diff options
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/doc/manual/from_md/release-notes/rl-2205.section.xml | 11 | ||||
| -rw-r--r-- | nixos/doc/manual/release-notes/rl-2205.section.md | 4 | ||||
| -rw-r--r-- | nixos/modules/system/boot/networkd.nix | 4 | ||||
| -rw-r--r-- | nixos/modules/system/boot/stage-1-init.sh | 3 | ||||
| -rw-r--r-- | nixos/modules/system/boot/stage-1.nix | 20 | ||||
| -rw-r--r-- | nixos/modules/system/boot/timesyncd.nix | 22 |
6 files changed, 58 insertions, 6 deletions
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index 41b99c59054d2..a3316d37d971d 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -52,6 +52,11 @@ </listitem> <listitem> <para> + Systemd has been upgraded to the version 250. + </para> + </listitem> + <listitem> + <para> <link xlink:href="https://kops.sigs.k8s.io"><literal>kops</literal></link> defaults to 1.22.4, which will enable <link xlink:href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html">Instance @@ -398,6 +403,12 @@ </listitem> <listitem> <para> + <literal>openssh</literal> has been update to 8.9p1, changing + the FIDO security key middleware interface. + </para> + </listitem> + <listitem> + <para> <literal>services.k3s.enable</literal> no longer implies <literal>systemd.enableUnifiedCgroupHierarchy = false</literal>, and will default to the <quote>systemd</quote> cgroup driver diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index 3c4652ae5c464..5ee73d683d1d6 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -19,6 +19,8 @@ In addition to numerous new and upgraded packages, this release has the followin - systemd services can now set [systemd.services.\<name\>.reloadTriggers](#opt-systemd.services) instead of `reloadIfChanged` for a more granular distinction between reloads and restarts. +- Systemd has been upgraded to the version 250. + - [`kops`](https://kops.sigs.k8s.io) defaults to 1.22.4, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. This will increase security by default, but may break some types of workloads. See the [release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) for details. ## New Services {#sec-release-22.05-new-services} @@ -129,6 +131,8 @@ In addition to numerous new and upgraded packages, this release has the followin - `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading. +- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface. + - `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`. This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration. The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration. diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix index ac1e4ef34b46f..4444ce3363a10 100644 --- a/nixos/modules/system/boot/networkd.nix +++ b/nixos/modules/system/boot/networkd.nix @@ -281,6 +281,8 @@ let "PrivateKeyFile" "ListenPort" "FirewallMark" + "RouteTable" + "RouteMetric" ]) (assertInt "FirewallMark") (assertRange "FirewallMark" 1 4294967295) @@ -296,6 +298,8 @@ let "AllowedIPs" "Endpoint" "PersistentKeepalive" + "RouteTable" + "RouteMetric" ]) (assertInt "PersistentKeepalive") (assertRange "PersistentKeepalive" 0 65535) diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh index 8fcc1f029723e..3175836698091 100644 --- a/nixos/modules/system/boot/stage-1-init.sh +++ b/nixos/modules/system/boot/stage-1-init.sh @@ -232,7 +232,8 @@ done mkdir -p /lib ln -s @modulesClosure@/lib/modules /lib/modules ln -s @modulesClosure@/lib/firmware /lib/firmware -echo @extraUtils@/bin/modprobe > /proc/sys/kernel/modprobe +# see comment in stage-1.nix for explanation +echo @extraUtils@/bin/modprobe-kernel > /proc/sys/kernel/modprobe for i in @kernelModules@; do info "loading module $(basename $i)..." modprobe $i diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix index 1575c0257d1c6..c45857441c6ca 100644 --- a/nixos/modules/system/boot/stage-1.nix +++ b/nixos/modules/system/boot/stage-1.nix @@ -131,6 +131,26 @@ let copy_bin_and_libs ${pkgs.kmod}/bin/kmod ln -sf kmod $out/bin/modprobe + # Dirty hack to make sure the kernel properly loads modules + # such as ext4 on demand (e.g. on a `mount(2)` syscall). This is necessary + # because `kmod` isn't linked against `libpthread.so.0` anymore (since + # it was merged into `libc.so.6` since version `2.34`), but still needs + # to access it for some reason. This is not an issue in stage-1 itself + # because of the `LD_LIBRARY_PATH`-variable and anytime later because the rpath of + # kmod/modprobe points to glibc's `$out/lib` where `libpthread.so.6` exists. + # However, this is a problem when the kernel calls `modprobe` inside + # the initial ramdisk because it doesn't know about the + # `LD_LIBRARY_PATH` and the rpath was nuked. + # + # Also, we can't use `makeWrapper` here because `kmod` only does + # `modprobe` functionality if `argv[0] == "modprobe"`. + cat >$out/bin/modprobe-kernel <<EOF + #!$out/bin/ash + export LD_LIBRARY_PATH=$out/lib + exec $out/bin/modprobe "\$@" + EOF + chmod +x $out/bin/modprobe-kernel + # Copy resize2fs if any ext* filesystems are to be resized ${optionalString (any (fs: fs.autoResize && (lib.hasPrefix "ext" fs.fsType)) fileSystems) '' # We need mke2fs in the initrd. diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix index 5f35a15476965..6279957fcd63b 100644 --- a/nixos/modules/system/boot/timesyncd.nix +++ b/nixos/modules/system/boot/timesyncd.nix @@ -60,15 +60,27 @@ with lib; }; users.groups.systemd-timesync.gid = config.ids.gids.systemd-timesync; - system.activationScripts.systemd-timesyncd-migration = mkIf (versionOlder config.system.stateVersion "19.09") '' + system.activationScripts.systemd-timesyncd-migration = # workaround an issue of systemd-timesyncd not starting due to upstream systemd reverting their dynamic users changes # - https://github.com/NixOS/nixpkgs/pull/61321#issuecomment-492423742 # - https://github.com/systemd/systemd/issues/12131 - if [ -L /var/lib/systemd/timesync ]; then - rm /var/lib/systemd/timesync - mv /var/lib/private/systemd/timesync /var/lib/systemd/timesync + mkIf (versionOlder config.system.stateVersion "19.09") '' + if [ -L /var/lib/systemd/timesync ]; then + rm /var/lib/systemd/timesync + mv /var/lib/private/systemd/timesync /var/lib/systemd/timesync + fi + ''; + system.activationScripts.systemd-timesyncd-init-clock = + # Ensure that we have some stored time to prevent systemd-timesyncd to + # resort back to the fallback time. + # If the file doesn't exist we assume that our current system clock is + # good enough to provide an initial value. + '' + if ! [ -f /var/lib/systemd/timesync/clock ]; then + test -d /var/lib/systemd/timesync || mkdir -p /var/lib/systemd/timesync + touch /var/lib/systemd/timesync/clock fi - ''; + ''; }; } |