diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json index 2cad40493dc5..88cb8f37f146 100644 --- a/nixos/doc/manual/redirects.json +++ b/nixos/doc/manual/redirects.json @@ -1466,6 +1466,24 @@ "module-services-mailman-other-mtas": [ "index.html#module-services-mailman-other-mtas" ], + "test-opt-requiredFeatures": [ + "index.html#test-opt-requiredFeatures" + ], + "test-opt-requiredFeatures.apple-virt": [ + "index.html#test-opt-requiredFeatures.apple-virt" + ], + "test-opt-requiredFeatures.devnet": [ + "index.html#test-opt-requiredFeatures.devnet" + ], + "test-opt-requiredFeatures.kvm": [ + "index.html#test-opt-requiredFeatures.kvm" + ], + "test-opt-requiredFeatures.nixos-test": [ + "index.html#test-opt-requiredFeatures.nixos-test" + ], + "test-opt-requiredFeatures.uid-range": [ + "index.html#test-opt-requiredFeatures.uid-range" + ], "trezor": [ "index.html#trezor" ], diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index f883372fd450..edc589c2193e 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -42,6 +42,15 @@ - The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available. +- The default D-Bus implementation has been switched from `dbus` to `dbus-broker`. dbus-broker provides + higher performance and reliability while maintaining compatibility with the D-Bus reference implementation. + + Note that changing `services.dbus.implementation` is a **switch inhibitor**: switching between + implementations requires a reboot rather than just `nixos-rebuild switch`, because restarting D-Bus + mid-session is unsafe. + + Users who wish to keep the classic daemon can set: `services.dbus.implementation = "dbus";` + ## New Modules {#sec-release-26.05-new-modules} diff --git a/nixos/lib/testing/run.nix b/nixos/lib/testing/run.nix index fcdd81412123..71d4e46f6d4f 100644 --- a/nixos/lib/testing/run.nix +++ b/nixos/lib/testing/run.nix @@ -3,6 +3,7 @@ hostPkgs, lib, containers, + nodes, options, ... }: @@ -28,9 +29,62 @@ let */ f: lib.mkOverride (opt.highestPrio - 1) (f opt.value); + + requiredFeaturesModuleType = { + freeformType = types.attrsOf types.bool; + options = { + devnet = mkOption { + type = types.bool; + default = + builtins.length (lib.attrNames containers) > 0 && builtins.length (lib.attrNames nodes) > 0; + defaultText = lib.literalMD "`true` if both VMs and containers are present."; + description = '' + This heuristic setting that assumes that the majority of tests requires VMs and containers + to communicate over network. To support such tests, adding "/dev/net" to `nix.settings.extra-sandbox-paths` is necessary. + + Override this to `false` if the heuristic is wrong in some cases. + ''; + }; + nixos-test = mkOption { + type = types.bool; + default = true; + description = "Standard requirement for NixOS integration tests"; + }; + uid-range = mkOption { + type = types.bool; + default = builtins.length (lib.attrNames containers) > 0; + defaultText = lib.literalMD "`true` if containers are present."; + description = "Containers use systemd-nspawn, which requires pid 0 inside of the sandbox. `uid-range` enables that."; + }; + kvm = mkOption { + type = types.bool; + default = isLinux; + defaultText = lib.literalMD "`true` if built to run on Linux."; + description = "Whether Linux KVM virtualization is required when running this test. Can be disabled to allow emulated execution."; + }; + apple-virt = mkOption { + type = types.bool; + default = isDarwin; + defaultText = lib.literalMD "`true` if built to run on Darwin."; + description = "Whether Apple virtualization functionality is required for running this test."; + }; + }; + }; in { options = { + requiredFeatures = mkOption { + description = "Builder features that are required for running this test."; + example = lib.literalExpression '' + { + cuda = true; + devnet = mkForce false; + } + ''; + type = types.submodule requiredFeaturesModuleType; + default = { }; # this is necessary due to a bug in the module system. + }; + passthru = mkOption { type = types.lazyAttrsOf types.raw; description = '' @@ -98,13 +152,7 @@ in { name = "vm-test-run-${config.name}"; - requiredSystemFeatures = [ - "nixos-test" - ] - # Containers use systemd-nspawn, which requires pid 0 inside of the sandbox. - ++ lib.optional (builtins.length (lib.attrNames containers) > 0) "uid-range" - ++ lib.optional isLinux "kvm" - ++ lib.optional isDarwin "apple-virt"; + requiredSystemFeatures = lib.attrNames (lib.filterAttrs (_: v: v) config.requiredFeatures); nativeBuildInputs = lib.optionals config.enableDebugHook [ hostPkgs.openssh diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix index a45fe8d88d56..6b6e8e879012 100644 --- a/nixos/modules/config/sysctl.nix +++ b/nixos/modules/config/sysctl.nix @@ -1,4 +1,9 @@ -{ config, lib, ... }: +{ + config, + lib, + pkgs, + ... +}: let sysctlOption = lib.mkOptionType { @@ -87,6 +92,28 @@ in # the value below is used by default on several other distros. "fs.inotify.max_user_instances" = lib.mkDefault 524288; "fs.inotify.max_user_watches" = lib.mkDefault 524288; + + # Maximise address space randomisation. + "vm.mmap_rnd_bits" = lib.mkMerge [ + (lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 ( + let + kernel = config.boot.kernelPackages.kernel; + isYes = kernel.config.isYes or (_: false); + in + lib.mkDefault ( + if isYes "ARM64_64K_PAGES" then + 29 + else if isYes "ARM64_16K_PAGES" then + 31 + else + 33 + ) + )) + (lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32)) + ]; + "vm.mmap_rnd_compat_bits" = lib.mkIf ( + pkgs.stdenv.hostPlatform.isx86_64 || pkgs.stdenv.hostPlatform.isAarch64 + ) (lib.mkDefault 16); }; }; } diff --git a/nixos/modules/services/system/dbus.nix b/nixos/modules/services/system/dbus.nix index 8cb03b08c2f6..3e4b4ecd1530 100644 --- a/nixos/modules/services/system/dbus.nix +++ b/nixos/modules/services/system/dbus.nix @@ -68,7 +68,7 @@ in "dbus" "broker" ]; - default = "dbus"; + default = "broker"; description = '' The implementation to use for the message bus defined by the D-Bus specification. Can be either the classic dbus daemon or dbus-broker, which aims to provide high diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix index 471069fe1b54..cab90cffbd0d 100644 --- a/pkgs/by-name/ty/ty/package.nix +++ b/pkgs/by-name/ty/ty/package.nix @@ -14,14 +14,14 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ty"; - version = "0.0.31"; + version = "0.0.32"; src = fetchFromGitHub { owner = "astral-sh"; repo = "ty"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-TJGEI22hp+YZCxIvZgNc8BF2Dd+z/TzpnRW2pO1f3X0="; + hash = "sha256-534/xT6JfbgEboH1q4R4JTl2/gLKKs1wU9eqoZf0Asw="; }; # For Darwin platforms, remove the integration test for file notifications, @@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoBuildFlags = [ "--package=ty" ]; - cargoHash = "sha256-JTE/zRf+VqBoLaoMaQ4ioVsr3Njm3OGkpMMnsPg3lsA="; + cargoHash = "sha256-uQkrvSmvQXJj+WlGLI+2fHNQeCd1eYJrJJ1z3OZSHbA="; nativeBuildInputs = [ installShellFiles ]; diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix index 677b884d1c6d..4155f345bc7e 100644 --- a/pkgs/os-specific/linux/busybox/default.nix +++ b/pkgs/os-specific/linux/busybox/default.nix @@ -167,6 +167,7 @@ stdenv.mkDerivation rec { 1 a busybox() { '$out'/bin/busybox "$@"; }\ logger() { '$out'/bin/logger "$@"; }\ ' ${debianDispatcherScript} > ${outDispatchPath} + sed -i 's|/sbin/resolvconf|"$(busybox which resolvconf)"|g' ${outDispatchPath} chmod 555 ${outDispatchPath} HOST_PATH=$out/bin patchShebangs --host ${outDispatchPath} '';