5ec159bbf5
WIP: networkmanager: restrict (using systemd options)
2024-06-03 13:05:51 +00:00
f6725f60b9
networkmanager: re-introduce my polkit patches
2024-06-03 13:04:48 +00:00
2f1592376d
document more sandbox limitations
2024-06-03 11:59:44 +00:00
42fed64b75
NetworkManager: split specific config options out of my main net/default.nix file
2024-06-03 11:24:38 +00:00
682143d47f
NetworkManager: 1.46.0 -> 1.48.0
...
mostly so i can review the PR and get this update mainlined sooner :)
2024-06-03 11:23:33 +00:00
1448cb4444
sane-reboot: fix operation on servo
2024-06-03 09:33:35 +00:00
2d07ff966b
health-check: mention failed systemd services
2024-06-03 09:30:02 +00:00
83404f6769
nixos/networkmanager patch: grab via PR
2024-06-03 07:49:53 +00:00
c6bb6e2e3c
megapixels-next: fix broken eval of metadata
2024-06-03 05:35:09 +00:00
9d109644b7
nixpkgs: 2024-06-01 -> 2024-06-03; sops-nix -> 2024-06-02
...
```
• Updated input 'nixpkgs-next-unpatched':
'github:nixos/nixpkgs/f7de25c01e4c073c06e0525226a0c2311d530cee' (2024-06-01)
→ 'github:nixos/nixpkgs/c987c730bbf2121264ebd68921b443db5bb28543' (2024-06-03)
• Updated input 'nixpkgs-unpatched':
'github:nixos/nixpkgs/61c1d282153dbfcb5fe413c228d172d0fe7c2a7e' (2024-06-01)
→ 'github:nixos/nixpkgs/77a51024c0f953d503eb3ed364aa4bff378649f8' (2024-06-03)
• Updated input 'sops-nix':
'github:Mic92/sops-nix/962797a8d7f15ed7033031731d0bb77244839960' (2024-05-26)
→ 'github:Mic92/sops-nix/ab2a43b0d21d1d37d4d5726a892f714eaeb4b075' (2024-06-02)
• Updated input 'sops-nix/nixpkgs-stable':
'github:NixOS/nixpkgs/59a450646ec8ee0397f5fa54a08573e8240eb91f' (2024-05-25)
→ 'github:NixOS/nixpkgs/3b1b4895b2c5f9f5544d02132896aeb9ceea77bc' (2024-06-01)
```
2024-06-03 05:31:28 +00:00
0050403b31
scripts: add an update helper
...
someday i can extend this for updating packages and feeds too
2024-06-03 05:30:03 +00:00
e4bcbab224
hosts: networking: switch to using nixos NetworkManager/ModemManager/etc, just patched for hardening
2024-06-02 11:22:03 +00:00
1b85aa0441
networkmanager/modemmanager: get closer to nixpkgs upstream
...
i've seen enough, that there's a path toward getting nixos proper to sandbox this in a way i'm happy with -- in time
2024-06-02 08:56:38 +00:00
f5e5d1bcc4
networkmanager: fix polkit integrations when running not as root
...
now nmcli/etc work
2024-06-02 05:10:11 +00:00
30d41f82f2
refactor: networkmanager: use substitute instead of sed when patching
2024-06-01 22:16:18 +00:00
62dbad3486
polyunfill: remove a few more default systemPackages
2024-06-01 21:06:40 +00:00
4287ecf0ed
polyfill: don't ship unused mtools package
2024-06-01 20:15:04 +00:00
b13ca92b72
polyfill: remove boot.{enableContainers,bcache}
2024-06-01 20:14:49 +00:00
45e121eb1c
make-sandboxed: preserve meta.mainProgram
2024-06-01 20:01:24 +00:00
53bbd611da
nixpkgs-review: persist the ~/.cache/nixpkgs-review directory
2024-06-01 17:15:54 +00:00
f0128b9496
apply patch for when trust-dns is renamed to hickory-dns
2024-06-01 17:07:44 +00:00
368169d48d
todo.md: start documenting sudo issues
2024-06-01 17:06:36 +00:00
cb1d5d53c6
feeds: add mintcast podcast
2024-06-01 16:28:42 +00:00
a5a635f00b
sftpgo: simplify my package override now that sftpgo 2.6.0 is merged
2024-06-01 16:22:22 +00:00
6fe3d26b30
modemmanager: fix missing mmcli binary in service definition
2024-06-01 15:41:14 +00:00
8340cf059f
nixpkgs-review: fix sandboxing
2024-06-01 15:26:23 +00:00
e0da3ece60
errno: simplify
2024-06-01 14:48:55 +00:00
8ea379d53b
errno: ship on all platforms
2024-06-01 14:04:45 +00:00
c7dd49af91
errno: fix cross compilation by not building *all* of moreutils
2024-06-01 14:03:59 +00:00
e8b900c722
todo.md: add media looping controls
2024-06-01 13:37:51 +00:00
36f4fa3018
checkSandboxed: fix so that cross-built scripts can be checked again
...
how did this work earlier? does lappy have binfmt enabled??
2024-06-01 13:24:41 +00:00
d8d11de9bc
sftpgo: replace deprecated "crypt" with "passlib"
2024-06-01 13:01:19 +00:00
07194d062a
servo: nfs: disable
2024-06-01 12:45:10 +00:00
24c49df75f
health-check: add a check that ftp://uninsane.org is operational
2024-06-01 12:42:53 +00:00
9f7e143d5e
todo.md: add some kernel work to be done
2024-06-01 12:38:28 +00:00
0a382ae8a3
todo.md: remove completed "landlock sandboxer prints garbage" item
2024-06-01 12:35:46 +00:00
96f177ceb2
docs: overlays/cross: slightly tidy up the "outstanding issues" part
2024-06-01 12:24:00 +00:00
2aa3fa35b8
nixpkgs: 2024-05-31 -> 2024-06-01; nixpkgs-wayland -> 2024-05-31
...
```
• Updated input 'nixpkgs-next-unpatched':
'github:nixos/nixpkgs/8a0a33b56d6279fec4827da602882561ef00f2fb' (2024-05-31)
→ 'github:nixos/nixpkgs/f7de25c01e4c073c06e0525226a0c2311d530cee' (2024-06-01)
• Updated input 'nixpkgs-unpatched':
'github:nixos/nixpkgs/7ccd1516effbc5510391d3b498a7a3bef92a090b' (2024-05-31)
→ 'github:nixos/nixpkgs/61c1d282153dbfcb5fe413c228d172d0fe7c2a7e' (2024-06-01)
• Updated input 'nixpkgs-wayland':
'github:nix-community/nixpkgs-wayland/1db9b79a45c8e346e03480767e6d9749fabfaf10' (2024-05-31)
→ 'github:nix-community/nixpkgs-wayland/93b225ddba91179248b378913a91defbc6aeb899' (2024-05-31)
```
2024-06-01 12:20:45 +00:00
8657cf1fcf
ship ausyscall binary
2024-06-01 12:17:08 +00:00
f875db916d
sandboxing: fix checkSandboxed to handle packages with multiple outputs
2024-06-01 12:12:46 +00:00
e3e86a43a9
brightnessctl: disable unused dbus access
2024-06-01 12:09:51 +00:00
05986d363d
brightnessctl: fix udev rules so i can run it again
2024-06-01 12:02:24 +00:00
539d9e45a2
networkmanager/modemmanager: ship separate packages for the daemon and CLI tools
...
they require fundamentally different sandboxing approaches. the daemon *can't* always use bwrap if it wants to run as non-root. meanwhile the CLI tools would mostly *prefer* to run under bwrap.
in the long term i'll maybe upstream the systemd sandboxing into nixpkgs, where there looks to be desire for it
2024-05-31 23:26:16 +00:00
a380bd04c4
trivial-builders: init deepLinkIntoOwnPackage
2024-05-31 23:26:16 +00:00
f296d8df93
make-sandboxed: fix multi-output packages and sandbox *all* their outputs
...
this mostly applies to the wrapperType = 'inplace' users
2024-05-31 23:26:16 +00:00
326bf045b0
networkmanager/wpa_supplicant: switch user back to "networkmanager"
...
root gives too much power, even with bwrap/namespaces
2024-05-31 23:26:16 +00:00
a1181a10ea
networkmanager: install parallel dbus .conf files to allow the services to be run as *either* networkmanager or root user (hopefully!)
2024-05-31 23:26:16 +00:00
9bb6a903bb
wpa_supplicant: get it to run under bwrap
2024-05-31 23:26:16 +00:00
214f963d89
networkmanager: run all services as root instead of networkmanager user
...
i believe this may allow using bwrap instead of landlock
2024-05-31 23:26:16 +00:00
c7eb4b66a5
polyunfill: remove unused su and sg security wrappers
2024-05-31 14:59:23 +00:00
