From 7d9a26a0b45850e47f679dd515ac24feb4e3e986 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 28 Jul 2025 09:11:06 +0200 Subject: [PATCH 1/5] kbd: allow building without pam --- pkgs/by-name/kb/kbd/package.nix | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/kb/kbd/package.nix b/pkgs/by-name/kb/kbd/package.nix index fcb747260f29..ff4a1c3403fd 100644 --- a/pkgs/by-name/kb/kbd/package.nix +++ b/pkgs/by-name/kb/kbd/package.nix @@ -15,6 +15,7 @@ xz, zstd, gitUpdater, + withVlock ? true, }: stdenv.mkDerivation rec { @@ -30,16 +31,19 @@ stdenv.mkDerivation rec { # reduces closure size for most use cases. outputs = [ "out" - "vlock" "dev" "scripts" "man" + ] + ++ lib.optionals withVlock [ + "vlock" ]; configureFlags = [ "--enable-optional-progs" "--enable-libkeymap" "--disable-nls" + (lib.enableFeature withVlock "vlock") ] ++ lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [ "ac_cv_func_malloc_0_nonnull=yes" @@ -89,9 +93,10 @@ stdenv.mkDerivation rec { buildInputs = [ check - pam bash - ]; + ] + ++ lib.optionals withVlock [ pam ]; + NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isStatic "-laudit"; nativeBuildInputs = [ autoreconfHook From 0ce91c70d8ac574e1be70d3d31da2607c293bd5f Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 28 Jul 2025 08:36:19 +0200 Subject: [PATCH 2/5] systemd: disable pam in transitive dependencies if pam is disabled --- pkgs/os-specific/linux/systemd/default.nix | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index d533b228f883..56fc32b909f9 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -203,6 +203,8 @@ let # $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \ # jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime' releaseTimestamp = "1734643670"; + + kbd' = if withPam then kbd else kbd.override { withVlock = false; }; in stdenv.mkDerivation (finalAttrs: { inherit pname version; @@ -396,7 +398,7 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ libxcrypt - libcap + (if withPam then libcap else libcap.override { usePam = false; }) libuuid linuxHeaders bashInteractive # for patch shebangs @@ -485,8 +487,8 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig") # Keyboard - (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys") - (lib.mesonOption "setfont-path" "${kbd}/bin/setfont") + (lib.mesonOption "loadkeys-path" "${kbd'}/bin/loadkeys") + (lib.mesonOption "setfont-path" "${kbd'}/bin/setfont") # SBAT (lib.mesonOption "sbat-distro" "nixos") @@ -923,9 +925,10 @@ stdenv.mkDerivation (finalAttrs: { withUtmp util-linux kmod - kbd ; + kbd = kbd'; + # Many TPM2-related units are only installed if this trio of features are # enabled. See https://github.com/systemd/systemd/blob/876ee10e0eb4bbb0920bdab7817a9f06cc34910f/units/meson.build#L521 withTpm2Units = withTpm2Tss && withBootloader && withOpenSSL; From 0afdb39253be8ec0319bffa78b3e03961112b55a Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 28 Jul 2025 15:26:50 +0200 Subject: [PATCH 3/5] systemd: Don't build nspawn for systemdLibs --- pkgs/os-specific/linux/systemd/default.nix | 30 +++++++++++++++++----- 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 56fc32b909f9..79ebdb0c4415 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -138,6 +138,7 @@ withLogind ? true, withMachined ? true, withNetworkd ? true, + withNspawn ? !buildLibsOnly, withNss ? !stdenv.hostPlatform.isMusl, withOomd ? true, withOpenSSL ? true, @@ -255,6 +256,21 @@ stdenv.mkDerivation (finalAttrs: { ./0019-meson-Don-t-link-ssh-dropins.patch ./0020-install-unit_file_exists_full-follow-symlinks.patch + + # add nspawn build option flag + # required to disable nspawn for systemdLibs to avoid dependency on getent + # https://github.com/systemd/systemd/pull/36876, remove for systemd 258 + (fetchpatch { + # required for the actual patch to apply + url = "https://github.com/systemd/systemd/commit/b1fb2d971c810e0bdf9ff0ae567a1c6c230e4e5d.patch"; + hash = "sha256-JBheazg1OFkx8vUl2l8+34BoEPVURBQJHxqntOBYB60="; + includes = [ "src/nspawn/meson.build" ]; + }) + (fetchpatch { + url = "https://github.com/systemd/systemd/commit/d95818f5221d9b9b19648cffa0cb2407f023b27e.patch"; + hash = "sha256-FTpWGec5ivlkyEEDMCPaLE+BH91e7JI0kH8pS88bBDY="; + excludes = [ "test/fuzz/meson.build" ]; + }) ] ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [ ./0021-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch @@ -366,7 +382,6 @@ stdenv.mkDerivation (finalAttrs: { ninja meson glibcLocales - getent m4 autoPatchelfHook @@ -585,6 +600,7 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonEnable "gnutls" false) (lib.mesonEnable "xkbcommon" false) (lib.mesonEnable "man" true) + (lib.mesonEnable "nspawn" withNspawn) (lib.mesonBool "analyze" withAnalyze) (lib.mesonBool "logind" withLogind) @@ -632,11 +648,6 @@ stdenv.mkDerivation (finalAttrs: { # exhaustive. If another (unhandled) case is found in the source code the # build fails with an error message. binaryReplacements = [ - { - search = "/usr/bin/getent"; - replacement = "${getent}/bin/getent"; - where = [ "src/nspawn/nspawn-setuid.c" ]; - } { search = "/sbin/mkswap"; replacement = "${lib.getBin util-linux}/sbin/mkswap"; @@ -684,6 +695,13 @@ stdenv.mkDerivation (finalAttrs: { where = [ "man/systemd-fsck@.service.xml" ]; } ] + ++ lib.optionals withNspawn [ + { + search = "/usr/bin/getent"; + replacement = "${getent}/bin/getent"; + where = [ "src/nspawn/nspawn-setuid.c" ]; + } + ] ++ lib.optionals withImportd [ { search = "\"gpg\""; From 26d61f3fdc690a767fec993e3929d7233bdd91ea Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Sun, 10 Aug 2025 11:06:25 +0200 Subject: [PATCH 4/5] linux-pam: 1.6.1 -> 1.7.1 PAM switched to meson build upstream, which requires some care: - build with logind support - reenable lastlog - clean up autotools remnants - disable debug as it slows down test making it fail --- pkgs/by-name/li/linux-pam/package.nix | 118 +++++++++--------- .../li/linux-pam/suid-wrapper-path.patch | 6 - 2 files changed, 60 insertions(+), 64 deletions(-) delete mode 100644 pkgs/by-name/li/linux-pam/suid-wrapper-path.patch diff --git a/pkgs/by-name/li/linux-pam/package.nix b/pkgs/by-name/li/linux-pam/package.nix index 97b67d2131bf..222953ec17c3 100644 --- a/pkgs/by-name/li/linux-pam/package.nix +++ b/pkgs/by-name/li/linux-pam/package.nix @@ -2,98 +2,100 @@ lib, stdenv, buildPackages, - fetchurl, - fetchpatch, + fetchFromGitHub, flex, db4, gettext, + ninja, audit, libxcrypt, nixosTests, - autoreconfHook269, - pkg-config-unwrapped, + meson, + pkg-config, + systemdLibs, + nix-update-script, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "linux-pam"; - version = "1.6.1"; + version = "1.7.1"; - src = fetchurl { - url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz"; - hash = "sha256-+JI8dAFZBS1xnb/CovgZQtaN00/K9hxwagLJuA/u744="; + src = fetchFromGitHub { + owner = "linux-pam"; + repo = "linux-pam"; + tag = "v${finalAttrs.version}"; + hash = "sha256-kANcwxifQz2tYPSrSBSFiYNTm51Gr10L/zroCqm8ZHQ="; }; - patches = [ - ./suid-wrapper-path.patch - # required for fixing CVE-2025-6020 - (fetchpatch { - url = "https://github.com/linux-pam/linux-pam/commit/10b80543807e3fc5af5f8bcfd8bb6e219bb3cecc.patch"; - hash = "sha256-VS3D3wUbDxDXRriIuEvvgeZixzDA58EfiLygfFeisGg="; - }) - # Manually cherry-picked from 475bd60c552b98c7eddb3270b0b4196847c0072e - ./CVE-2025-6020.patch - ]; - - # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569 - postPatch = - lib.optionalString (stdenv.buildPlatform.isDarwin && stdenv.buildPlatform != stdenv.hostPlatform) - '' - rm CHANGELOG - touch ChangeLog - ''; + # patching unix_chkpwd is required as the nix store entry does not have the necessary bits + postPatch = '' + substituteInPlace modules/module-meson.build \ + --replace-fail "sbindir / 'unix_chkpwd'" "'/run/wrappers/bin/unix_chkpwd'" + ''; outputs = [ "out" - "doc" - "man" # "modules" + # "doc" + # "man" + # "modules" ]; depsBuildBuild = [ buildPackages.stdenv.cc ]; - # autoreconfHook269 is needed for `suid-wrapper-path.patch` above. - # pkg-config-unwrapped is needed for `AC_CHECK_LIB` and `AC_SEARCH_LIBS` nativeBuildInputs = [ flex - autoreconfHook269 - pkg-config-unwrapped - ] - ++ lib.optional stdenv.buildPlatform.isDarwin gettext; + meson + ninja + pkg-config + gettext + ]; buildInputs = [ db4 libxcrypt ] - ++ lib.optional stdenv.buildPlatform.isLinux audit; + ++ lib.optionals stdenv.buildPlatform.isLinux [ + audit + systemdLibs + ]; enableParallelBuilding = true; - configureFlags = [ - "--includedir=${placeholder "out"}/include/security" - "--enable-sconfigdir=/etc/security" - # The module is deprecated. We re-enable it explicitly until NixOS - # module stops using it. - "--enable-lastlog" - ]; - - installFlags = [ - "SCONFIGDIR=${placeholder "out"}/etc/security" + mesonFlags = [ + (lib.mesonEnable "logind" stdenv.buildPlatform.isLinux) + (lib.mesonEnable "audit" stdenv.buildPlatform.isLinux) + (lib.mesonEnable "pam_lastlog" (!stdenv.hostPlatform.isMusl)) # TODO: switch to pam_lastlog2, pam_lastlog is deprecated and broken on musl + (lib.mesonEnable "pam_unix" true) + # (lib.mesonBool "pam-debug" true) # warning: slower execution due to debug makes VM tests fail! + (lib.mesonOption "sysconfdir" "etc") # relative to meson prefix, which is $out + (lib.mesonEnable "elogind" false) + (lib.mesonEnable "econf" false) + (lib.mesonEnable "selinux" false) + (lib.mesonEnable "nis" false) + (lib.mesonEnable "docs" false) + (lib.mesonBool "xtests" false) + (lib.mesonBool "examples" false) ]; doCheck = false; # fails - passthru.tests = { - inherit (nixosTests) - pam-oath-login - pam-u2f - pam-lastlog - shadow - sssd-ldap - ; + passthru = { + tests = { + inherit (nixosTests) + pam-oath-login + pam-u2f + pam-lastlog + shadow + sssd-ldap + ; + }; + updateScript = nix-update-script { }; }; - meta = with lib; { + meta = { + changelog = "https://github.com/linux-pam/linux-pam/releases/tag/${finalAttrs.src.tag}"; homepage = "https://github.com/linux-pam/linux-pam"; description = "Pluggable Authentication Modules, a flexible mechanism for authenticating user"; - platforms = platforms.linux; - license = licenses.bsd3; + platforms = lib.platforms.linux; + license = lib.licenses.bsd3; }; -} +}) diff --git a/pkgs/by-name/li/linux-pam/suid-wrapper-path.patch b/pkgs/by-name/li/linux-pam/suid-wrapper-path.patch deleted file mode 100644 index a427ccf38816..000000000000 --- a/pkgs/by-name/li/linux-pam/suid-wrapper-path.patch +++ /dev/null @@ -1,6 +0,0 @@ -It needs the SUID version during runtime, and that can't be in /nix/store/** ---- a/modules/pam_unix/Makefile.am -+++ b/modules/pam_unix/Makefile.am -@@ -21 +21 @@ -- -DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \ -+ -DCHKPWD_HELPER=\"/run/wrappers/bin/unix_chkpwd\" \ From 868e7c10b9b4cf2cdc8331d34085625fdea5c056 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 28 Jul 2025 12:07:48 +0200 Subject: [PATCH 5/5] linux-pam: re-enable doc/man outputs Co-Authored-by: Marcin Serwin --- pkgs/by-name/li/linux-pam/package.nix | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/li/linux-pam/package.nix b/pkgs/by-name/li/linux-pam/package.nix index 222953ec17c3..3d41329f2701 100644 --- a/pkgs/by-name/li/linux-pam/package.nix +++ b/pkgs/by-name/li/linux-pam/package.nix @@ -13,6 +13,12 @@ meson, pkg-config, systemdLibs, + docbook5, + libxslt, + libxml2, + w3m-batch, + findXMLCatalogs, + docbook_xsl_ns, nix-update-script, }: @@ -35,8 +41,8 @@ stdenv.mkDerivation (finalAttrs: { outputs = [ "out" - # "doc" - # "man" + "doc" + "man" # "modules" ]; @@ -47,6 +53,13 @@ stdenv.mkDerivation (finalAttrs: { ninja pkg-config gettext + + libxslt + libxml2 + w3m-batch + findXMLCatalogs + docbook_xsl_ns + docbook5 ]; buildInputs = [ @@ -60,6 +73,7 @@ stdenv.mkDerivation (finalAttrs: { enableParallelBuilding = true; + mesonAutoFeatures = "auto"; mesonFlags = [ (lib.mesonEnable "logind" stdenv.buildPlatform.isLinux) (lib.mesonEnable "audit" stdenv.buildPlatform.isLinux) @@ -71,7 +85,6 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonEnable "econf" false) (lib.mesonEnable "selinux" false) (lib.mesonEnable "nis" false) - (lib.mesonEnable "docs" false) (lib.mesonBool "xtests" false) (lib.mesonBool "examples" false) ];