg.mysqlAuth ''
+ auth sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
+ '' +
optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth) ''
auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles}
'' +
@@ -572,6 +591,9 @@ let
optionalString use_ldap ''
password sufficient ${pam_ldap}/lib/security/pam_ldap.so
'' +
+ optionalString cfg.mysqlAuth ''
+ password sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
+ '' +
optionalString config.services.sssd.enable ''
password sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_authtok
'' +
@@ -615,6 +637,9 @@ let
optionalString use_ldap ''
session optional ${pam_ldap}/lib/security/pam_ldap.so
'' +
+ optionalString cfg.mysqlAuth ''
+ session optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
+ '' +
optionalString config.services.sssd.enable ''
session optional ${pkgs.sssd}/lib/security/pam_sss.so
'' +
@@ -1236,6 +1261,9 @@ in
optionalString (isEnabled (cfg: cfg.oathAuth)) ''
"mr ${pkgs.oath-toolkit}/lib/security/pam_oath.so,
'' +
+ optionalString (isEnabled (cfg: cfg.mysqlAuth)) ''
+ mr ${pkgs.pam_mysql}/lib/security/pam_mysql.so,
+ '' +
optionalString (isEnabled (cfg: cfg.yubicoAuth)) ''
mr ${pkgs.yubico-pam}/lib/security/pam_yubico.so,
'' +
diff --git a/nixos/modules/services/system/nscd.nix b/nixos/modules/services/system/nscd.nix
index c3046a5b4cf4..f3dfd2af3d2f 100644
--- a/nixos/modules/services/system/nscd.nix
+++ b/nixos/modules/services/system/nscd.nix
@@ -27,6 +27,22 @@ in
'';
};
+ user = mkOption {
+ type = types.str;
+ default = "nscd";
+ description = ''
+ User account under which nscd runs.
+ '';
+ };
+
+ group = mkOption {
+ type = types.str;
+ default = "nscd";
+ description = ''
+ User group under which nscd runs.
+ '';
+ };
+
config = mkOption {
type = types.lines;
default = builtins.readFile ./nscd.conf;
@@ -56,12 +72,20 @@ in
config = mkIf cfg.enable {
environment.etc."nscd.conf".text = cfg.config;
+ users.users.${cfg.user} = {
+ isSystemUser = true;
+ group = cfg.group;
+ };
+
+ users.groups.${cfg.group} = {};
+
systemd.services.nscd =
{ description = "Name Service Cache Daemon";
before = [ "nss-lookup.target" "nss-user-lookup.target" ];
wants = [ "nss-lookup.target" "nss-user-lookup.target" ];
wantedBy = [ "multi-user.target" ];
+ requiredBy = [ "nss-lookup.target" "nss-user-lookup.target" ];
environment = { LD_LIBRARY_PATH = nssModulesPath; };
@@ -69,18 +93,29 @@ in
config.environment.etc.hosts.source
config.environment.etc."nsswitch.conf".source
config.environment.etc."nscd.conf".source
+ ] ++ optionals config.users.mysql.enable [
+ config.environment.etc."libnss-mysql.cfg".source
+ config.environment.etc."libnss-mysql-root.cfg".source
];
- # We use DynamicUser because in default configurations nscd doesn't
- # create any files that need to survive restarts. However, in some
- # configurations, nscd needs to be started as root; it will drop
- # privileges after all the NSS modules have read their configuration
- # files. So prefix the ExecStart command with "!" to prevent systemd
- # from dropping privileges early. See ExecStart in systemd.service(5).
+ # In some configurations, nscd needs to be started as root; it will
+ # drop privileges after all the NSS modules have read their
+ # configuration files. So prefix the ExecStart command with "!" to
+ # prevent systemd from dropping privileges early. See ExecStart in
+ # systemd.service(5). We use a static user, because some NSS modules
+ # sill want to read their configuration files after the privilege drop
+ # and so users can set the owner of those files to the nscd user.
serviceConfig =
{ ExecStart = "!@${cfg.package}/bin/nscd nscd";
Type = "forking";
- DynamicUser = true;
+ User = cfg.user;
+ Group = cfg.group;
+ RemoveIPC = true;
+ PrivateTmp = true;
+ NoNewPrivileges = true;
+ RestrictSUIDSGID = true;
+ ProtectSystem = "strict";
+ ProtectHome = "read-only";
RuntimeDirectory = "nscd";
PIDFile = "/run/nscd/nscd.pid";
Restart = "always";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a0af42b0056a..43fb4d2bd238 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -41,6 +41,7 @@ in {
apparmor = handleTest ./apparmor.nix {};
atd = handleTest ./atd.nix {};
atop = handleTest ./atop.nix {};
+ auth-mysql = handleTest ./auth-mysql.nix {};
avahi = handleTest ./avahi.nix {};
avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
babeld = handleTest ./babeld.nix {};
diff --git a/nixos/tests/auth-mysql.nix b/nixos/tests/auth-mysql.nix
new file mode 100644
index 000000000000..0ed4b050a69a
--- /dev/null
+++ b/nixos/tests/auth-mysql.nix
@@ -0,0 +1,177 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+let
+ dbUser = "nixos_auth";
+ dbPassword = "topsecret123";
+ dbName = "auth";
+
+ mysqlUsername = "mysqltest";
+ mysqlPassword = "topsecretmysqluserpassword123";
+ mysqlGroup = "mysqlusers";
+
+ localUsername = "localtest";
+ localPassword = "topsecretlocaluserpassword123";
+
+ mysqlInit = pkgs.writeText "mysqlInit" ''
+ CREATE USER '${dbUser}'@'localhost' IDENTIFIED BY '${dbPassword}';
+ CREATE DATABASE ${dbName};
+ GRANT ALL PRIVILEGES ON ${dbName}.* TO '${dbUser}'@'localhost';
+ FLUSH PRIVILEGES;
+
+ USE ${dbName};
+ CREATE TABLE `groups` (
+ rowid int(11) NOT NULL auto_increment,
+ gid int(11) NOT NULL,
+ name char(255) NOT NULL,
+ PRIMARY KEY (rowid)
+ );
+
+ CREATE TABLE `users` (
+ name varchar(255) NOT NULL,
+ uid int(11) NOT NULL auto_increment,
+ gid int(11) NOT NULL,
+ password varchar(255) NOT NULL,
+ PRIMARY KEY (uid),
+ UNIQUE (name)
+ ) AUTO_INCREMENT=5000;
+
+ INSERT INTO `users` (name, uid, gid, password) VALUES
+ ('${mysqlUsername}', 5000, 5000, SHA2('${mysqlPassword}', 256));
+ INSERT INTO `groups` (name, gid) VALUES ('${mysqlGroup}', 5000);
+ '';
+in
+{
+ name = "auth-mysql";
+ meta.maintainers = with lib.maintainers; [ netali ];
+
+ nodes.machine =
+ { ... }:
+ {
+ services.mysql = {
+ enable = true;
+ package = pkgs.mariadb;
+ settings.mysqld.bind-address = "127.0.0.1";
+ initialScript = mysqlInit;
+ };
+
+ users.users.${localUsername} = {
+ isNormalUser = true;
+ password = localPassword;
+ };
+
+ security.pam.services.login.makeHomeDir = true;
+
+ users.mysql = {
+ enable = true;
+ host = "127.0.0.1";
+ user = dbUser;
+ database = dbName;
+ passwordFile = "${builtins.toFile "dbPassword" dbPassword}";
+ pam = {
+ table = "users";
+ userColumn = "name";
+ passwordColumn = "password";
+ passwordCrypt = "sha256";
+ disconnectEveryOperation = true;
+ };
+ nss = {
+ getpwnam = ''
+ SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
+ FROM users \
+ WHERE name='%1$s' \
+ LIMIT 1
+ '';
+ getpwuid = ''
+ SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
+ FROM users \
+ WHERE id=%1$u \
+ LIMIT 1
+ '';
+ getspnam = ''
+ SELECT name, password, 1, 0, 99999, 7, 0, -1, 0 \
+ FROM users \
+ WHERE name='%1$s' \
+ LIMIT 1
+ '';
+ getpwent = ''
+ SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
+ FROM users
+ '';
+ getspent = ''
+ SELECT name, password, 1, 0, 99999, 7, 0, -1, 0 \
+ FROM users
+ '';
+ getgrnam = ''
+ SELECT name, 'x', gid FROM groups WHERE name='%1$s' LIMIT 1
+ '';
+ getgrgid = ''
+ SELECT name, 'x', gid FROM groups WHERE gid='%1$u' LIMIT 1
+ '';
+ getgrent = ''
+ SELECT name, 'x', gid FROM groups
+ '';
+ memsbygid = ''
+ SELECT name FROM users WHERE gid=%1$u
+ '';
+ gidsbymem = ''
+ SELECT gid FROM users WHERE name='%1$s'
+ '';
+ };
+ };
+ };
+
+ testScript = ''
+ def switch_to_tty(tty_number):
+ machine.fail(f"pgrep -f 'agetty.*tty{tty_number}'")
+ machine.send_key(f"alt-f{tty_number}")
+ machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
+ machine.wait_for_unit(f"getty@tty{tty_number}.service")
+ machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{tty_number}'")
+
+
+ def try_login(tty_number, username, password):
+ machine.wait_until_tty_matches(tty_number, "login: ")
+ machine.send_chars(f"{username}\n")
+ machine.wait_until_tty_matches(tty_number, f"login: {username}")
+ machine.wait_until_succeeds("pgrep login")
+ machine.wait_until_tty_matches(tty_number, "Password: ")
+ machine.send_chars(f"{password}\n")
+
+
+ machine.wait_for_unit("multi-user.target")
+ machine.wait_for_unit("mysql.service")
+ machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+
+ with subtest("Local login"):
+ switch_to_tty("2")
+ try_login("2", "${localUsername}", "${localPassword}")
+
+ machine.wait_until_succeeds("pgrep -u ${localUsername} bash")
+ machine.send_chars("id > local_id.txt\n")
+ machine.wait_for_file("/home/${localUsername}/local_id.txt")
+ machine.succeed("cat /home/${localUsername}/local_id.txt | grep 'uid=1000(${localUsername}) gid=100(users) groups=100(users)'")
+
+ with subtest("Local incorrect login"):
+ switch_to_tty("3")
+ try_login("3", "${localUsername}", "wrongpassword")
+
+ machine.wait_until_tty_matches("3", "Login incorrect")
+ machine.wait_until_tty_matches("3", "login:")
+
+ with subtest("MySQL login"):
+ switch_to_tty("4")
+ try_login("4", "${mysqlUsername}", "${mysqlPassword}")
+
+ machine.wait_until_succeeds("pgrep -u ${mysqlUsername} bash")
+ machine.send_chars("id > mysql_id.txt\n")
+ machine.wait_for_file("/home/${mysqlUsername}/mysql_id.txt")
+ machine.succeed("cat /home/${mysqlUsername}/mysql_id.txt | grep 'uid=5000(${mysqlUsername}) gid=5000(${mysqlGroup}) groups=5000(${mysqlGroup})'")
+
+ with subtest("MySQL incorrect login"):
+ switch_to_tty("5")
+ try_login("5", "${mysqlUsername}", "wrongpassword")
+
+ machine.wait_until_tty_matches("5", "Login incorrect")
+ machine.wait_until_tty_matches("5", "login:")
+ '';
+})
diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index 57ef95c2725f..5c7926e24abf 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -62,16 +62,11 @@ import ./make-test-python.nix (
# Test nss_mymachines without nscd
machine.succeed('LD_LIBRARY_PATH="/run/current-system/sw/lib" getent -s hosts:mymachines hosts ${containerName}');
- # Test failing nss_mymachines via nscd
- # nscd has not enough rights to connect to systemd bus
- # via sd_bus_open_system() in
- # https://github.com/systemd/systemd/blob/main/src/nss-mymachines/nss-mymachines.c#L287
- machine.fail("getent hosts ${containerName}");
+ # Test nss_mymachines via nscd
+ machine.succeed("getent hosts ${containerName}");
# Test systemd-nspawn network configuration
- machine.succeed("systemctl stop nscd");
- machine.succeed('LD_LIBRARY_PATH="/run/current-system/sw/lib" ping -n -c 1 ${containerName}');
- machine.succeed("systemctl start nscd");
+ machine.succeed("ping -n -c 1 ${containerName}");
# Test systemd-nspawn uses a user namespace
machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
diff --git a/pkgs/applications/misc/free42/default.nix b/pkgs/applications/misc/free42/default.nix
index 08af45be5d48..9f1b6f73a1a8 100644
--- a/pkgs/applications/misc/free42/default.nix
+++ b/pkgs/applications/misc/free42/default.nix
@@ -10,13 +10,13 @@
stdenv.mkDerivation rec {
pname = "free42";
- version = "3.0.13";
+ version = "3.0.14";
src = fetchFromGitHub {
owner = "thomasokken";
repo = pname;
rev = "v${version}";
- hash = "sha256-0CFDkGUV9dihshYbjc0JL0axBcW499mt13xxdfO31vg=";
+ hash = "sha256-Jx+MLItr+rIGfzJdQku1pRXaIldfrpG3vfOhjebSIZA=";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/misc/swaynotificationcenter/default.nix b/pkgs/applications/misc/swaynotificationcenter/default.nix
index 42e6dba3da45..087e9c82ffb2 100644
--- a/pkgs/applications/misc/swaynotificationcenter/default.nix
+++ b/pkgs/applications/misc/swaynotificationcenter/default.nix
@@ -1,25 +1,29 @@
{ lib
, stdenv
, fetchFromGitHub
+, testers
+, wrapGAppsHook
+, bash-completion
+, dbus
+, dbus-glib
+, fish
+, gdk-pixbuf
+, glib
+, gobject-introspection
+, gtk-layer-shell
+, gtk3
+, json-glib
+, libhandy
+, librsvg
, meson
, ninja
, pkg-config
, scdoc
, vala
-, gtk3
-, glib
-, gtk-layer-shell
-, dbus
-, dbus-glib
-, json-glib
-, librsvg
-, libhandy
-, gobject-introspection
-, gdk-pixbuf
-, wrapGAppsHook
+, xvfb-run
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: rec {
pname = "SwayNotificationCenter";
version = "0.6.3";
@@ -30,15 +34,54 @@ stdenv.mkDerivation rec {
hash = "sha256-79Kda2Mi2r38f0J12bRm9wbHiZCy9+ojPDxwlFG8EYw=";
};
- nativeBuildInputs = [ gobject-introspection meson ninja pkg-config scdoc vala wrapGAppsHook ];
+ nativeBuildInputs = [
+ bash-completion
+ # cmake # currently conflicts with meson
+ fish
+ glib
+ gobject-introspection
+ meson
+ ninja
+ pkg-config
+ scdoc
+ vala
+ wrapGAppsHook
+ ];
- buildInputs = [ dbus dbus-glib gdk-pixbuf glib gtk-layer-shell gtk3 json-glib libhandy librsvg ];
+ buildInputs = [
+ dbus
+ dbus-glib
+ gdk-pixbuf
+ glib
+ gtk-layer-shell
+ gtk3
+ json-glib
+ libhandy
+ librsvg
+ # systemd # ends with broken permission
+ ];
+
+ # Fix-Me: Broken in 0.6.3, but fixed on master. Enable on next release. Requires python3 in nativeBuildInputs.
+ # postPatch = ''
+ # chmod +x build-aux/meson/postinstall.py
+ # patchShebangs build-aux/meson/postinstall.py
+ # '';
+
+ # Remove past 0.6.3
+ postInstall = ''
+ glib-compile-schemas "$out"/share/glib-2.0/schemas
+ '';
+
+ passthru.tests.version = testers.testVersion {
+ package = finalAttrs.finalPackage;
+ command = "${xvfb-run}/bin/xvfb-run swaync --version";
+ };
meta = with lib; {
description = "Simple notification daemon with a GUI built for Sway";
homepage = "https://github.com/ErikReider/SwayNotificationCenter";
license = licenses.gpl3;
platforms = platforms.linux;
- maintainers = [ maintainers.berbiche ];
+ maintainers = with maintainers; [ berbiche pedrohlc ];
};
-}
+})
diff --git a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0001-qtbase-mkspecs-mac.patch b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
index b50913753614..faf0b643fdba 100644
--- a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
@@ -355,6 +355,37 @@ index e3534561a5..3b01424e67 100644
-xcode_copy_phase_strip_setting.name = COPY_PHASE_STRIP
-xcode_copy_phase_strip_setting.value = NO
-QMAKE_MAC_XCODE_SETTINGS += xcode_copy_phase_strip_setting
+diff --git a/mkspecs/features/mac/sdk.mk b/mkspecs/features/mac/sdk.mk
+--- a/mkspecs/features/mac/sdk.mk
++++ b/mkspecs/features/mac/sdk.mk
+@@ -1,27 +0,0 @@
+-
+-ifeq ($(QT_MAC_SDK_NO_VERSION_CHECK),)
+- CHECK_SDK_COMMAND = /usr/bin/xcrun --sdk $(EXPORT_QMAKE_MAC_SDK) -show-sdk-version 2>/dev/null
+- CURRENT_MAC_SDK_VERSION := $(shell DEVELOPER_DIR=$(EXPORT_QMAKE_XCODE_DEVELOPER_PATH) $(CHECK_SDK_COMMAND))
+- ifneq ($(CURRENT_MAC_SDK_VERSION),$(EXPORT_QMAKE_MAC_SDK_VERSION))
+- # We don't want to complain about out of date SDK unless the target needs to be remade.
+- # This covers use-cases such as running 'make check' after moving the build to a
+- # computer without Xcode or with a different Xcode version.
+- TARGET_UP_TO_DATE := $(shell QT_MAC_SDK_NO_VERSION_CHECK=1 $(MAKE) --question $(QMAKE_TARGET) && echo 1 || echo 0)
+- ifeq ($(TARGET_UP_TO_DATE),0)
+- ifneq ($(findstring missing DEVELOPER_DIR path,$(CURRENT_MAC_SDK_VERSION)),)
+- $(info The developer dir $(EXPORT_QMAKE_XCODE_DEVELOPER_PATH) is no longer valid.)
+- else ifneq ($(findstring SDK "$(EXPORT_QMAKE_MAC_SDK)" cannot be located,$(CURRENT_MAC_SDK_VERSION)),)
+- $(info The developer dir $(EXPORT_QMAKE_XCODE_DEVELOPER_PATH) no longer contains the $(EXPORT_QMAKE_MAC_SDK_VERSION) platform SDK.)
+- else ifneq ($(CURRENT_MAC_SDK_VERSION),)
+- $(info The $(EXPORT_QMAKE_MAC_SDK) platform SDK has been changed from version $(EXPORT_QMAKE_MAC_SDK_VERSION) to version $(CURRENT_MAC_SDK_VERSION).)
+- else
+- $(info Unknown error resolving current platform SDK version.)
+- endif
+- $(info This requires a fresh build of your project. Please wipe the build directory)
+- ifneq ($(EXPORT__QMAKE_STASH_),)
+- $(info including the qmake cache in $(EXPORT__QMAKE_STASH_))
+- endif
+- $(error ^)
+- endif
+- endif
+-endif
diff --git a/mkspecs/features/mac/sdk.prf b/mkspecs/features/mac/sdk.prf
deleted file mode 100644
index 3a9c2778bb..0000000000
diff --git a/pkgs/development/tools/cobra-cli/default.nix b/pkgs/development/tools/cobra-cli/default.nix
new file mode 100644
index 000000000000..989c2f161f6d
--- /dev/null
+++ b/pkgs/development/tools/cobra-cli/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+ pname = "cobra-cli";
+ version = "1.3.0";
+
+ src = fetchFromGitHub {
+ owner = "spf13";
+ repo = pname;
+ rev = "v${version}";
+ sha256 = "sha256-E0I/Pxw4biOv7aGVzGlQOFXnxkc+zZaEoX1JmyMh6UE=";
+ };
+
+ vendorSha256 = "sha256-vrtGPQzY+NImOGaSxV+Dvch+GNPfL9XfY4lfCHTGXwY=";
+
+ meta = with lib; {
+ description = "Cobra CLI tool to generate applications and commands";
+ homepage = "https://github.com/spf13/cobra-cli/";
+ changelog = "https://github.com/spf13/cobra-cli/releases/tag/${version}";
+ license = licenses.afl20;
+ maintainers = [ maintainers.ivankovnatsky ];
+ };
+}
diff --git a/pkgs/development/tools/misc/pkgconf/default.nix b/pkgs/development/tools/misc/pkgconf/default.nix
index 8db8a709bb6e..e479f8a2db9f 100644
--- a/pkgs/development/tools/misc/pkgconf/default.nix
+++ b/pkgs/development/tools/misc/pkgconf/default.nix
@@ -6,11 +6,11 @@
stdenv.mkDerivation rec {
pname = "pkgconf";
- version = "1.8.0";
+ version = "1.9.2";
src = fetchurl {
url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
- hash = "sha256-75x+YYIrfLg1bm6eHcpY2VVvMgDXisqzXkNH6dTCu68=";
+ hash = "sha256-22v1Qm4On8EHBCzIX8YrHzkfHXr0bEo8Obf1tSMd+gk=";
};
outputs = [ "out" "lib" "dev" "man" "doc" ];
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index d753b4822253..2ab48e391873 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -9,13 +9,13 @@
}:
rustPlatform.buildRustPackage rec {
pname = "sentry-cli";
- version = "2.5.0";
+ version = "2.5.1";
src = fetchFromGitHub {
owner = "getsentry";
repo = "sentry-cli";
rev = version;
- sha256 = "sha256-VNYZMeKX3QJNxwWK+gn8LIm/W6l4NAjJtCG6nlO9Clc=";
+ sha256 = "sha256-4X3IzLZRiyQpTwZ/4tl1nBPhSmuZLelEzOxvjCVnaIQ=";
};
doCheck = false;
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
nativeBuildInputs = [ pkg-config ];
- cargoSha256 = "sha256-Nn7GolRtBs2eVBPT75hqXiTNrqNZfcSPdHwXWkb48NA=";
+ cargoSha256 = "sha256-VsJrdQph8GJrQc0DWskvVdjvtsirEQxEIgr3vr62ktY=";
meta = with lib; {
homepage = "https://docs.sentry.io/cli/";
diff --git a/pkgs/misc/lilypond/unstable.nix b/pkgs/misc/lilypond/unstable.nix
new file mode 100644
index 000000000000..dc137ccd7e9e
--- /dev/null
+++ b/pkgs/misc/lilypond/unstable.nix
@@ -0,0 +1,11 @@
+{ lib, fetchurl, guile, lilypond }:
+
+(lilypond.override {
+ inherit guile;
+}).overrideAttrs (oldAttrs: rec {
+ version = "2.23.11";
+ src = fetchurl {
+ url = "https://lilypond.org/download/sources/v${lib.versions.majorMinor version}/lilypond-${version}.tar.gz";
+ sha256 = "sha256-4VjcuZvRmpPmiZ42zyk9xYPlsSN6kEsBSRe30P+raQ8=";
+ };
+})
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 798d89102ee7..267de2fb7474 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -12,42 +12,42 @@
"4.19": {
"patch": {
"extra": "-hardened1",
- "name": "linux-hardened-4.19.254-hardened1.patch",
- "sha256": "0c8mlpykk3j3zmh2fszyc0xnyqdfqf02nna5fq018179pmsglbnk",
- "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.254-hardened1/linux-hardened-4.19.254-hardened1.patch"
+ "name": "linux-hardened-4.19.255-hardened1.patch",
+ "sha256": "1pi0na6gr0l56479dzny8fvb3yzvxvjbvwn7c6kxf0gdhdqjzsc9",
+ "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.255-hardened1/linux-hardened-4.19.255-hardened1.patch"
},
- "sha256": "1rd40wmdaymbly2zvf60mjqsflkd4n1y232qz0ixn1rfl28yz62i",
- "version": "4.19.254"
+ "sha256": "0hwa3g09cmllc2z01s2jqbczpznzdp3ldngx18k5c2ac7w394fbp",
+ "version": "4.19.255"
},
"5.10": {
"patch": {
"extra": "-hardened1",
- "name": "linux-hardened-5.10.134-hardened1.patch",
- "sha256": "0d6ygrsssbww9aqy55q1zxq2b1y9lwnz0j8xfqpya3c3hll1951a",
- "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.134-hardened1/linux-hardened-5.10.134-hardened1.patch"
+ "name": "linux-hardened-5.10.136-hardened1.patch",
+ "sha256": "1mw30dy0xk2l12gds0kf7mjxbfamjxdwshkwc4kcics9rf57mgx6",
+ "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.136-hardened1/linux-hardened-5.10.136-hardened1.patch"
},
- "sha256": "0s9j4zzck9880kvyb18i2ng6dc16p0dwsi95mkwdhg83vyn16dgc",
- "version": "5.10.134"
+ "sha256": "0naiwihlj6aswnqwdz3xzmga98xpj5lf2iy9vxqzdng7b46rs28w",
+ "version": "5.10.136"
},
"5.15": {
"patch": {
"extra": "-hardened1",
- "name": "linux-hardened-5.15.58-hardened1.patch",
- "sha256": "1c2friimfzi5i0x76z66wdgkfafly1rhpy8zzs7li3s79d22138k",
- "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.58-hardened1/linux-hardened-5.15.58-hardened1.patch"
+ "name": "linux-hardened-5.15.60-hardened1.patch",
+ "sha256": "1w93qgwycicwjp3aiklm6c6yvg0gq674pxcxvbsdd0c1p0b4y8dk",
+ "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.60-hardened1/linux-hardened-5.15.60-hardened1.patch"
},
- "sha256": "1a2gzjfymfafvk8cvibr1zdfydzxg0c5j772c9hqwcabkibxjnyp",
- "version": "5.15.58"
+ "sha256": "0yi3bvqz4qn8nvgr910ic09zvpisafwi282j0y2gvbvgr7vlb59d",
+ "version": "5.15.60"
},
"5.18": {
"patch": {
"extra": "-hardened1",
- "name": "linux-hardened-5.18.15-hardened1.patch",
- "sha256": "0ir6k4d9mx4skyhxjin2hn237kl3qh6cl0kmjqkqyxkm83k12kln",
- "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.15-hardened1/linux-hardened-5.18.15-hardened1.patch"
+ "name": "linux-hardened-5.18.17-hardened1.patch",
+ "sha256": "0vic9y72d3vfw66y32yrgh7q2wgjk902780ik2viylwr3f5xq1yq",
+ "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.17-hardened1/linux-hardened-5.18.17-hardened1.patch"
},
- "sha256": "0g5yvhq7rmkzvfl4w50l7bg56a20insvg4s4nvgnk2iqvkmlz039",
- "version": "5.18.15"
+ "sha256": "0i7yms65b8kxjm92ahic0787vb9h7xblbwp1v6cq8zpns3ivv0ih",
+ "version": "5.18.17"
},
"5.4": {
"patch": {
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index afa8423d578b..0981efb66a77 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
- version = "4.19.254";
+ version = "4.19.255";
# modDirVersion needs to be x.y.z, will automatically add .0 if needed
modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
- sha256 = "1rd40wmdaymbly2zvf60mjqsflkd4n1y232qz0ixn1rfl28yz62i";
+ sha256 = "0hwa3g09cmllc2z01s2jqbczpznzdp3ldngx18k5c2ac7w394fbp";
};
} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index a7184b37f435..a9fde05e0ca5 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
- version = "5.10.135";
+ version = "5.10.136";
# modDirVersion needs to be x.y.z, will automatically add .0 if needed
modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
- sha256 = "0i1kahv739qpyyml7d7sx306nv7gp55i5d97vlb0fryfx4dsd6g4";
+ sha256 = "0naiwihlj6aswnqwdz3xzmga98xpj5lf2iy9vxqzdng7b46rs28w";
};
} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index e6e3ca260ee2..636ec481748b 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
- version = "5.15.59";
+ version = "5.15.60";
# modDirVersion needs to be x.y.z, will automatically add .0 if needed
modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
- sha256 = "1jxw6fnc7yaw7r6193wy6l8wdlpy3frw48drnc3dnh3k0m1cdpg6";
+ sha256 = "0yi3bvqz4qn8nvgr910ic09zvpisafwi282j0y2gvbvgr7vlb59d";
};
} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.18.nix b/pkgs/os-specific/linux/kernel/linux-5.18.nix
index edfdb859503f..ebba401dd671 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.18.nix
@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
- version = "5.18.16";
+ version = "5.18.17";
# modDirVersion needs to be x.y.z, will automatically add .0 if needed
modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
- sha256 = "1khi1npn8d8jimwdy8bf3r7l780mxdmvk5azdv419pk33qjqdxgi";
+ sha256 = "0i7yms65b8kxjm92ahic0787vb9h7xblbwp1v6cq8zpns3ivv0ih";
};
} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.19.nix b/pkgs/os-specific/linux/kernel/linux-5.19.nix
index 5c622c24a576..79d106150b4b 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.19.nix
@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
- version = "5.19";
+ version = "5.19.1";
# modDirVersion needs to be x.y.z, will automatically add .0 if needed
modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
- sha256 = "1a05a3hw4w3k530mxhns96xw7hag743xw5w967yazqcykdbhq97z";
+ sha256 = "0mgak94i4z9s1kdyw211ks4si4ngaii71xdiin06pim2ds97pqpl";
};
} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index e727097c028d..3018d83840e3 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
- version = "5.4.209";
+ version = "5.4.210";
# modDirVersion needs to be x.y.z, will automatically add .0 if needed
modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
- sha256 = "1kdnz99k7zspzaxqaxahbf6hncigy4cvjlb79jsy7a95qxxr31qf";
+ sha256 = "13l8zh5balciqhi4k4328sznza30v8g871wxcqqka61cij3rc0wl";
};
} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 7ee37c5b261a..898bd1d18ad1 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
, ... } @ args:
let
- version = "5.4.193-rt74"; # updated by ./update-rt.sh
+ version = "5.4.209-rt77"; # updated by ./update-rt.sh
branch = lib.versions.majorMinor version;
kversion = builtins.elemAt (lib.splitString "-" version) 0;
in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
- sha256 = "187jfk9hf52n5z9yv56vq1knp3kdcbyk5w5k98ziwcbdjm1x65hd";
+ sha256 = "1kdnz99k7zspzaxqaxahbf6hncigy4cvjlb79jsy7a95qxxr31qf";
};
kernelPatches = let rt-patch = {
name = "rt";
patch = fetchurl {
url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
- sha256 = "1gn4ii5pr0870ba481nqbd5rxk7ajrarv1p5mipfi42x07rpn7c2";
+ sha256 = "1wh5m7ychgnn33yg7gg9nlwcmmm72dixvdf77m764hs90xl8c9ig";
};
}; in [ rt-patch ] ++ kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 0ed4c48047ad..a4304e9e9369 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
- version = "5.19-rc5";
+ version = "6.0-rc1";
extraMeta.branch = lib.versions.majorMinor version;
# modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
src = fetchurl {
url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
- sha256 = "sha256-eqBbQBZaqexgx6m3jAoU/0HWAdHbAuT3slZWMZhrht0=";
+ sha256 = "sha256-RReHoEYavib86K9XQKwguBYQvyQboRl7537p69P8ca0=";
};
# Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index cca6a8d1cfad..53b00b93358a 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -1,14 +1,15 @@
{ lib, stdenv, fetchFromGitHub, buildLinux, ... } @ args:
let
+ # These names are how they are designated in https://xanmod.org.
ltsVariant = {
- version = "5.15.54";
- hash = "sha256-0Odo+ZrQok3MMPl/512F8kIQ31mGZH6e9FyVVpXrYf0=";
+ version = "5.15.60";
+ hash = "sha256-XSOYgrJ/uvPpEG+P3Zy1geFeF/HMZ4LejsKWtTxMUTs=";
};
edgeVariant = {
- version = "5.18.11";
- hash = "sha256-UPLwaEWhBu1yriCUJu9L/B8yy+1zxnTQzHaKlT507UY=";
+ version = "5.19.1";
+ hash = "sha256-Fw+XW2YDAGKEzZ4AO88Y8GcypfOb6AjKp3XOlkT8ZTQ=";
};
ttVariant = {
diff --git a/pkgs/os-specific/linux/libnss-mysql/default.nix b/pkgs/os-specific/linux/libnss-mysql/default.nix
new file mode 100644
index 000000000000..77e629b03074
--- /dev/null
+++ b/pkgs/os-specific/linux/libnss-mysql/default.nix
@@ -0,0 +1,30 @@
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, which, libmysqlclient }:
+
+stdenv.mkDerivation rec {
+ pname = "libnss-mysql";
+ version = "1.7.1";
+
+ src = fetchFromGitHub {
+ owner = "saknopper";
+ repo = "libnss-mysql";
+ rev = "v${version}";
+ sha256 = "1fhsswa3h2nkhjkyjxxqnj07rlx6bmfvd8j521snimx2jba8h0d6";
+ };
+
+ nativeBuildInputs = [ autoreconfHook which ];
+ buildInputs = [ libmysqlclient ];
+
+ configureFlags = [ "--sysconfdir=/etc" ];
+ installFlags = [ "sysconfdir=$(out)/etc" ];
+ postInstall = ''
+ rm -r $out/etc
+ '';
+
+ meta = with lib; {
+ description = "MySQL module for the Solaris Nameservice Switch (NSS)";
+ homepage = "https://github.com/saknopper/libnss-mysql";
+ license = licenses.gpl2Plus;
+ platforms = platforms.linux;
+ maintainers = with maintainers; [ netali ];
+ };
+}
diff --git a/pkgs/os-specific/linux/pam_mysql/default.nix b/pkgs/os-specific/linux/pam_mysql/default.nix
new file mode 100644
index 000000000000..807899cf2b28
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_mysql/default.nix
@@ -0,0 +1,24 @@
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pam, pkg-config, libmysqlclient, mariadb }:
+
+stdenv.mkDerivation rec {
+ pname = "pam_mysql";
+ version = "1.0.0-beta2";
+
+ src = fetchFromGitHub {
+ owner = "NigelCunningham";
+ repo = "pam-MySQL";
+ rev = version;
+ sha256 = "07acf0hbhkd0kg49gnj4nb5ilnv3v4xx3dsggvzvjg8gi3cjmsap";
+ };
+
+ nativeBuildInputs = [ meson pkg-config ninja ];
+ buildInputs = [ pam libmysqlclient mariadb ];
+
+ meta = with lib; {
+ description = "PAM authentication module against a MySQL database";
+ homepage = "https://github.com/NigelCunningham/pam-MySQL";
+ license = licenses.gpl2Plus;
+ platforms = platforms.linux;
+ maintainers = with maintainers; [ netali ];
+ };
+}
diff --git a/pkgs/servers/irc/solanum/default.nix b/pkgs/servers/irc/solanum/default.nix
index 9dc7a8abe2c8..df1218ba7920 100644
--- a/pkgs/servers/irc/solanum/default.nix
+++ b/pkgs/servers/irc/solanum/default.nix
@@ -12,13 +12,13 @@
stdenv.mkDerivation rec {
pname = "solanum";
- version = "unstable-2021-11-14";
+ version = "unstable-2022-07-12";
src = fetchFromGitHub {
owner = "solanum-ircd";
repo = pname;
- rev = "bd38559fedcdfded4d9acbcbf988e4a8f5057eeb";
- sha256 = "sha256-2P+mqf5b+TD9+9dLahXOdH7ZZhPWUoR1eV73YHbRbAA=";
+ rev = "860187d02895fc953de3475da07a7a06b9380254";
+ hash = "sha256-g8hXmxTfcPDmQ/cu4AI/iJfrhPLaQJEAeMdDhNDsVXs=";
};
patches = [
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index bac3bca4cc6b..1a30548f3cc4 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -1,6 +1,7 @@
{ lib
, python3
, openssl
+, fetchpatch
# Many Salt modules require various Python modules to be installed,
# passing them in this array enables Salt to find them.
, extraInputs ? []
@@ -29,6 +30,10 @@ python3.pkgs.buildPythonApplication rec {
patches = [
./fix-libcrypto-loading.patch
+ (fetchpatch {
+ url = "https://github.com/saltstack/salt/commit/6ec8b90e402ff3fa8f27c7da70ece898592416bc.patch";
+ hash = "sha256-OQCJeG12cp2EZ0BErp6yqsqhv023923rVFDHAFUfF6c=";
+ })
];
postPatch = ''
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
index efcb1241b611..aa08aa7759d8 100644
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -6,16 +6,16 @@
rustPlatform.buildRustPackage rec {
pname = "httm";
- version = "0.14.8";
+ version = "0.14.9";
src = fetchFromGitHub {
owner = "kimono-koans";
repo = pname;
rev = version;
- sha256 = "sha256-PakfSEQCp4LG7mInJvPKFnpRqI7HVr5BxEOM2TronXQ=";
+ sha256 = "sha256-nRvXAHvIAUmtP1Xny9RWNZsCLI2eiE7163h6qxS2v1I=";
};
- cargoSha256 = "sha256-hCoStHD+RG700IBXMV4I007mzFvaKk/bVpnte3cigYk=";
+ cargoSha256 = "sha256-gF9pPOhWT+aaZdk7qyyDIPvJ76s6pkjaeyOLYYrHxo4=";
nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/tools/filesystems/xfsprogs/default.nix b/pkgs/tools/filesystems/xfsprogs/default.nix
index d24e418a0865..b18057fed489 100644
--- a/pkgs/tools/filesystems/xfsprogs/default.nix
+++ b/pkgs/tools/filesystems/xfsprogs/default.nix
@@ -4,11 +4,11 @@
stdenv.mkDerivation rec {
pname = "xfsprogs";
- version = "5.18.0";
+ version = "5.19.0";
src = fetchurl {
url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
- hash = "sha256-Ho2IAb3sjNTK02DOO70Sw1qX8ryPfIyVgNGQOw6Mw1s=";
+ hash = "sha256-S2xsmMA2o39tkMgst/6UBdO1hW2TRWYgMtAf9LFAWSw=";
};
outputs = [ "bin" "dev" "out" "doc" ];
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index 60620c9ba225..f57bb291a99c 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
buildGoModule rec {
pname = "nfpm";
- version = "2.17.0";
+ version = "2.18.0";
src = fetchFromGitHub {
owner = "goreleaser";
repo = pname;
rev = "v${version}";
- sha256 = "sha256-+X68HW5pfJtMWmUoOgI1yHn5rfOVMKQaGL0/MQtMDQM=";
+ sha256 = "sha256-hRsqu7r6n89KGHybe2D54OtQWq+hBj05xYgi/KPEA7o=";
};
- vendorSha256 = "sha256-KR1DgF41fjrCX4bn82kZ49xImQQitIyMSjlBPuNkF8c=";
+ vendorSha256 = "sha256-6RB27jFK6HI6CR8D9vAPshsRi3ldoQwTTH6S1gyDqxs=";
ldflags = [ "-s" "-w" "-X main.version=${version}" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index a270cfe72c43..bd27f1db3182 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -760,7 +760,6 @@ mapAliases ({
lightdm_gtk_greeter = lightdm-gtk-greeter; # Added 2022-08-01
lighthouse = throw "lighthouse has been removed: abandoned by upstream"; # Added 2022-04-24
lighttable = throw "'lighttable' crashes (SIGSEGV) on startup, has not been updated in years and depends on deprecated GTK2"; # Added 2022-06-15
- lilypond-unstable = lilypond; # Added 2021-03-11
lilyterm = throw "lilyterm has been removed from nixpkgs, because it was relying on a vte version that depended on python2"; # Added 2022-01-14
lilyterm-git = throw "lilyterm-git has been removed from nixpkgs, because it was relying on a vte version that depended on python2"; # Added 2022-01-14
links = throw "'links' has been renamed to/replaced by 'links2'"; # Converted to throw 2022-02-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c3c84b03c8d6..e5bd4a0c4b7d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4144,6 +4144,8 @@ with pkgs;
libndtypes = callPackage ../development/libraries/libndtypes { };
+ libnss-mysql = callPackage ../os-specific/linux/libnss-mysql { };
+
libxnd = callPackage ../development/libraries/libxnd { };
lifeograph = callPackage ../applications/editors/lifeograph { };
@@ -15813,6 +15815,8 @@ with pkgs;
cmake-format = python3Packages.callPackage ../development/tools/cmake-format { };
+ cobra-cli = callPackage ../development/tools/cobra-cli { };
+
cmake-language-server = python3Packages.callPackage ../development/tools/misc/cmake-language-server {
inherit cmake cmake-format;
};
@@ -20901,9 +20905,8 @@ with pkgs;
qt5 = qt515;
});
- # TODO bump to 5.15 on darwin once it's not broken; see #125548
- qt5 = if stdenv.hostPlatform.isDarwin then qt514 else qt515;
- libsForQt5 = if stdenv.hostPlatform.isDarwin then libsForQt514 else libsForQt515;
+ qt5 = qt515;
+ libsForQt5 = libsForQt515;
# plasma5Packages maps to the Qt5 packages set that is used to build the plasma5 desktop
plasma5Packages = libsForQt515;
@@ -24378,6 +24381,8 @@ with pkgs;
pam_mount = callPackage ../os-specific/linux/pam_mount { };
+ pam_mysql = callPackage ../os-specific/linux/pam_mysql { };
+
pam_p11 = callPackage ../os-specific/linux/pam_p11 { };
pam_pgsql = callPackage ../os-specific/linux/pam_pgsql { };
@@ -35166,6 +35171,15 @@ with pkgs;
lilypond = callPackage ../misc/lilypond { guile = guile_1_8; };
+ lilypond-unstable = callPackage ../misc/lilypond/unstable.nix { };
+
+ lilypond-unstable-with-fonts = callPackage ../misc/lilypond/with-fonts.nix {
+ lilypond = lilypond-unstable;
+ openlilylib-fonts = openlilylib-fonts.override {
+ lilypond = lilypond-unstable;
+ };
+ };
+
lilypond-with-fonts = callPackage ../misc/lilypond/with-fonts.nix { };
openlilylib-fonts = callPackage ../misc/lilypond/fonts.nix { };