The PR that added this is only a few hours old (https://github.com/NixOS/nixpkgs/pull/399766) and hasn't had the chance to enter an unstable released, which is why I haven't added a rename flag.
fish no longer installs share/fish/tools/ and instead embeds the
script in the binary. Extract it via `status get-file` and replace
the patch that stripped the autogenerated header with an inline sed
plus a test that fails the build if the upstream header format
changes.
Without this, these integration scripts will mess with the prompt even
when not running a shell inside of foot. This can break:
1. Terminals that don't understand these sequences (e.g., gnome-terminal
and likely other vte based terminals).
2. Anything that tries to parse the prompt (Emacs packages like
bash-completion).
This patch relies on the TERM variable (against upstream's
recommendation [1]) because:
1. Only Fish [2] has built-in support for querying things like
XTVERSION. Querying terminal features manually is non-trivial and
requires writing to STDOUT, which I'd like to avoid.
2. Even in Fish, this XTVERSION may only be queried after the first
prompt has been displayed ([2]), which is too late.
This patch does not explicitly check if the terminal is interactive as
the modified files are only sourced by interactive shells anyway.
[1]: https://codeberg.org/dnkl/foot#programmatically-checking-if-running-in-foot
[2]: https://fishshell.com/docs/current/cmds/status.html#status-terminalfixes#374613
mouse-actions-gui is reliant on Tauri v1, which pulls in webkitgtk 4.0
and libsoup 2.4. The former has already been dropped, and the latter's
is imminent. It has been marked broken in Nixpkgs since October 2025.
GDM 50 falls back to launching `gnome-session` as the user session
command when the AccountsService record has `Session=` empty and
`services.displayManager.defaultSession` is unset. On a Niri-only
machine the spawn fails with ENOENT and the user is bounced back to
the greeter — an indefinite login loop after a fresh install or after
the AccountsService record gets reset.
GDM 49 hit the same fallback path but happened to find gnome-session
on PATH; the user's first session pick then got stashed in
AccountsService and subsequent logins worked. GDM 50's tighter
environment removed the accidental save.
Setting `services.displayManager.defaultSession = lib.mkDefault "niri"`
inside `programs.niri` makes a Niri-only install boot straight into
the compositor. Users running multiple session packages can still
override via a plain assignment.
Refs https://github.com/NixOS/nixpkgs/issues/523332
Writing a multi-line /proc/<pid>/[ug]id_map only requires
CAP_SETUID/CAP_SETGID over the parent user namespace, not full root.
shadow's own --with-fcaps install mode (70971457b761) sets exactly
cap_setuid+ep / cap_setgid+ep, and Arch, Fedora and Debian have shipped
these binaries with file capabilities instead of setuid for years.
The setuid variant already drops to the same single capability before
the uid_map write (see lib/idmapping.c), so the privilege at the point
attacker-controlled data reaches the kernel is unchanged. The reduction
is in the startup window: with file capabilities the process never has
euid 0 and never holds the full capability set during NSS lookups,
/etc/subuid parsing and /proc/<pid> opening.
The only functional difference is that mapping host uid 0 into a child
namespace additionally needs CAP_SETFCAP, which the setuid path got
implicitly. NixOS never puts uid 0 into auto-allocated subuid ranges,
and granting it manually is a deliberate root-equivalent configuration;
the release notes document the override for that case.
nixosTests.{shadow,podman,docker-rootless} pass; the latter two
exercise newuidmap/newgidmap via rootless containers.
Supersedes #461172.
Co-authored-by: Rasheeq Azad <rasheeqhere@gmail.com>
With kernel lockdown the tun kmod is not necessarily available in stage2,
but Lix dependes on it through pasta.
nix-daemon[682677]: remote pid 682659 is user build (trusted)
nix-daemon[682711]: Failed to open() /dev/net/tun: No such device
nix-daemon[682702]: Failed to set up tap device in namespace
ProtectSystem=strict makes /var read-only, so the persistent state
fallback path needs a StateDirectory to be writable.
21e661fa14/src/core/paths.rs (L94)
Also remove from enableAllTerminfo list.
Since vte: 0.82.3 → 0.84.0 custom patches applied to vte in termite are
broken. The package has been without upstream for 5 years for now.
18de7682e9https://github.com/NixOS/nixpkgs/issues/122929
