From 58040d58ae21e377cf1a54a1361731febf329ce1 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Tue, 23 Nov 2021 01:28:43 +0300 Subject: [PATCH 1/3] nixos/nginx: tengine requires allowing @ipc calls (cherry picked from commit 7376f4e34f85cd2ad9bb0c0c1caf75c1afb78fd0) --- nixos/modules/services/web-servers/nginx/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 3c927246b2c4..c5c26782ce1f 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -907,7 +907,7 @@ in PrivateMounts = true; # System Call Filtering SystemCallArchitectures = "native"; - SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid"; + SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ]; }; }; From c3dc2e2c0766a1fcfb154d0055435a06e192c025 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 7 Mar 2022 23:28:43 +0300 Subject: [PATCH 2/3] nginxModules: add option disableIPC The disableIPC option is required to checking enabled nginxModules and disable the SystemCallFilter IPC filter. (cherry picked from commit b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b) --- nixos/modules/services/web-servers/nginx/default.nix | 3 ++- pkgs/servers/http/nginx/modules.nix | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index c5c26782ce1f..1de8665c65b7 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -907,7 +907,8 @@ in PrivateMounts = true; # System Call Filtering SystemCallArchitectures = "native"; - SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ]; + SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] + ++ optionals ((cfg.package != pkgs.tengine) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ]; }; }; diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix index 3a234009f3e2..b4f0fe1a5a41 100644 --- a/pkgs/servers/http/nginx/modules.nix +++ b/pkgs/servers/http/nginx/modules.nix @@ -213,6 +213,7 @@ in sha256 = "sha256-UXiitc3jZlgXlCsDPS+xEFLNRVgRbn8BCCXUEqAWlII="; }; inputs = [ pkgs.curl pkgs.geoip pkgs.libmodsecurity pkgs.libxml2 pkgs.lmdb pkgs.yajl ]; + disableIPC = true; }; moreheaders = { From b9f98896e7c1b1a287c8fda9d550e4d1d829cb99 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sun, 17 Apr 2022 17:33:24 +0200 Subject: [PATCH 3/3] franz: 5.6.1 -> 5.9.2 (cherry picked from commit 5799e2580d4516c616bbf478090098ea1d6a6903) --- .../networking/instant-messengers/franz/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix index 9f772bf3f6d7..b3d9194c6fe4 100644 --- a/pkgs/applications/networking/instant-messengers/franz/default.nix +++ b/pkgs/applications/networking/instant-messengers/franz/default.nix @@ -3,10 +3,10 @@ mkFranzDerivation rec { pname = "franz"; name = "Franz"; - version = "5.6.1"; + version = "5.9.2"; src = fetchurl { url = "https://github.com/meetfranz/franz/releases/download/v${version}/franz_${version}_amd64.deb"; - sha256 = "1gn0n1hr6z2gsdnpxysyq6sm8y7cjr9jafhsam8ffw0bq74kph7p"; + sha256 = "sha256-W/60g5CbSUZcNASjdbiS7DNv9375GiesEG60QLLAh1g="; }; meta = with lib; { description = "A free messaging app that combines chat & messaging services into one application";