gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,008,378 Commits 9 Branches 0 Tags
1ac3c5dc9969eb532bc5fb22bfedaa4f2b4293c0
Commit Graph
1008378 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
r-vdpandRasheeq Azad 1ac3c5dc99 nixos/shadow: use file capabilities for newuidmap/newgidmap 
Writing a multi-line /proc/<pid>/[ug]id_map only requires
CAP_SETUID/CAP_SETGID over the parent user namespace, not full root.
shadow's own --with-fcaps install mode (70971457b761) sets exactly
cap_setuid+ep / cap_setgid+ep, and Arch, Fedora and Debian have shipped
these binaries with file capabilities instead of setuid for years.

The setuid variant already drops to the same single capability before
the uid_map write (see lib/idmapping.c), so the privilege at the point
attacker-controlled data reaches the kernel is unchanged. The reduction
is in the startup window: with file capabilities the process never has
euid 0 and never holds the full capability set during NSS lookups,
/etc/subuid parsing and /proc/<pid> opening.

The only functional difference is that mapping host uid 0 into a child
namespace additionally needs CAP_SETFCAP, which the setuid path got
implicitly. NixOS never puts uid 0 into auto-allocated subuid ranges,
and granting it manually is a deliberate root-equivalent configuration;
the release notes document the override for that case.

nixosTests.{shadow,podman,docker-rootless} pass; the latter two
exercise newuidmap/newgidmap via rootless containers.

Supersedes #461172.

Co-authored-by: Rasheeq Azad <rasheeqhere@gmail.com>
 2026-06-01 00:18:28 +03:00
nixpkgs-ci[bot]andGitHub bbb5a121dc Merge master into staging-nixos 2026-05-31 18:26:58 +00:00
Michael DanielsandGitHub 7286612a53 uriparser: move gtest from nativeCheckInputs to checkInputs (#526172) 2026-05-31 18:19:46 +00:00
Michael DanielsandGitHub 463d5951d0 eslint: 10.3.0 -> 10.4.0 (#524208) 2026-05-31 18:18:04 +00:00
dishandGitHub a0b67cc69e jextract-21: remove (#519958) 2026-05-31 18:07:27 +00:00
Ivan MincikandGitHub 922015c3d6 pmtiles: 1.30.0 → 1.30.3 (#526111) 2026-05-31 17:57:27 +00:00
nixpkgs-ci[bot]andGitHub d1f8ebcb74 uptime-kuma: 2.3.2 -> 2.4.0 (#526203) 2026-05-31 17:42:28 +00:00
nixpkgs-ci[bot]andGitHub 3b5ec87c52 crush: 0.70.0 -> 0.74.1 (#526402) 2026-05-31 17:14:12 +00:00
nixpkgs-ci[bot]andGitHub f6ce442b4c dwproton-bin: dwproton-11.0-2 -> dwproton-11.0-3 (#526322) 2026-05-31 17:14:08 +00:00
Yohann BonifaceandGitHub 3109eaae18 youki: update homepage and changelog URLs (#526414) 2026-05-31 16:57:23 +00:00
SandroandGitHub 4f938e6dac sunshine: remove pcre (#525943) 2026-05-31 16:40:08 +00:00
otaconixandStefan Zwanenburg 8664f2af97 youki: update homepage and changelog URLs 
I'm not exactly sure when this happened, but Youki is no longer being maintained under the _containers_ organization on GitHub, and instead in its own _youki-dev_ organization.
 2026-05-31 18:30:14 +02:00
Alyssa RossandGitHub 331800de50 ci/OWNERS: add myself to some critical components (#511736) 2026-05-31 16:09:29 +00:00
R. Ryantm cc2f97a1cf crush: 0.70.0 -> 0.74.1 2026-05-31 15:49:23 +00:00
Bobby RongandGitHub 856d6dd71e spice-up: drop unused libsoup 2.4 dependency, modernize (#526089) 2026-05-31 15:45:04 +00:00
SandroandGitHub e52ad6d686 nixos/gemstash: add package option (#392135) 2026-05-31 15:38:28 +00:00
SandroandGitHub f37114b679 clippy-copy: init at 1.6.9 (#518816) 2026-05-31 15:37:14 +00:00
SandroandGitHub c1f31180f8 chameleonultragui: init at 1.3 (#455441) 2026-05-31 15:33:49 +00:00
SandroandGitHub 7a4bf488d5 bobgen: init at 0.42.0 (#420450) 2026-05-31 15:32:06 +00:00
SandroandGitHub d72039412b leet-helix: init at 0.2.3-unstable-2026-02-24 (#492301) 2026-05-31 15:30:36 +00:00
RamsesandGitHub e0f1741d33 fwupd: 2.1.1 -> 2.1.4 (#513368) 2026-05-31 15:11:55 +00:00
RamsesandGitHub ea0723ecc7 kmscon: 9.3.5 -> 10.0.0, nixos/kmscon: RFC42 treatment (#520693) 2026-05-31 14:56:05 +00:00
Michael DanielsandGitHub 57ee43c333 maintainers/github-teams.json: Automated sync (#521701) 2026-05-31 14:51:20 +00:00
dotlambdaandGitHub b6bed15b54 bitwarden-cli: 2026.4.2 -> 2026.5.0 (#525725) 2026-05-31 14:50:59 +00:00
dotlambdaandGitHub b0cd645bf5 verapdf: 1.28.2 -> 1.30.1 (#525083) 2026-05-31 14:49:45 +00:00
Michael DanielsandGitHub 2584b33b42 mudlet: 4.19.1 -> 4.20.1 (#517599) 2026-05-31 14:49:20 +00:00
nixpkgs-ci[bot] 81515c9c2e maintainers/github-teams.json: Automated sync 2026-05-31 14:46:32 +00:00
dotlambdaandGitHub 652328185b python3Packages.insightface: 0.7.3 -> 1.0.1 (#525339) 2026-05-31 14:45:19 +00:00
Francesco GazzettaandGitHub 83183dd497 tclPackages.tclcsv: init at 2.4.3 (#367887) 2026-05-31 14:42:36 +00:00
Arne KellerandGitHub 8a7ccc8977 jextract: fix build on Darwin (#519643) 2026-05-31 14:37:50 +00:00
Francesco GazzettaandGitHub 287ae4b33e ladybird: fix wrong icu error (#523175) 2026-05-31 14:35:59 +00:00
Arne KellerandGitHub 4103602b57 jspecify: build fromSource with gradle (#521149) 2026-05-31 14:33:32 +00:00
Stefan FrijtersandGitHub 2cd62598d7 enlightenment.efl: enable structuredAttrs and strictDeps, modernize (#526253) 2026-05-31 14:32:35 +00:00
Arne KellerandGitHub baae4fad2c prusa-slicer: 2.9.4 -> 2.9.5 (#522253) 2026-05-31 14:30:28 +00:00
Arne KellerandGitHub c66de3821c temurin-{,jre-}bin-26: init at 26.0.1 (#506356) 2026-05-31 14:25:16 +00:00
nixpkgs-ci[bot]andGitHub 8b2a78b69f sdl_gamecontrollerdb: 0-unstable-2026-05-12 -> 0-unstable-2026-05-28 (#526307) 2026-05-31 14:23:03 +00:00
Guillaume GirolandGitHub a6cdc5ed94 mplayer: enable strictDeps and structuredAttrs, add versionCheckHook (#526049) 2026-05-31 14:22:16 +00:00
Doron BeharandGitHub 01e2dd353f handy: init at 0.8.3 (#507754) 2026-05-31 14:09:37 +00:00
Matt SturgeonandGitHub 8f5fcf6fae gh-gonest: init at 0-unstable-2025-12-17 (#505796) 2026-05-31 14:08:39 +00:00
Martin WeineltandGitHub 8c8c287338 httpfs2: drop (#526263) 2026-05-31 14:03:49 +00:00
Adam Dinwoodieandjack rosenberg eeea15fbf3 gh-gonest: init at 0-unstable-2025-12-17 
Co-authored-by: jack rosenberg <56937175+jackrosenberg@users.noreply.github.com>
 2026-05-31 15:01:12 +01:00
Matt SturgeonandGitHub cb85638ebd minizip-ng{-compat}: split compat, fixup cmake options, 4.1.0 -> 4.2.1, strictDeps, add kuflierl as maintainer (#506086) 2026-05-31 13:56:34 +00:00
Michael DanielsandGitHub 23ca5cc448 {lemonbar,lemonbar-xft}: move to by-name (#525985) 2026-05-31 13:52:37 +00:00
Pol DellaieraandGitHub c1ee2eb8b9 fahclient: 8.5.3 -> 8.5.6 (#526358) 2026-05-31 13:47:55 +00:00
Stefan Frijters 060ccf1e40 mplayer: embed version, add versionCheckHook 2026-05-31 15:46:24 +02:00
Stefan Frijters 35685c55e8 mplayer: enable strictDeps and structuredAttrs 2026-05-31 15:46:24 +02:00
Stefan Frijters 97950d6fec mplayer: use lib.enableFeature 2026-05-31 15:46:24 +02:00
Stefan Frijters 95aad17dc9 mplayer: fix build with structuredAttrs 
Entries in configureFlags should be single flags, not multiple space separated flags per string.
 2026-05-31 15:46:23 +02:00
nixpkgs-ci[bot]andGitHub a9307e05dc nakama: 3.38.0 -> 3.39.0 (#522334) 2026-05-31 13:42:49 +00:00
nixpkgs-ci[bot]andGitHub 90e5d582ca findent: 4.3.6 -> 4.3.7 (#525078) 2026-05-31 13:42:46 +00:00