nixos-generate-config: Fix PCI/USB checks

As reported by Kirill Elagin, read_file doesn't chomp its output. So
the equality tests on PCI/USB vendor and device IDs were failing.
haskell: sbv 3.0

Signed-off-by: Austin Seipp <aseipp@pobox.com>
flashplayer: Update from 11.2.202.346 -> 11.2.202.350
cb1cat: 20140328100000 -> 20140403153000

Signed-off-by: Austin Seipp <aseipp@pobox.com>
fsharp: 3.1 -> 3.1.0

This matches the traditional upstream versioning for FSharp in the wild

Signed-off-by: Austin Seipp <aseipp@pobox.com>
nixUnstable: Update to 1.7pre3576_2b6c8ef
nixos: make several kernel common-config options optional

Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.

The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.

This is really just an arbitrary picking at the moment, but it should be
OK.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
nixos: add grsecurity module (#1875)

This module implements a significant refactoring in grsecurity
configuration for NixOS, making it far more usable by default and much
easier to configure.

 - New security.grsecurity NixOS attributes.
   - All grsec kernels supported
   - Allows default 'auto' grsec configuration, or custom config
   - Supports custom kernel options through kernelExtraConfig
   - Defaults to high-security - user must choose server/desktop mode,
     and any virtualisation software. That's all.
   - kptr_restrict is fixed under grsecurity (it's unwriteable)
 - grsecurity patch creation is now significantly abstracted
   - only need revision, version, and SHA1
   - kernel version requirements are asserted for sanity
   - built kernels can have the uname specify the exact grsec version
     for development or bug reports. Off by default (requires
     `security.grsecurity.config.verboseVersion = true;`)
 - grsecurity sysctl support
   - By default, disabled.
   - For people who enable it, NixOS deploys a 'grsec-lock' systemd
     service which runs at startup. You are expected to configure sysctl
     through NixOS like you regularly would, which will occur before the
     service is started. As a result, changing sysctl settings requires
     a reboot.
 - AppArmor is now automatically enabled where it wasn't before, despite
   implying features.apparmor = true

The most trivial example of enabling grsecurity in your kernel is by
specifying:

    security.grsecurity.enable  = true;
    security.grsecurity.testing = true; # enable testing 3.13 kernel
    security.grsecurity.config.priority = "performance" # or "security"
    security.grsecurity.config.system   = "desktop";    # or "server"

This specifies absolutely no virtualisation support. In general, you
probably at least want KVM host support, which is a little more work.
So:

    security.grsecurity.enable = true;
    security.grsecurity.stable = true; # enable stable 3.2 kernel
    security.grsecurity.config = {
      system   = "server";
      priority = "security";
      virtualisationConfig   = "host";
      virtualisationSoftware = "kvm";
      hardwareVirtualisation = true;
    }

This configuration has primarily been tested on a Hetzner EX40 & VQ7
with NixOps.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
nixos/grsec: add a grsecurity group by default

This adds a new group to NixOS by default, called `grsecurity`, which
the `root` user is always a member of.

By default, the grsecurity module now sets GRKERNSEC_PROC_GID to the
`grsecurity` group by default - making it easy to add new users (for
example, services) to the group for /proc access. This is particularly
useful for system monitoring software.

Signed-off-by: Austin Seipp <aseipp@pobox.com>