Remove timestamp from the kernel.
Make initrd and the kernel builds repeatable.
Merge branch 'make-the-kernel-build-repeatable' of git://github.com/alexanderkjeldaas/nixpkgs

Make the kernel build and initrd generation binary repeatable (#2128)
buildPythonPackage: don't return on shellHook

Entering environment might not always be the desired effect.
Added a derivation for Ozgun's's retry (Haskell.)
Merge pull request #2157 from fmap/haskell-retry

Added a derivation for Ozgun's's retry (Haskell.)
haskell-criterion: downgrade to hastache 0.5.1 to fix the build

Closes <https://github.com/NixOS/nixpkgs/pull/2133>.
Gnome 3 should not be a release blocker
Revert "udisks1: bump to fix CVE-2014-0004"

This reverts commit 0194a44d63c613065bb5c55d50470881c00563c2 because
it breaks udisks on 13.10 (e.g. running "udisks --enumerate" will
print "Unit udisks.service failed to load").

(cherry picked from commit d7daf1a47f0d3d759555a3f0a0f09398c69c6b28)
Apply patch for CVE-2014-0004 to udisks-1.0.4

(cherry picked from commit 3b1f9899618f81794ce8b88fe4eaa867e549eb06)
Add a regression test for udisks
Remove ignored argument to sync
nixos: make several kernel common-config options optional

Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.

The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.

This is really just an arbitrary picking at the moment, but it should be
OK.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
nixos: add grsecurity module

This module implements a significant refactoring in grsecurity
configuration for NixOS, making it far more usable by default and much
easier to configure.

 - New security.grsecurity NixOS attributes.
   - All grsec kernels supported
   - Allows default 'auto' grsec configuration, or custom config
   - Supports custom kernel options through kernelExtraConfig
   - Defaults to high-security - user must choose server/desktop mode,
     and any virtualisation software. That's all.
   - kptr_restrict is fixed under grsecurity (it's unwriteable)
 - grsecurity patch creation is now significantly abstracted
   - only need revision, version, and SHA1
   - kernel version requirements are asserted for sanity
   - built kernels can have the uname specify the exact grsec version
     for development or bug reports. Off by default (requires
     `security.grsecurity.config.verboseVersion = true;`)
 - grsecurity sysctl support
   - By default, disabled.
   - For people who enable it, NixOS deploys a 'grsec-lock' systemd
     service which runs at startup. You are expected to configure sysctl
     through NixOS like you regularly would, which will occur before the
     service is started. As a result, changing sysctl settings requires
     a reboot.
 - AppArmor is now automatically enabled where it wasn't before, despite
   implying features.apparmor = true

The most trivial example of enabling grsecurity in your kernel is by
specifying:

    security.grsecurity.enable  = true;
    security.grsecurity.testing = true; # enable testing 3.13 kernel
    security.grsecurity.config.priority = "performance" # or "security"
    security.grsecurity.config.system   = "desktop";    # or "server"

This specifies absolutely no virtualisation support. In general, you
probably at least want KVM host support, which is a little more work.
So:

    security.grsecurity.enable = true;
    security.grsecurity.stable = true; # enable stable 3.2 kernel
    security.grsecurity.config = {
      system   = "server";
      priority = "security";
      virtualisationConfig   = "host";
      virtualisationSoftware = "kvm";
      hardwareVirtualisation = true;
    }

This configuration has primarily been tested on a Hetzner EX40 & VQ7
with NixOps.

Signed-off-by: Austin Seipp <aseipp@pobox.com>