movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

Merge staging-next into staging

Browse source
This commit is contained in:
github-actions[bot] 2021-07-22 18:01:39 +00:00 • committed by GitHub
commit 0b0a8c7c9a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
80 changed files with 708 additions and 434 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nixos/modules/programs/udevil.nix
View file

@ -10,5 +10,8 @@ in {
config = mkIf cfg.enable {
security.wrappers.udevil.source = "${lib.getBin pkgs.udevil}/bin/udevil";
systemd.packages = [ pkgs.udevil ];
systemd.services."devmon@".wantedBy = [ "multi-user.target" ];
};
}

26
nixos/modules/programs/zsh/zsh.nix
View file

@ -53,7 +53,7 @@ in
};
shellAliases = mkOption {
default = {};
default = { };
description = ''
Set of aliases for zsh shell, which overrides <option>environment.shellAliases</option>.
See <option>environment.shellAliases</option> for an option format description.
@ -118,7 +118,9 @@ in
setOptions = mkOption {
type = types.listOf types.str;
default = [
"HIST_IGNORE_DUPS" "SHARE_HISTORY" "HIST_FCNTL_LOCK"
"HIST_IGNORE_DUPS"
"SHARE_HISTORY"
"HIST_FCNTL_LOCK"
];
example = [ "EXTENDED_HISTORY" "RM_STAR_WAIT" ];
description = ''
@ -278,15 +280,29 @@ in
environment.etc.zinputrc.source = ./zinputrc;
environment.systemPackages = [ pkgs.zsh ]
++ optional cfg.enableCompletion pkgs.nix-zsh-completions;
environment.systemPackages =
let
completions =
if lib.versionAtLeast (lib.getVersion config.nix.package) "2.4pre"
then
pkgs.nix-zsh-completions.overrideAttrs
(_: {
postInstall = ''
rm $out/share/zsh/site-functions/_nix
'';
})
else pkgs.nix-zsh-completions;
in
[ pkgs.zsh ]
++ optional cfg.enableCompletion completions;
environment.pathsToLink = optional cfg.enableCompletion "/share/zsh";
#users.defaultUserShell = mkDefault "/run/current-system/sw/bin/zsh";
environment.shells =
[ "/run/current-system/sw/bin/zsh"
[
"/run/current-system/sw/bin/zsh"
"${pkgs.zsh}/bin/zsh"
];

26
nixos/modules/services/networking/pppd.nix
View file

@ -82,13 +82,21 @@ in
LD_PRELOAD = "${pkgs.libredirect}/lib/libredirect.so";
NIX_REDIRECTS = "/var/run=/run/pppd";
};
serviceConfig = {
serviceConfig = let
capabilities = [
"CAP_BPF"
"CAP_SYS_TTY_CONFIG"
"CAP_NET_ADMIN"
"CAP_NET_RAW"
];
in
{
ExecStart = "${getBin cfg.package}/sbin/pppd call ${peerCfg.name} nodetach nolog";
Restart = "always";
RestartSec = 5;
AmbientCapabilities = "CAP_SYS_TTY_CONFIG CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN";
CapabilityBoundingSet = "CAP_SYS_TTY_CONFIG CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN";
AmbientCapabilities = capabilities;
CapabilityBoundingSet = capabilities;
KeyringMode = "private";
LockPersonality = true;
MemoryDenyWriteExecute = true;
@ -103,7 +111,17 @@ in
ProtectKernelTunables = false;
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = "AF_PACKET AF_UNIX AF_PPPOX AF_ATMPVC AF_ATMSVC AF_INET AF_INET6 AF_IPX";
RestrictAddressFamilies = [
"AF_ATMPVC"
"AF_ATMSVC"
"AF_INET"
"AF_INET6"
"AF_IPX"
"AF_NETLINK"
"AF_PACKET"
"AF_PPPOX"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;