Merge remote-tracking branch 'upstream/master' into hardened-stdenv

nixos/modules/system/activation/activation-script.nix

@@ -12,7 +12,8 @@ let
     '';
   });
 
-  path =
+  path = map # outputs TODO?
+    (pkg: (pkg.bin or (pkg.out or pkg)))
     [ pkgs.coreutils pkgs.gnugrep pkgs.findutils
       pkgs.glibc # needed for getent
       pkgs.shadow

nixos/modules/system/boot/coredump.nix

@@ -50,6 +50,11 @@ with lib;
 
     (mkIf (!config.systemd.coredump.enable) {
       boot.kernel.sysctl."kernel.core_pattern" = mkDefault "core";
+
+      systemd.extraConfig =
+        ''
+          DefaultLimitCORE=0:infinity
+        '';
     })
   ];
 

nixos/modules/system/boot/loader/grub/grub.nix

@@ -55,10 +55,10 @@ let
         version extraConfig extraPerEntryConfig extraEntries
         extraEntriesBeforeNixOS extraPrepareConfig configurationLimit copyKernels timeout
         default fsIdentifier efiSupport gfxmodeEfi gfxmodeBios;
-      path = (makeSearchPath "bin" ([
+      path = (makeBinPath ([
         pkgs.coreutils pkgs.gnused pkgs.gnugrep pkgs.findutils pkgs.diffutils pkgs.btrfs-progs
         pkgs.utillinux ] ++ (if cfg.efiSupport && (cfg.version == 2) then [pkgs.efibootmgr ] else [])
-      )) + ":" + (makeSearchPath "sbin" [
+      )) + ":" + (makeSearchPathOutputs "sbin" ["bin"] [
         pkgs.mdadm pkgs.utillinux
       ]);
     });

nixos/modules/system/boot/luksroot.nix

@@ -436,9 +436,9 @@ in
       ${optionalString luks.yubikeySupport ''
         copy_bin_and_libs ${pkgs.ykpers}/bin/ykchalresp
         copy_bin_and_libs ${pkgs.ykpers}/bin/ykinfo
-        copy_bin_and_libs ${pkgs.openssl}/bin/openssl
+        copy_bin_and_libs ${pkgs.openssl.bin}/bin/openssl
 
-        cc -O3 -I${pkgs.openssl}/include -L${pkgs.openssl}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
+        cc -O3 -I${pkgs.openssl}/include -L${pkgs.openssl.out}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
         strip -s pbkdf2-sha512
         copy_bin_and_libs pbkdf2-sha512
 

nixos/modules/system/boot/stage-1.nix

@@ -31,7 +31,6 @@ let
   extraUtils = pkgs.runCommand "extra-utils"
     { buildInputs = [pkgs.nukeReferences];
       allowedReferences = [ "out" ]; # prevent accidents like glibc being included in the initrd
-      doublePatchelf = pkgs.stdenv.isArm;
     }
     ''
       set +o pipefail
@@ -80,7 +79,7 @@ let
       ${config.boot.initrd.extraUtilsCommands}
 
       # Copy ld manually since it isn't detected correctly
-      cp -pv ${pkgs.glibc}/lib/ld*.so.? $out/lib
+      cp -pv ${pkgs.glibc.out}/lib/ld*.so.? $out/lib
 
       # Copy all of the needed libraries for the binaries
       for BIN in $(find $out/{bin,sbin} -type f); do
@@ -111,9 +110,6 @@ let
           if ! test -L $i; then
               echo "patching $i..."
               patchelf --set-interpreter $out/lib/ld*.so.? --set-rpath $out/lib $i || true
-              if [ -n "$doublePatchelf" ]; then
-                  patchelf --set-interpreter $out/lib/ld*.so.? --set-rpath $out/lib $i || true
-              fi
           fi
       done
 

nixos/modules/system/boot/stage-2.nix

@@ -7,11 +7,14 @@ let
   kernel = config.boot.kernelPackages.kernel;
   activateConfiguration = config.system.activationScripts.script;
 
-  readonlyMountpoint = pkgs.runCommand "readonly-mountpoint" {} ''
-    mkdir -p $out/bin
-    cc -O3 ${./readonly-mountpoint.c} -o $out/bin/readonly-mountpoint
-    strip -s $out/bin/readonly-mountpoint
-  '';
+  readonlyMountpoint = pkgs.stdenv.mkDerivation {
+    name = "readonly-mountpoint";
+    unpackPhase = "true";
+    installPhase = ''
+      mkdir -p $out/bin
+      cc -O3 ${./readonly-mountpoint.c} -o $out/bin/readonly-mountpoint
+    '';
+  };
 
   bootStage2 = pkgs.substituteAll {
     src = ./stage-2-init.sh;

nixos/modules/system/boot/systemd-unit-options.nix

@@ -193,7 +193,7 @@ in rec {
 
     path = mkOption {
       default = [];
-      apply = ps: "${makeSearchPath "bin" ps}:${makeSearchPath "sbin" ps}";
+      apply = ps: "${makeBinPath ps}:${makeSearchPathOutputs "sbin" ["bin"] ps}";
       description = ''
         Packages added to the service's <envar>PATH</envar>
         environment variable.  Both the <filename>bin</filename>

nixos/modules/system/boot/systemd.nix

@@ -472,6 +472,13 @@ in
       '';
     };
 
+    systemd.generator-packages = mkOption {
+      default = [];
+      type = types.listOf types.package;
+      example = literalExample "[ pkgs.systemd-cryptsetup-generator ]";
+      description = "Packages providing systemd generators.";
+    };
+
     systemd.defaultUnit = mkOption {
       default = "multi-user.target";
       type = types.str;
@@ -628,7 +635,18 @@ in
 
     environment.systemPackages = [ systemd ];
 
-    environment.etc = {
+    environment.etc = let
+      # generate contents for /etc/systemd/system-generators from
+      # systemd.generators and systemd.generator-packages
+      generators = pkgs.runCommand "system-generators" { packages = cfg.generator-packages; } ''
+        mkdir -p $out
+        for package in $packages
+        do
+          ln -s $package/lib/systemd/system-generators/* $out/
+        done;
+        ${concatStrings (mapAttrsToList (generator: target: "ln -s ${target} $out/${generator};\n") cfg.generators)}
+      '';
+    in ({
       "systemd/system".source = generateUnits "system" cfg.units upstreamSystemUnits upstreamSystemWants;
 
       "systemd/user".source = generateUnits "user" cfg.user.units upstreamUserUnits [];
@@ -667,7 +685,9 @@ in
 
         ${concatStringsSep "\n" cfg.tmpfiles.rules}
       '';
-    } // mapAttrs' (n: v: nameValuePair "systemd/system-generators/${n}" {"source"=v;}) cfg.generators;
+
+      "systemd/system-generators" = { source = generators; };
+    });
 
     system.activationScripts.systemd = stringAfter [ "groups" ]
       ''