Fixes a regression introduced in
824d46a2fe.
* doc/build.scm (stylized-html)[build]: Avoid double leading slash for
‘language-picker.svg’.
Change-Id: I0817949862f061dbbe04352bda1e479347015c84
This is useful when testing changes locally, so that CSS links point to
the right place.
* doc/build.scm (%web-site-url): Default to /.
(%manual-css-url): Honor ‘%web-site-url’.
Change-Id: I8d885eba0fb8560dd7da7f21629c716a06c16b1f
* doc/contributing.texi (Bulk Updates): Capitalize title. Leave two
spaces after end-of-sentence period. Use @dots{} instead of showing
full store file names, as per ‘assert-no-store-file-names’ target.
Fix typo.
Change-Id: Iceb0079ec35fda95280afff1c0d4b2cd84717b96
Previously, the builder of a fixed-output derivation could communicate with an
external process via an abstract Unix-domain socket. In particular, it could
send an open file descriptor to the store, granting write access to some of
its output files in the store provided the derivation build fails—the fix for
CVE-2024-27297 did not address this specific case. It could also send an open
file descriptor to a setuid program, which could then be executed using
execveat to gain the privileges of the build user.
With this change, fixed-output derivations other than “builtin:download”
and “builtin:git-download” always run in a separate network namespace
and have network access provided by a TAP device backed by slirp4netns,
thereby closing the abstract Unix-domain socket channel.
* nix/libstore/globals.hh (Settings)[useHostLoopback, slirp4netns]: new
fields.
* config-daemon.ac (SLIRP4NETNS): new C preprocessor definition.
* nix/libstore/globals.cc (Settings::Settings): initialize them to defaults.
* nix/nix-daemon/guix-daemon.cc (options): add --isolate-host-loopback option.
* doc/guix.texi: document it.
* nix/libstore/build.cc (DerivationGoal)[slirp]: New field.
(setupTap, setupTapAction, waitForSlirpReadyAction, enableRouteLocalnetAction,
prepareSlirpChrootAction, spawnSlirp4netns, haveGlobalIPv6Address,
remapIdsTo0Action): New functions.
(initializeUserNamespace): allow the guest UID and GID to be specified.
(DerivationGoal::killChild): When ‘slirp’ is not -1, call ‘kill’.
(DerivationGoal::startBuilder): Unconditionally add CLONE_NEWNET to FLAGS.
When ‘fixedOutput’ is true, spawn ‘slirp4netns’.
When ‘fixedOutput’ and ‘useChroot’ are true, add setupTapAction,
waitForSlirpReadyAction, and enableRouteLocalnetAction to builder setup
phases.
Create a /etc/resolv.conf for fixed-output derivations that directs them to
slirp4netns's dns address.
When settings.useHostLoopback is true, supply fixed-output derivations with a
/etc/hosts that resolves "localhost" to slirp4netns's address for accessing
the host loopback.
* nix/libutil/util.cc (keepOnExec, decodeOctalEscaped, sendFD, receiveFD,
findProgram): New functions.
* nix/libutil/util.hh (keepOnExec, decodeOctalEscaped, sendFD, receiveFD,
findProgram): New declarations.
* gnu/packages/package-management.scm (guix): add slirp4netns input for linux
targets.
* tests/derivations.scm (builder-network-isolated?): new variable.
("fixed-output derivation, network access, localhost", "fixed-output
derivation, network access, external host"):
skip test case if fixed output derivations are isolated from the network.
Change-Id: Ia3fea2ab7add56df66800071cf15cdafe7bfab96
Signed-off-by: John Kehayias <john.kehayias@protonmail.com>
* doc/contributing.texi (Submitting Patches): Describe the two options,
Codeberg and Debbugs.
(Sending a Patch Series): Add deprecation warning.
(The Issue Tracker): Mention Codeberg.
(Managing Patches and Branches): Remove initial reference to
guix-patches.
(Debbugs User Interfaces): Add deprecation warning.
(Reviewing the Work of Others): Mention pull request approval.
Change-Id: Ibf21e8923e555db1e14107ad87a65bf45f9f3fc3
* gnu/services/networking.scm (iwd-shepherd-service): Fix name and
mention “iwd” in ‘description’.
* doc/guix.texi (Networking Setup): Correct iwd’s name and add link.
Change-Id: I7605488f2018b8ac60664c6617a82f05ddadf6ec
* gnu/services/networking.scm (wpa-supplicant-configuration):
[requirement]: Deprecate, [shepherd-requirement]: New field,
[shepherd-provision]: Extract to a field. Add 'wireless-daemon to it.
* doc/guix.texi (Networking Setup): Document it.
Change-Id: Icc6fdd695e6e96ef168a085524989da639f77cd3
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This is a followup to commit 7bbc00ccf0315a68509cacd6a85e1ae8ae7f5e5d of
guix/artwork.git.
* doc/build.scm (%manual-css-url): New variable.
(%makeinfo-html-options): Use it instead of www.gnu.org/…/manual.css.
(stylized-html): Likewise for the default #:manual-css-url.
Change-Id: I20bd3866383f8cbb4984993c15dbab483a17f6c9
This allows running `make info` without having to run `make` first.
* doc/local.mk (%C%_guix_TEXINFOS): Add os-config-*.texi.
Change-Id: I1998bccc6fb13a74e992a3f23311ed0de4799e89
Signed-off-by: Ekaitz Zarraga <ekaitz@elenq.tech>
* doc/guix.texi (mpv Media Player): Use the more common usage [0].
[0] https://english.stackexchange.com/a/35433
Change-Id: I5c10d281441c2995849df880dbaf62a790d2ff78
* gnu/services.scm (vte-integration-service-type): New service type.
* doc/guix.texi (Service Reference): Document it.
Change-Id: I7e4bc1b913b50a5a061894f9ddef27f1877b62a2
This factorizes out the remaining bashrc bits from /etc/skel/.bashrc to a the
template used for both /etc/bashrc on Guix System and ~/.bashrc for
home-bash-service-type.
Rationale: The use of /etc/skel introduce state: the file is only copied
originally when the user account is created, and never (automatically)
refreshed again.
* gnu/system.scm (operating-system-etc-service):
<profile>: Guard against souring /etc/bashrc in non-interactive, SSH case.
<bashrc>: Use %default-bashrc, having migrated the remaining definitions to...
* gnu/system/shadow.scm (%default-bashrc): ... here. Factorize aliases to...
* gnu/services.scm (%default-bash-aliases): ... here.
(%default-bashrc-d-aliases): New variable.
(%default-etc-bashrc-d-files): Include it in the default configuration.
* gnu/services/base.scm (%base-services): Register etc-bashrc-d-service-type.
* gnu/home/services/shells.scm (add-bash-configuration): Do not set PS1, now
part of %default-bashrc.
(home-bash-configuration) [guix-defaults?]: Update doc.
[aliases]: Set %default-bash-aliases as the default value. Update doc.
* doc/guix.texi (Shells Home Services): Update documentation.
(Service Reference): Update example.
Change-Id: I340c614983a78fd20a9c4a9705e7fc542ae9b513
* gnu/services.scm (files->bashrc-d-directory) New procedure.
(etc-bashrc-d-service-type): New service type.
* doc/guix.texi (Service Reference): Document it.
* gnu/tests/base.scm (test-basic-os): Test it.
Change-Id: Ibbb0f684de7aee296adedbce5b1192786d661af2
* gnu/services.scm (make-files->etc-directory)
(files->profile-d-entries): New procedures.
(etc-profile-d-service-type): New service type.
* doc/guix.texi (Service Reference): Document it.
* gnu/tests/base.scm (run-basic-test): Test it.
Change-Id: I45dde43a1b9603c3384b933ebd1d6e45dba146b9
* guix/scripts/refresh.scm (update-specification->update-spec): Flag the
update-spec as partial when it is prefixed with '~'.
* tests/guix-refresh.sh: Test it. Remove extraneous 'guix refresh'
invocation.
* doc/guix.texi (Invoking guix refresh): Document it.
Change-Id: Iab4482d9367105f6ffcd2d6a49148736c93d53e4
Reviewed-by: Florian Pelz <pelzflorian@pelzflorian.de>
Reviewed-by: Ludovic Courtès <ludo@gnu.org>
