Merge branch 'master' into grsec-stdenv

nixos/modules/security/duosec.nix

@@ -165,6 +165,17 @@ in
           whitelist.
         '';
       };
+
+      allowTcpForwarding = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          By default, when SSH forwarding, enabling Duo Security will
+          disable TCP forwarding. By enabling this, you potentially
+          undermine some of the SSH based login security. Note this is
+          not needed if you use PAM.
+        '';
+      };
     };
   };
 
@@ -192,7 +203,9 @@ in
        # Duo Security configuration
        ForceCommand ${config.security.wrapperDir}/login_duo
        PermitTunnel no
-       AllowTcpForwarding no
+       ${optionalString (!cfg.allowTcpForwarding) ''
+         AllowTcpForwarding no
+       ''}
      '');
   };
 }

nixos/modules/services/desktops/gnome3/at-spi2-core.nix

@@ -4,6 +4,9 @@
 
 with lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -30,9 +33,9 @@ with lib;
 
   config = mkIf config.services.gnome3.at-spi2-core.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.at_spi2_core ];
+    environment.systemPackages = [ gnome3.at_spi2_core ];
 
-    services.dbus.packages = [ pkgs.gnome3.at_spi2_core ];
+    services.dbus.packages = [ gnome3.at_spi2_core ];
 
   };
 

nixos/modules/services/desktops/gnome3/gnome-documents.nix

@@ -4,6 +4,9 @@
 
 with pkgs.lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -30,9 +33,9 @@ with pkgs.lib;
 
   config = mkIf config.services.gnome3.gnome-documents.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.gnome-documents ];
+    environment.systemPackages = [ gnome3.gnome-documents ];
 
-    services.dbus.packages = [ pkgs.gnome3.gnome-documents ];
+    services.dbus.packages = [ gnome3.gnome-documents ];
 
     services.gnome3.gnome-online-accounts.enable = true;
 

nixos/modules/services/desktops/gnome3/gnome-keyring.nix

@@ -4,6 +4,9 @@
 
 with pkgs.lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -31,9 +34,9 @@ with pkgs.lib;
 
   config = mkIf config.services.gnome3.gnome-keyring.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.gnome_keyring ];
+    environment.systemPackages = [ gnome3.gnome_keyring ];
 
-    services.dbus.packages = [ pkgs.gnome3.gnome_keyring ];
+    services.dbus.packages = [ gnome3.gnome_keyring ];
 
   };
 

nixos/modules/services/desktops/gnome3/gnome-online-accounts.nix

@@ -4,6 +4,9 @@
 
 with pkgs.lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -30,9 +33,9 @@ with pkgs.lib;
 
   config = mkIf config.services.gnome3.gnome-online-accounts.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.gnome_online_accounts ];
+    environment.systemPackages = [ gnome3.gnome_online_accounts ];
 
-    services.dbus.packages = [ pkgs.gnome3.gnome_online_accounts ];
+    services.dbus.packages = [ gnome3.gnome_online_accounts ];
 
   };
 

nixos/modules/services/desktops/gnome3/gnome-online-miners.nix

@@ -4,6 +4,9 @@
 
 with pkgs.lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -30,9 +33,9 @@ with pkgs.lib;
 
   config = mkIf config.services.gnome3.gnome-online-miners.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.gnome-online-miners ];
+    environment.systemPackages = [ gnome3.gnome-online-miners ];
 
-    services.dbus.packages = [ pkgs.gnome3.gnome-online-miners ];
+    services.dbus.packages = [ gnome3.gnome-online-miners ];
 
   };
 

nixos/modules/services/desktops/gnome3/gnome-user-share.nix

@@ -4,6 +4,9 @@
 
 with pkgs.lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -30,9 +33,9 @@ with pkgs.lib;
 
   config = mkIf config.services.gnome3.gnome-user-share.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.gnome-user-share ];
+    environment.systemPackages = [ gnome3.gnome-user-share ];
 
-    services.xserver.displayManager.sessionCommands = with pkgs.gnome3; ''
+    services.xserver.displayManager.sessionCommands = with gnome3; ''
       # Don't let gnome-control-center depend upon gnome-user-share
       export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${gnome-user-share}/share/gsettings-schemas/${gnome-user-share.name}
     '';

nixos/modules/services/desktops/gnome3/seahorse.nix

@@ -4,6 +4,9 @@
 
 with pkgs.lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -29,9 +32,9 @@ with pkgs.lib;
 
   config = mkIf config.services.gnome3.seahorse.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.seahorse ];
+    environment.systemPackages = [ gnome3.seahorse ];
 
-    services.dbus.packages = [ pkgs.gnome3.seahorse ];
+    services.dbus.packages = [ gnome3.seahorse ];
 
   };
 

nixos/modules/services/desktops/gnome3/sushi.nix

@@ -4,6 +4,9 @@
 
 with lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -29,9 +32,9 @@ with lib;
 
   config = mkIf config.services.gnome3.sushi.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.sushi ];
+    environment.systemPackages = [ gnome3.sushi ];
 
-    services.dbus.packages = [ pkgs.gnome3.sushi ];
+    services.dbus.packages = [ gnome3.sushi ];
 
   };
 

nixos/modules/services/desktops/gnome3/tracker.nix

@@ -4,6 +4,9 @@
 
 with pkgs.lib;
 
+let
+  gnome3 = config.environment.gnome3.packageSet;
+in
 {
 
   ###### interface
@@ -30,9 +33,9 @@ with pkgs.lib;
 
   config = mkIf config.services.gnome3.tracker.enable {
 
-    environment.systemPackages = [ pkgs.gnome3.tracker ];
+    environment.systemPackages = [ gnome3.tracker ];
 
-    services.dbus.packages = [ pkgs.gnome3.tracker ];
+    services.dbus.packages = [ gnome3.tracker ];
 
   };
 

nixos/modules/services/hardware/udev.nix

@@ -22,7 +22,7 @@ let
     KERNEL=="kqemu",                MODE="0666"
 
     # Needed for gpm.
-    KERNEL=="input/mice", TAG+="systemd"
+    SUBSYSTEM=="input", KERNEL=="mice", TAG+="systemd"
   '';
 
   # Perform substitutions in all udev rules files.

nixos/modules/services/hardware/upower.nix

@@ -4,6 +4,9 @@
 
 with lib;
 
+let
+  cfg = config.services.upower;
+in
 {
 
   ###### interface
@@ -21,6 +24,15 @@ with lib;
         '';
       };
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.upower;
+        example = lib.literalExample "pkgs.upower";
+        description = ''
+          Which upower package to use.
+        '';
+      };
+
     };
 
   };
@@ -28,13 +40,13 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.services.upower.enable {
+  config = mkIf cfg.enable {
 
-    environment.systemPackages = [ pkgs.upower ];
+    environment.systemPackages = [ cfg.package ];
 
-    services.dbus.packages = [ pkgs.upower ];
+    services.dbus.packages = [ cfg.package ];
 
-    services.udev.packages = [ pkgs.upower ];
+    services.udev.packages = [ cfg.package ];
 
     systemd.services.upower =
       { description = "Power Management Daemon";
@@ -42,7 +54,7 @@ with lib;
         serviceConfig =
           { Type = "dbus";
             BusName = "org.freedesktop.UPower";
-            ExecStart = "@${pkgs.upower}/libexec/upowerd upowerd";
+            ExecStart = "@${cfg.package}/libexec/upowerd upowerd";
           };
       };
 

nixos/modules/services/ttys/gpm.nix

@@ -45,6 +45,7 @@ in
 
         wantedBy = [ "multi-user.target" ];
         requires = [ "dev-input-mice.device" ];
+        after = [ "dev-input-mice.device" ];
 
         serviceConfig.ExecStart = "@${pkgs.gpm}/sbin/gpm gpm -m /dev/input/mice -t ${cfg.protocol}";
         serviceConfig.Type = "forking";

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -4,13 +4,13 @@ with lib;
 
 let
   cfg = config.services.xserver.desktopManager.gnome3;
-  gnome3 = pkgs.gnome3;
+  gnome3 = config.environment.gnome3.packageSet;
 
   # Remove packages of ys from xs, based on their names
   removePackagesByName = xs: ys:
     let
       pkgName = drv: (builtins.parseDrvName drv.name).name;
-	  ysNames = map pkgName ys;
+      ysNames = map pkgName ys;
       res = (filter (x: !(builtins.elem (pkgName x) ysNames)) xs);
     in
       filter (x: !(builtins.elem (pkgName x) ysNames)) xs;
@@ -35,6 +35,12 @@ in {
       description = "Enable Gnome 3 desktop manager.";
     };
 
+    environment.gnome3.packageSet = mkOption {
+      default = pkgs.gnome3;
+      example = literalExample "pkgs.gnome3_12";
+      description = "Which Gnome 3 package set to use.";
+    };
+    
     environment.gnome3.excludePackages = mkOption {
       default = [];
       example = "[ pkgs.gnome3.totem ]";
@@ -64,6 +70,7 @@ in {
     services.telepathy.enable = mkDefault true;
     networking.networkmanager.enable = true;
     services.upower.enable = config.powerManagement.enable;
+    services.upower.package = gnome3.upower;
 
     fonts.fonts = [ pkgs.dejavu_fonts ];
 
@@ -80,7 +87,7 @@ in {
 
           # Don't let epiphany depend upon gnome-shell
           # Override default mimeapps
-          export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${pkgs.gnome3.gnome_shell}/share/gsettings-schemas/${pkgs.gnome3.gnome_shell.name}:${mimeAppsList}/share
+          export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${gnome3.gnome_shell}/share/gsettings-schemas/${gnome3.gnome_shell.name}:${mimeAppsList}/share
 
           # Let gnome-control-center find gnome-shell search providers
           export GNOME_SEARCH_PROVIDERS_DIR=${config.system.path}/share/gnome-shell/search-providers/

nixos/modules/system/boot/systemd.nix

@@ -812,5 +812,7 @@ in
         ${concatStringsSep "\n" cfg.tmpfiles.rules}
       '';
 
+    systemd.services."user@".restartIfChanged = false;
+
   };
 }

nixos/tests/gnome3_12.nix

@@ -0,0 +1,30 @@
+import ./make-test.nix {
+
+  machine =
+    { config, pkgs, ... }:
+
+    { imports = [ ./common/user-account.nix ];
+
+      services.xserver.enable = true;
+
+      services.xserver.displayManager.auto.enable = true;
+      services.xserver.displayManager.auto.user = "alice";
+      services.xserver.desktopManager.gnome3.enable = true;
+      environment.gnome3.packageSet = pkgs.gnome3_12;
+    };
+
+  testScript =
+    ''
+      $machine->waitForX;
+      $machine->sleep(15);
+
+      # Check that logging in has given the user ownership of devices.
+      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+
+      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
+      $machine->waitForWindow(qr/Terminal/);
+      $machine->sleep(10);
+      $machine->screenshot("screen");
+    '';
+
+}

pkgs/applications/misc/blender/default.nix

@@ -1,7 +1,8 @@
 { stdenv, fetchurl, SDL, boost, cmake, ffmpeg, gettext, glew
-, ilmbase, jackaudio, libXi, libjpeg, libpng, libsamplerate, libsndfile
+, ilmbase, libXi, libjpeg, libpng, libsamplerate, libsndfile
 , libtiff, mesa, openal, opencolorio, openexr, openimageio, openjpeg, python
 , zlib
+, jackaudioSupport ? false, jackaudio
 }:
 
 stdenv.mkDerivation rec {
@@ -12,25 +13,23 @@ stdenv.mkDerivation rec {
     sha256 = "1rgkijn1nirj3jwh058zv6piw8q4j5wwjapgbvh2hh6fpbj84bgb";
   };
 
-  buildInputs = [
+  buildInputs =
-    SDL boost cmake ffmpeg gettext glew ilmbase jackaudio libXi
+    [ SDL boost cmake ffmpeg gettext glew ilmbase jackaudio libXi
-    libjpeg libpng libsamplerate libsndfile libtiff mesa openal
+      libjpeg libpng libsamplerate libsndfile libtiff mesa openal
-    opencolorio openexr openimageio openjpeg python zlib
+      opencolorio openexr openimageio openjpeg python zlib
-  ];
+    ] ++ stdenv.lib.optional jackaudioSupport jackaudio;
 
-
+  cmakeFlags =
-  cmakeFlags = [
+    [ "-DOPENEXR_INC=${openexr}/include/OpenEXR"
-    "-DOPENEXR_INC=${openexr}/include/OpenEXR"
+      "-DWITH_OPENCOLLADA=OFF"
-    "-DWITH_OPENCOLLADA=OFF"
+      "-DWITH_CODEC_FFMPEG=ON"
-    "-DWITH_CODEC_FFMPEG=ON"
+      "-DWITH_CODEC_SNDFILE=ON"
-    "-DWITH_CODEC_SNDFILE=ON"
+      "-DWITH_INSTALL_PORTABLE=OFF"
-    "-DWITH_JACK=ON"
+      "-DPYTHON_LIBRARY=python${python.majorVersion}m"
-    "-DWITH_INSTALL_PORTABLE=OFF"
+      "-DPYTHON_LIBPATH=${python}/lib"
-    "-DPYTHON_LIBRARY=python${python.majorVersion}m"    
+      "-DPYTHON_INCLUDE_DIR=${python}/include/python${python.majorVersion}m"
-    "-DPYTHON_LIBPATH=${python}/lib"
+      "-DPYTHON_VERSION=${python.majorVersion}"
-    "-DPYTHON_INCLUDE_DIR=${python}/include/python${python.majorVersion}m"
+    ] ++ stdenv.lib.optional jackaudioSupport "-DWITH_JACK=ON";
-    "-DPYTHON_VERSION=${python.majorVersion}"
-  ];
 
   NIX_CFLAGS_COMPILE = "-I${ilmbase}/include/OpenEXR -I${python}/include/${python.libPrefix}m";
 
@@ -44,6 +43,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.goibhniu ];
-
   };
 }

pkgs/applications/networking/bittorrentsync/default.nix

@@ -5,15 +5,15 @@ let
     else if stdenv.system == "i686-linux" then "i386"
     else throw "Bittorrent Sync for: ${stdenv.system} not supported!";
 
-  sha256 = if stdenv.system == "x86_64-linux" then "0q91fwzvb5ybl43z9nirnk3bs13z0z5vf0cqdyynqwa93an6wiaq"
+  sha256 = if stdenv.system == "x86_64-linux" then "1xba0wv45w4kg84i5sywkfk44vj9wxkr7f1vga2mpz86j8vq25iy"
-    else if stdenv.system == "i686-linux" then "1y7i9p7fs23ksv8qhcb5gxlrm0wxs090jvdm58war13bg9656fvj"
+    else if stdenv.system == "i686-linux" then "10ml1wclix9236zcb4mh60hdm9vvfaarlb62z7fdrwk6ikqbm7fk"
     else throw "Bittorrent Sync for: ${stdenv.system} not supported!";
 
   libPath = stdenv.lib.makeLibraryPath [ stdenv.gcc.libc ];
 in
 stdenv.mkDerivation rec {
   name = "btsync-${version}";
-  version = "1.3.93";
+  version = "1.3.94";
 
   src  = fetchurl {
     url  = "http://syncapp.bittorrent.com/${version}/btsync_${arch}-${version}.tar.gz";

pkgs/applications/networking/browsers/firefox/default.nix

@@ -17,14 +17,14 @@ assert stdenv.gcc ? libc && stdenv.gcc.libc != null;
 
 rec {
 
-  firefoxVersion = "29.0";
+  firefoxVersion = "29.0.1";
 
-  xulVersion = "29.0"; # this attribute is used by other packages
+  xulVersion = "29.0.1"; # this attribute is used by other packages
 
 
   src = fetchurl {
     url = "http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${firefoxVersion}/source/firefox-${firefoxVersion}.source.tar.bz2";
-    sha1 = "db8fa9a4863bd7427115adec01b7db0e494dffa6";
+    sha1 = "2819ef63403de2bcfff5496bd21a3b8cb5dfce82";
   };
 
   commonConfigureFlags =

pkgs/applications/virtualization/qemu/cve-2014-2894.patch

@@ -1,14 +0,0 @@
-
-diff --git a/hw/ide/core.c b/hw/ide/core.c
-index e1dfe54..c943a4d 100644
---- a/hw/ide/core.c
-+++ b/hw/ide/core.c
-@@ -1602,7 +1602,7 @@ static bool cmd_smart(IDEState *s, uint8_t cmd)
-         case 2: /* extended self test */
-             s->smart_selftest_count++;
-             if (s->smart_selftest_count > 21) {
--                s->smart_selftest_count = 0;
-+                s->smart_selftest_count = 1;
-             }
-             n = 2 + (s->smart_selftest_count - 1) * 24;
-             s->smart_selftest_data[n] = s->sector;

pkgs/applications/virtualization/qemu/default.nix

@@ -7,17 +7,17 @@
 , x86Only ? false
 }:
 
-let n = "qemu-1.7.1"; in
+let n = "qemu-2.0.0"; in
 
 stdenv.mkDerivation rec {
   name = n + (if x86Only then "-x86-only" else "");
 
   src = fetchurl {
     url = "http://wiki.qemu.org/download/${n}.tar.bz2";
-    sha256 = "1x5y06zhp0gc97g1sb98vf7dkawg63xywv0mbnpfnbi20jh452fn";
+    sha256 = "0frsahiw56jr4cqr9m6s383lyj4ar9hfs2wp3y4yr76krah1mk30";
   };
 
-  patches = [ ./cve-2014-0150.patch ./cve-2014-2894.patch ];
+  patches = [ ./cve-2014-0150.patch ];
 
   buildInputs =
     [ python zlib pkgconfig glib ncurses perl pixman attr libcap

pkgs/build-support/vm/default.nix

@@ -1385,7 +1385,7 @@ rec {
           })
           (fetchurl {
             url = mirror://ubuntu/dists/quantal/universe/binary-i386/Packages.bz2;
-            sha256 = "323036e81c8bf409f71d3bc5cf37cfba72fe1d0fc82e9b5418d4d0cb516646e1";
+            sha256 = "9933ce12e7830b9c68a4aead08b86fcbb8d6ef0ea1fd133f0cf9d7126ad8c9bd";
           })
         ];
       urlPrefix = mirror://ubuntu;
@@ -1402,7 +1402,7 @@ rec {
           })
           (fetchurl {
             url = mirror://ubuntu/dists/quantal/universe/binary-amd64/Packages.bz2;
-            sha256 = "c762bd4ed063326577a62ff783cf9720e772b03d4a2aa38048918ee6287b96ce";
+            sha256 = "329a98312248c98092f8b91f232fc68fd3e6e2337ea4f348b3785465ae8dae17";
           })
         ];
       urlPrefix = mirror://ubuntu;
@@ -1419,7 +1419,7 @@ rec {
           })
           (fetchurl {
             url = mirror://ubuntu/dists/raring/universe/binary-i386/Packages.bz2;
-            sha256 = "1db19982fc3689b00a918e2cdbb936dfccebbac2ed82f81bb0164a3d51039012";
+            sha256 = "c1a59dd9132654194f4470932fd0f1582496465d8f96909b22accaf9f404024a";
           })
         ];
       urlPrefix = mirror://ubuntu;
@@ -1436,7 +1436,7 @@ rec {
           })
           (fetchurl {
             url = mirror://ubuntu/dists/raring/universe/binary-amd64/Packages.bz2;
-            sha256 = "0caf561bad359e8a82a987a076c0f1cb7a43412a5de053c105b160477c192978";
+            sha256 = "8aba137ae18540a12de03a564c11496431a150ab2d4d1e93e2b4b691fa2a4850";
           })
         ];
       urlPrefix = mirror://ubuntu;
@@ -1453,7 +1453,7 @@ rec {
           })
           (fetchurl {
             url = mirror://ubuntu/dists/saucy/universe/binary-i386/Packages.bz2;
-            sha256 = "84ff81ef23bcece68bfc3dd4b0b1fd38e5b81ac90ad48b4e4210396b425da500";
+            sha256 = "897f64c19a742ac8524c17c1b5ec31b33ec8ab20c85463010d8bf04f5d14aa0f";
           })
         ];
       urlPrefix = mirror://ubuntu;
@@ -1470,7 +1470,7 @@ rec {
           })
           (fetchurl {
             url = mirror://ubuntu/dists/saucy/universe/binary-amd64/Packages.bz2;
-            sha256 = "06ec77f2f5d6ee70ffb805affe3a6b3e8d5b6463fbfe42ba6588295c7e1f65bc";
+            sha256 = "a899ce5513ce8540ce9b8da4c1cd85b16b231900881b3aa559f7ac3182cdbfc8";
           })
         ];
       urlPrefix = mirror://ubuntu;
@@ -1483,11 +1483,11 @@ rec {
       packagesLists =
         [ (fetchurl {
             url = mirror://ubuntu/dists/trusty/main/binary-i386/Packages.bz2;
-            sha256 = "1bld2z47cc8adlqgfib1hypj5zwdqalhizzgpmkr3rmmb095lbma";
+            sha256 = "fdfc38663915c5cef3029872deb8c3bf52b98092073058086e2f1db0c71ebeb4";
           })
           (fetchurl {
             url = mirror://ubuntu/dists/trusty/universe/binary-i386/Packages.bz2;
-            sha256 = "03xqi9vd653hdf31a2l6p3zqfmywwvwlsc54dymxji8ppj7mcgkz";
+            sha256 = "2afcf259332d88c5e02f5446c4926edd567ef1a00ce24ca7cb400cbf44e2a90f";
           })
         ];
       urlPrefix = mirror://ubuntu;
@@ -1500,11 +1500,11 @@ rec {
       packagesList =
         [ (fetchurl {
             url = mirror://ubuntu/dists/trusty/main/binary-amd64/Packages.bz2;
-            sha256 = "11cw9flmnq3wappmwk87h19jzyrsan15h6p0mmb30ypnrqaz7g9j";
+            sha256 = "7095917eb8e4ac9161bc3b2ceeaf86e9265aae7b855a0e15d72096ecb05f1fc2";
           })
           (fetchurl {
             url = mirror://ubuntu/dists/trusty/universe/binary-amd64/Packages.bz2;
-            sha256 = "06nn3ci8s7zgwharxm76bcbqmnqknpds67zffylyii5hgmbjcnxm";
+            sha256 = "558637eeb8e340b871653e2060effe36e064677eca4eae62d9e4138dd402a610";
           })
         ];
       urlPrefix = mirror://ubuntu;