gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux-pam: 1.6.1 -> 1.7.1 (#418255)

Browse Source
This commit is contained in:
K900
2025-08-10 12:36:36 +03:00
committed by GitHub
parent 801b363af8 868e7c10b9
commit 48a82c852f
4 changed files with 111 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/by-name/kb/kbd/package.nix
+8 -3
View File
@@ -15,6 +15,7 @@
xz,
zstd,
gitUpdater,
withVlock ? true,
}:
stdenv.mkDerivation rec {
@@ -30,16 +31,19 @@ stdenv.mkDerivation rec {
# reduces closure size for most use cases.
outputs = [
"out"
"vlock"
"dev"
"scripts"
"man"
]
++ lib.optionals withVlock [
"vlock"
];
configureFlags = [
"--enable-optional-progs"
"--enable-libkeymap"
"--disable-nls"
(lib.enableFeature withVlock "vlock")
]
++ lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
"ac_cv_func_malloc_0_nonnull=yes"
@@ -89,9 +93,10 @@ stdenv.mkDerivation rec {
buildInputs = [
check
pam
bash
];
]
++ lib.optionals withVlock [ pam ];
NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isStatic "-laudit";
nativeBuildInputs = [
autoreconfHook
pkgs/by-name/li/linux-pam/package.nix
+72 -57
View File
@@ -2,98 +2,113 @@
lib,
stdenv,
buildPackages,
fetchurl,
fetchpatch,
fetchFromGitHub,
flex,
db4,
gettext,
ninja,
audit,
libxcrypt,
nixosTests,
autoreconfHook269,
pkg-config-unwrapped,
meson,
pkg-config,
systemdLibs,
docbook5,
libxslt,
libxml2,
w3m-batch,
findXMLCatalogs,
docbook_xsl_ns,
nix-update-script,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "linux-pam";
version = "1.6.1";
version = "1.7.1";
src = fetchurl {
url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
hash = "sha256-+JI8dAFZBS1xnb/CovgZQtaN00/K9hxwagLJuA/u744=";
src = fetchFromGitHub {
owner = "linux-pam";
repo = "linux-pam";
tag = "v${finalAttrs.version}";
hash = "sha256-kANcwxifQz2tYPSrSBSFiYNTm51Gr10L/zroCqm8ZHQ=";
};
patches = [
./suid-wrapper-path.patch
# required for fixing CVE-2025-6020
(fetchpatch {
url = "https://github.com/linux-pam/linux-pam/commit/10b80543807e3fc5af5f8bcfd8bb6e219bb3cecc.patch";
hash = "sha256-VS3D3wUbDxDXRriIuEvvgeZixzDA58EfiLygfFeisGg=";
})
# Manually cherry-picked from 475bd60c552b98c7eddb3270b0b4196847c0072e
./CVE-2025-6020.patch
];
# Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
postPatch =
lib.optionalString (stdenv.buildPlatform.isDarwin && stdenv.buildPlatform != stdenv.hostPlatform)
''
rm CHANGELOG
touch ChangeLog
'';
# patching unix_chkpwd is required as the nix store entry does not have the necessary bits
postPatch = ''
substituteInPlace modules/module-meson.build \
--replace-fail "sbindir / 'unix_chkpwd'" "'/run/wrappers/bin/unix_chkpwd'"
'';
outputs = [
"out"
"doc"
"man" # "modules"
"man"
# "modules"
];
depsBuildBuild = [ buildPackages.stdenv.cc ];
# autoreconfHook269 is needed for `suid-wrapper-path.patch` above.
# pkg-config-unwrapped is needed for `AC_CHECK_LIB` and `AC_SEARCH_LIBS`
nativeBuildInputs = [
flex
autoreconfHook269
pkg-config-unwrapped
]
++ lib.optional stdenv.buildPlatform.isDarwin gettext;
meson
ninja
pkg-config
gettext
libxslt
libxml2
w3m-batch
findXMLCatalogs
docbook_xsl_ns
docbook5
];
buildInputs = [
db4
libxcrypt
]
++ lib.optional stdenv.buildPlatform.isLinux audit;
++ lib.optionals stdenv.buildPlatform.isLinux [
audit
systemdLibs
];
enableParallelBuilding = true;
configureFlags = [
"--includedir=${placeholder "out"}/include/security"
"--enable-sconfigdir=/etc/security"
# The module is deprecated. We re-enable it explicitly until NixOS
# module stops using it.
"--enable-lastlog"
];
installFlags = [
"SCONFIGDIR=${placeholder "out"}/etc/security"
mesonAutoFeatures = "auto";
mesonFlags = [
(lib.mesonEnable "logind" stdenv.buildPlatform.isLinux)
(lib.mesonEnable "audit" stdenv.buildPlatform.isLinux)
(lib.mesonEnable "pam_lastlog" (!stdenv.hostPlatform.isMusl)) # TODO: switch to pam_lastlog2, pam_lastlog is deprecated and broken on musl
(lib.mesonEnable "pam_unix" true)
# (lib.mesonBool "pam-debug" true) # warning: slower execution due to debug makes VM tests fail!
(lib.mesonOption "sysconfdir" "etc") # relative to meson prefix, which is $out
(lib.mesonEnable "elogind" false)
(lib.mesonEnable "econf" false)
(lib.mesonEnable "selinux" false)
(lib.mesonEnable "nis" false)
(lib.mesonBool "xtests" false)
(lib.mesonBool "examples" false)
];
doCheck = false; # fails
passthru.tests = {
inherit (nixosTests)
pam-oath-login
pam-u2f
pam-lastlog
shadow
sssd-ldap
;
passthru = {
tests = {
inherit (nixosTests)
pam-oath-login
pam-u2f
pam-lastlog
shadow
sssd-ldap
;
};
updateScript = nix-update-script { };
};
meta = with lib; {
meta = {
changelog = "https://github.com/linux-pam/linux-pam/releases/tag/${finalAttrs.src.tag}";
homepage = "https://github.com/linux-pam/linux-pam";
description = "Pluggable Authentication Modules, a flexible mechanism for authenticating user";
platforms = platforms.linux;
license = licenses.bsd3;
platforms = lib.platforms.linux;
license = lib.licenses.bsd3;
};
}
})
pkgs/by-name/li/linux-pam/suid-wrapper-path.patch
-6
View File
@@ -1,6 +0,0 @@
It needs the SUID version during runtime, and that can't be in /nix/store/**
--- a/modules/pam_unix/Makefile.am
+++ b/modules/pam_unix/Makefile.am
@@ -21 +21 @@
- -DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \
+ -DCHKPWD_HELPER=\"/run/wrappers/bin/unix_chkpwd\" \
pkgs/os-specific/linux/systemd/default.nix
+31 -10
View File
@@ -138,6 +138,7 @@
withLogind ? true,
withMachined ? true,
withNetworkd ? true,
withNspawn ? !buildLibsOnly,
withNss ? !stdenv.hostPlatform.isMusl,
withOomd ? true,
withOpenSSL ? true,
@@ -203,6 +204,8 @@ let
# $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
# jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
releaseTimestamp = "1734643670";
kbd' = if withPam then kbd else kbd.override { withVlock = false; };
in
stdenv.mkDerivation (finalAttrs: {
inherit pname version;
@@ -253,6 +256,21 @@ stdenv.mkDerivation (finalAttrs: {
./0019-meson-Don-t-link-ssh-dropins.patch
./0020-install-unit_file_exists_full-follow-symlinks.patch
# add nspawn build option flag
# required to disable nspawn for systemdLibs to avoid dependency on getent
# https://github.com/systemd/systemd/pull/36876, remove for systemd 258
(fetchpatch {
# required for the actual patch to apply
url = "https://github.com/systemd/systemd/commit/b1fb2d971c810e0bdf9ff0ae567a1c6c230e4e5d.patch";
hash = "sha256-JBheazg1OFkx8vUl2l8+34BoEPVURBQJHxqntOBYB60=";
includes = [ "src/nspawn/meson.build" ];
})
(fetchpatch {
url = "https://github.com/systemd/systemd/commit/d95818f5221d9b9b19648cffa0cb2407f023b27e.patch";
hash = "sha256-FTpWGec5ivlkyEEDMCPaLE+BH91e7JI0kH8pS88bBDY=";
excludes = [ "test/fuzz/meson.build" ];
})
]
++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
./0021-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -364,7 +382,6 @@ stdenv.mkDerivation (finalAttrs: {
ninja
meson
glibcLocales
getent
m4
autoPatchelfHook
@@ -396,7 +413,7 @@ stdenv.mkDerivation (finalAttrs: {
buildInputs = [
libxcrypt
libcap
(if withPam then libcap else libcap.override { usePam = false; })
libuuid
linuxHeaders
bashInteractive # for patch shebangs
@@ -485,8 +502,8 @@ stdenv.mkDerivation (finalAttrs: {
(lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig")
# Keyboard
(lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
(lib.mesonOption "setfont-path" "${kbd}/bin/setfont")
(lib.mesonOption "loadkeys-path" "${kbd'}/bin/loadkeys")
(lib.mesonOption "setfont-path" "${kbd'}/bin/setfont")
# SBAT
(lib.mesonOption "sbat-distro" "nixos")
@@ -583,6 +600,7 @@ stdenv.mkDerivation (finalAttrs: {
(lib.mesonEnable "gnutls" false)
(lib.mesonEnable "xkbcommon" false)
(lib.mesonEnable "man" true)
(lib.mesonEnable "nspawn" withNspawn)
(lib.mesonBool "analyze" withAnalyze)
(lib.mesonBool "logind" withLogind)
@@ -630,11 +648,6 @@ stdenv.mkDerivation (finalAttrs: {
# exhaustive. If another (unhandled) case is found in the source code the
# build fails with an error message.
binaryReplacements = [
{
search = "/usr/bin/getent";
replacement = "${getent}/bin/getent";
where = [ "src/nspawn/nspawn-setuid.c" ];
}
{
search = "/sbin/mkswap";
replacement = "${lib.getBin util-linux}/sbin/mkswap";
@@ -682,6 +695,13 @@ stdenv.mkDerivation (finalAttrs: {
where = [ "man/systemd-fsck@.service.xml" ];
}
]
++ lib.optionals withNspawn [
{
search = "/usr/bin/getent";
replacement = "${getent}/bin/getent";
where = [ "src/nspawn/nspawn-setuid.c" ];
}
]
++ lib.optionals withImportd [
{
search = "\"gpg\"";
@@ -923,9 +943,10 @@ stdenv.mkDerivation (finalAttrs: {
withUtmp
util-linux
kmod
kbd
;
kbd = kbd';
# Many TPM2-related units are only installed if this trio of features are
# enabled. See https://github.com/systemd/systemd/blob/876ee10e0eb4bbb0920bdab7817a9f06cc34910f/units/meson.build#L521
withTpm2Units = withTpm2Tss && withBootloader && withOpenSSL;