Commit Graph

23 Commits

Author SHA1 Message Date
nat
af65b87b23
nixos/malloc: add graphene-hardened-light 2024-04-18 23:19:46 +02:00
stuebinm
6afb255d97 nixos: remove all uses of lib.mdDoc
these changes were generated with nixq 0.0.2, by running

  nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix

two mentions of the mdDoc function remain in nixos/, both of which
are inside of comments.

Since lib.mdDoc is already defined as just id, this commit is a no-op as
far as Nix (and the built manual) is concerned.
2024-04-13 10:07:35 -07:00
Franz Pletz
cef068f3b3
Revert "nixos/malloc: add back maybe unnecessary line"
This reverts commit ed55524562.

Does not evaluate.
2023-08-10 03:02:39 +02:00
Artturin
ed55524562 nixos/malloc: add back maybe unnecessary line 2023-06-22 17:28:44 +03:00
Martino Fontana
e1a6c85c2b nixos/sysctl: raise default vm.max_map_count to 1048576 2023-06-21 19:25:42 +02:00
Alyssa Ross
ecc1ec2c72 llvmPackages_latest: move to aliases.nix
Because llvmPackages_latest is used in Nixpkgs, by quite a few
packages, it's difficult to keep it up to date, because updating it
requires some level of confidence that every package that uses it is
going to keep working after the update.  The result of this is that
llvmPackages_latest is not updated, and so we end up in the situation
that "latest" is two versions older than the latest version we
actually provide.  This is confusing and unexpected.

"But won't this end up fragmenting our LLVM versions, if every package
previously using _latest is separately pinned to LLVM 14?", I hear you
ask.  No.  That fragmentation is already happening, even with an
llvmPackages_latest, because packages that actually require the
_latest_ version of LLVM (15/16), have already been decoupled from
llvmPackages_latest since it hasn't been upgraded.  So like it or not,
we can't escape packages depending on specific recent LLVMs.  The only
real fix is to get better at keeping the default LLVM up to
date (which I'm reasonably confident we're getting into a better
position to be feasibly better able to do).

So, unless we want to double down on providing a confusingly named
"llvmPackages_latest" attribute that refers to some arbitrary LLVM
version that's probably not the latest one (or even the latest one
available in Nixpkgs), we only have two options here: either we don't
provide such an attribute at all, or we don't use it in Nixpkgs so we
don't become scared to bump it as soon as we have a new LLVM available.
2023-05-08 13:05:33 +00:00
enc0urage
a76bd96e4b nixos/malloc: set vm.max_map_count when using graphene-hardened 2023-03-28 10:18:20 +00:00
pennae
c915b915b5 nixos/*: md-convert options with unordered lists
mostly no rendering changes. some lists (like simplelist) don't have an
exact translation to markdown, so we use a comma-separated list of
literals instead.
2022-08-31 16:32:53 +02:00
06kellyjac
9ac11c0762 nixos/malloc: fix scudo on non-x86_64 machines 2021-10-29 19:56:17 +01:00
Sandro
bfc38d3d0d
Merge pull request #125966 from ju1m/apparmor 2021-09-21 22:10:10 +02:00
Mikael Voss
5437b17b8e
nixos/malloc: add mimalloc 2021-09-20 19:10:28 +02:00
Julien Moutinho
22e52be3b3 nixos/apparmor: allow closure of selected mallocLib, fixes #125415 2021-06-06 17:51:12 +02:00
Julien Moutinho
05d334cfe2 Revert "Revert "apparmor: fix and improve the service""
This reverts commit 420f89ceb2.
2021-04-23 07:17:55 +02:00
TredwellGit
fc6948cd47 nixos/malloc: fix Scudo
Fixes segmentation faults.
https://github.com/NixOS/nixpkgs/issues/100799
2020-11-17 09:11:31 -05:00
Vladimír Čunát
420f89ceb2
Revert "apparmor: fix and improve the service"
This reverts commit fb6d63f3fd.

I really hope this finally fixes #99236: evaluation on Hydra.
This time I really did check basically the same commit on Hydra:
https://hydra.nixos.org/eval/1618011

Right now I don't have energy to find what exactly is wrong in the
commit, and it doesn't seem important in comparison to nixos-unstable
channel being stuck on a commit over one week old.
2020-10-07 12:22:18 +02:00
Julien Moutinho
fb6d63f3fd apparmor: fix and improve the service 2020-09-06 07:43:03 +02:00
volth
08f68313a4 treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
volth
35d68ef143 treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
Joachim Fasting
44b6999614
nixos/malloc: use ld preload
This is more robust than setting via environment variable, though it does come
later in the load sequence.  An added benefit is affecting the current
session.
2019-07-04 19:24:40 +02:00
Pierre Bourdon
9e60eab8f5
nixos/malloc: apply allocator settings to systemd units
This uses systemd's system.conf/user.conf "DefaultEnvironment" feature
to set the allocator's LD_PRELOAD near-globally.
2019-05-30 12:07:34 +09:00
Pierre Bourdon
1cc8ea7cb4
nixos/malloc: add scudo from LLVM compiler-rt 2019-05-30 02:35:50 +09:00
Eelco Dolstra
de9e238469
FIx some malformed XML in option descriptions
E.g. these were using "<para>" at the *end* of a description. The real
WTF is that this is possible at all...
2019-05-13 09:15:17 +02:00
Joachim Fasting
a84be28270
nixos/malloc: configure system-wide malloc provider
Currently, this uses the somewhat crude method of setting LD_PRELOAD in the
system environment.  This works, but should be considered a stepping stone to
a more robust solution.
2019-05-07 13:45:38 +02:00