From 15dc91ff952da117ed95ca7bc9d5a097b67d3b9a Mon Sep 17 00:00:00 2001 From: r-vdp Date: Tue, 30 Dec 2025 13:47:16 +0200 Subject: [PATCH 1/5] nixos-rebuild-ng: pass the NIXOS_NO_CHECK variable through the systemd-run and sudo invocations This allows to skip nixos pre-switch check when running switch-to-configuration. --- nixos/modules/system/activation/switchable-system.nix | 11 +++++++++++ .../ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py | 2 ++ 2 files changed, 13 insertions(+) diff --git a/nixos/modules/system/activation/switchable-system.nix b/nixos/modules/system/activation/switchable-system.nix index 380b52b6825d..8c7159c3ec7e 100644 --- a/nixos/modules/system/activation/switchable-system.nix +++ b/nixos/modules/system/activation/switchable-system.nix @@ -140,5 +140,16 @@ fi ''; }; + + security = + let + extraConfig = '' + Defaults env_keep+=NIXOS_NO_CHECK + ''; + in + { + sudo = { inherit extraConfig; }; + sudo-rs = { inherit extraConfig; }; + }; }; } diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py index cf3f1eefc891..f30ccf90d1ea 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py @@ -37,6 +37,8 @@ SWITCH_TO_CONFIGURATION_CMD_PREFIX: Final = [ "LOCALE_ARCHIVE", "-E", "NIXOS_INSTALL_BOOTLOADER", + "-E", + "NIXOS_NO_CHECK", "--collect", "--no-ask-password", "--pipe", From 15ac0a5b9b5c43ee28745544297bf9f662ca6432 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaakko=20Sir=C3=A9n?= Date: Sun, 4 Jan 2026 21:46:30 +0200 Subject: [PATCH 2/5] kernel/common-config: enable fs-verity and IPE LSM Enable filesystem integrity verification features: - FS_VERITY: Per-file Merkle tree integrity verification. Files with fs-verity enabled become immutable and are verified block-by-block on read. Zero overhead when not used. Already enabled by default in Fedora, Ubuntu, and Arch. - FS_VERITY_BUILTIN_SIGNATURES: Allow verifying fs-verity signatures against keys in the kernel keyring. - SECURITY_IPE: Integrity Policy Enforcement LSM (merged in 6.12). Allows enforcing policies based on file integrity properties like fs-verity measurements or dm-verity. Useful for verified boot and ensuring only integrity-verified files can be executed. - IPE_PROP_FS_VERITY: Allow IPE to use fs-verity as a trust source. - IPE_PROP_FS_VERITY_BUILTIN_SIG: Allow IPE to require signed fs-verity. These features have no runtime impact unless explicitly used, but enable important security use cases like immutable package stores (NixOS /nix/store) and verified boot configurations. --- pkgs/os-specific/linux/kernel/common-config.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index e1380b86a11f..7c1295740403 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -684,6 +684,8 @@ let TMPFS = yes; TMPFS_POSIX_ACL = yes; FS_ENCRYPTION = yes; + FS_VERITY = yes; + FS_VERITY_BUILTIN_SIGNATURES = yes; EXT2_FS_XATTR = yes; EXT2_FS_POSIX_ACL = yes; @@ -796,6 +798,12 @@ let # This does not have any effect if a program does not support it SECURITY_LANDLOCK = whenAtLeast "5.13" yes; + # IPE (Integrity Policy Enforcement) - LSM that can enforce file integrity based on + # fs-verity measurements or dm-verity. Useful for verified boot and immutable /nix/store. + SECURITY_IPE = whenAtLeast "6.12" yes; + IPE_PROP_FS_VERITY = whenAtLeast "6.12" yes; + IPE_PROP_FS_VERITY_BUILTIN_SIG = whenAtLeast "6.12" yes; + DEVKMEM = lib.mkIf (!stdenv.hostPlatform.isAarch64) (whenOlder "5.13" no); # Disable /dev/kmem USER_NS = yes; # Support for user namespaces From 24188db7351021632efe39ae05f20caaf2481dc8 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 8 Jan 2026 09:58:02 +0000 Subject: [PATCH 3/5] linux_testing: 6.19-rc3 -> 6.19-rc4 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 8996ab9388ab..585becdaf752 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -1,7 +1,7 @@ { "testing": { - "version": "6.19-rc3", - "hash": "sha256:1ps2bq9jag0ypr9nj2zfqak81sc12l2hrj2065k2jnvwqcx0vhw3", + "version": "6.19-rc4", + "hash": "sha256:1ivkpgmmpy7my1vcly82pnnz3ynmdjz62n4q251j970zk8m42r9s", "lts": false }, "6.1": { From cedbb8a384b8054c4f77eeacf148d64280da565c Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 8 Jan 2026 09:58:06 +0000 Subject: [PATCH 4/5] linux_6_18: 6.18.3 -> 6.18.4 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 585becdaf752..8674fcc22031 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -30,8 +30,8 @@ "lts": true }, "6.18": { - "version": "6.18.3", - "hash": "sha256:16kzgpxrmaxd2kcsmlnsvc2ryxih457rrwynfzhbmi49gcb7k23s", + "version": "6.18.4", + "hash": "sha256:1asza9m4vb7lghxaiy5fpnbwmb9a44pgjclbpgv1p77plnf16l7q", "lts": false } } From 570cd71db4dc5afdfa5e21a360559a8eff17c7b5 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Thu, 8 Jan 2026 09:58:08 +0000 Subject: [PATCH 5/5] linux_6_12: 6.12.63 -> 6.12.64 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 8674fcc22031..3ea3be0917cf 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -25,8 +25,8 @@ "lts": true }, "6.12": { - "version": "6.12.63", - "hash": "sha256:1cvxvwlmnqw71nf6nizf0hpp710a8dsczz5bjwy3i55qwkzwa0lm", + "version": "6.12.64", + "hash": "sha256:18j9ivimvlm1afzfiw03n3r35qv91nbjhh2gi3z8w5416sir9bfi", "lts": true }, "6.18": {