History

Robert Obryk e3550208de nixos/security/wrappers: read capabilities off /proc/self/exe directly /proc/self/exe is a "fake" symlink. When it's opened, it always opens the actual file that was execve()d in this process, even if the file was deleted or renamed; if the file is no longer accessible from the current chroot/mount namespace it will at the very worst fail and never open the wrong file. Thus, we can make a much simpler argument that we're reading capabilities off the correct file after this change (and that argument doesn't rely on things such as protected_hardlinks being enabled, or no users being able to write to /run/wrappers, or the verification that the path readlink returns starts with /run/wrappers/).		2023-08-27 14:10:38 +02:00
..
doc/manual	pass: stop installing password-store.el	2023-08-25 12:33:54 +08:00
lib	Merge pull request #250248 from Artturin/onlylimiti686	2023-08-20 11:26:28 +02:00
maintainers	nixos/amazon-image: embiggen	2023-06-07 08:42:47 +03:00
modules	nixos/security/wrappers: read capabilities off /proc/self/exe directly	2023-08-27 14:10:38 +02:00
tests	nixos/security/wrappers: stop using `.real` files	2023-08-27 14:10:36 +02:00
COPYING
default.nix
README.md	CONTRIBUTING.md: Move boot loader-specific sentence to pkgs/README.md	2023-08-14 19:50:02 +02:00
release-combined.nix	nixos/release-*: finish dropping the conntrack tests	2023-03-04 09:28:09 +01:00
release-small.nix	Merge pull request #209870 from amjoseph-nixpkgs/pr/stdenv/external-gcc-bootstrap	2023-04-03 08:19:03 -07:00
release.nix	nixos/doc: Improve documentation of documentation	2023-08-12 22:28:04 +03:00

README.md

NixOS

NixOS is a Linux distribution based on the purely functional package management system Nix. More information can be found at https://nixos.org/nixos and in the manual in doc/manual.

Testing changes

You can add new module to your NixOS configuration file (usually it’s /etc/nixos/configuration.nix). And do sudo nixos-rebuild test -I nixpkgs=<path to your local nixpkgs folder> --fast.

Reviewing contributions

When changing the bootloader installation process, extra care must be taken. Grub installations cannot be rolled back, hence changes may break people’s installations forever. For any non-trivial change to the bootloader please file a PR asking for review, especially from @edolstra.

Module updates

Module updates are submissions changing modules in some ways. These often contains changes to the options or introduce new options.

Reviewing process:

Ensure that the module maintainers are notified.
- CODEOWNERS will make GitHub notify users based on the submitted changes, but it can happen that it misses some of the package maintainers.
Ensure that the module tests, if any, are succeeding.
Ensure that the introduced options are correct.
- Type should be appropriate (string related types differs in their merging capabilities, loaOf and string types are deprecated).
- Description, default and example should be provided.
Ensure that option changes are backward compatible.
- mkRenamedOptionModuleWith provides a way to make option changes backward compatible.
Ensure that removed options are declared with mkRemovedOptionModule
Ensure that changes that are not backward compatible are mentioned in release notes.
Ensure that documentations affected by the change is updated.

Sample template for a module update review is provided below.

##### Reviewed points

- [ ] changes are backward compatible
- [ ] removed options are declared with `mkRemovedOptionModule`
- [ ] changes that are not backward compatible are documented in release notes
- [ ] module tests succeed on ARCHITECTURE
- [ ] options types are appropriate
- [ ] options description is set
- [ ] options example is provided
- [ ] documentation affected by the changes is updated

##### Possible improvements

##### Comments

New modules

New modules submissions introduce a new module to NixOS.