Merge remote-tracking branch 'origin/master' into hardened-stdenv

53 files changed, 336 insertions, 369 deletions

diff --git a/pkgs/os-specific/darwin/install_name_tool/default.nix b/pkgs/os-specific/darwin/install_name_tool/default.nix
index 6a7e6caaa26..581eb31cc71 100644
--- a/pkgs/os-specific/darwin/install_name_tool/default.nix
+++ b/pkgs/os-specific/darwin/install_name_tool/default.nix
@@ -5,9 +5,9 @@ assert stdenv.isDarwin;
 stdenv.mkDerivation {
   name = "install_name_tool";
   src = "/usr/bin/install_name_tool";
+
   unpackPhase = "true";
-  configurePhase = "true";
-  buildPhase = "true";
+  dontBuild = true;
 
   installPhase = ''
     mkdir -p "$out"/bin
diff --git a/pkgs/os-specific/darwin/osx-sdk/default.nix b/pkgs/os-specific/darwin/osx-sdk/default.nix
index 875479b4f29..235eadfd255 100644
--- a/pkgs/os-specific/darwin/osx-sdk/default.nix
+++ b/pkgs/os-specific/darwin/osx-sdk/default.nix
@@ -7,9 +7,8 @@ in stdenv.mkDerivation rec {
 
   src = "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.9.sdk";
 
-  unpackPhase    = "true";
-  configurePhase = "true";
-  buildPhase     = "true";
+  unpackPhase = "true";
+  dontBuild = true;
 
   installPhase = ''
     mkdir -p $out/Developer/SDKs/
diff --git a/pkgs/os-specific/gnu/hurd/default.nix b/pkgs/os-specific/gnu/hurd/default.nix
index 4bdb6e132fb..5eccee62468 100644
--- a/pkgs/os-specific/gnu/hurd/default.nix
+++ b/pkgs/os-specific/gnu/hurd/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation ({
 //
 
 (if headersOnly
- then { buildPhase = ":"; installPhase = "make install-headers"; }
+ then { dontBuild = true; installPhase = "make install-headers"; }
  else (if (cross != null)
        then {
          crossConfig = cross.config;
diff --git a/pkgs/os-specific/gnu/libpthread/default.nix b/pkgs/os-specific/gnu/libpthread/default.nix
index 4b16652ba05..294a1548582 100644
--- a/pkgs/os-specific/gnu/libpthread/default.nix
+++ b/pkgs/os-specific/gnu/libpthread/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation ({
        "ac_cv_lib_ihash_hurd_ihash_create=yes"
      ];
 
-   buildPhase = ":";
+   dontBuild = true;
    installPhase = "make install-data-local-headers";
  }
  else { })
diff --git a/pkgs/os-specific/gnu/mach/default.nix b/pkgs/os-specific/gnu/mach/default.nix
index 6d2d20687bc..e8c15850715 100644
--- a/pkgs/os-specific/gnu/mach/default.nix
+++ b/pkgs/os-specific/gnu/mach/default.nix
@@ -53,5 +53,5 @@ stdenv.mkDerivation ({
 //
 
 (if headersOnly
- then { buildPhase = ":"; installPhase = "make install-data"; }
+ then { dontBuild = true; installPhase = "make install-data"; }
  else {}))
diff --git a/pkgs/os-specific/linux/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-lib/default.nix
index d2637f99119..985d04299db 100644
--- a/pkgs/os-specific/linux/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-lib/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-lib-1.1.0";
+  name = "alsa-lib-1.1.1";
 
   src = fetchurl {
     urls = [
      "ftp://ftp.alsa-project.org/pub/lib/${name}.tar.bz2"
      "http://alsa.cybermirror.org/lib/${name}.tar.bz2"
     ];
-    sha256 = "dfde65d11e82b68f82e562ab6228c1fb7c78854345d3c57e2c68a9dd3dae1f15";
+    sha256 = "0sa24fy3qf3jg63xxvfb7j8halj1qmdbcak2lyfx8bpd8hqnriwa";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/ati-drivers/builder.sh b/pkgs/os-specific/linux/ati-drivers/builder.sh
index 844f30e0c60..4394e785960 100644
--- a/pkgs/os-specific/linux/ati-drivers/builder.sh
+++ b/pkgs/os-specific/linux/ati-drivers/builder.sh
@@ -1,4 +1,3 @@
-# What is LIBGL_DRIVERS_PATH used for?
 # TODO gentoo removes some tools because there are xorg sources (?)
 
 source $stdenv/setup
@@ -6,15 +5,10 @@ set -x
 
 die(){ echo $@; exit 1; }
 
-mkdir fglrx # custom unpack:
-cd fglrx
 unzip $src
-cd ..
-run_file=$(echo fglrx/amd-driver-installer-*)
+run_file=fglrx-$build/amd-driver-installer-$build-x86.x86_64.run
 sh $run_file --extract .
 
-eval "$patchPhase1"
-
 case "$system" in
   x86_64-linux)
     arch=x86_64
@@ -33,9 +27,9 @@ esac
 
 if test -z "$libsOnly"; then
 
-  kernelVersion=$(cd ${kernel}/lib/modules && ls)
-  kernelBuild=$(echo ${kernel}/lib/modules/$kernelVersion/build)
-  linuxsources=$(echo ${kernel}/lib/modules/$kernelVersion/source)
+  kernelVersion=$(cd ${kernelDir}/lib/modules && ls)
+  kernelBuild=$(echo ${kernelDir}/lib/modules/$kernelVersion/build)
+  linuxsources=$(echo ${kernelDir}/lib/modules/$kernelVersion/source)
 
   # note: maybe the .config file should be used to determine this ?
   # current kbuild infrastructure allows using CONFIG_* defines
@@ -231,7 +225,7 @@ fi
     fglrx_dri.so \
     libaticaldd.so
   do
-    patchelf --set-rpath $gcc/$lib_arch/ $out/lib/$pelib2
+    patchelf --set-rpath $glibcDir/lib/:$libStdCxx/lib/ $out/lib/$pelib2
   done
 }
 
@@ -245,12 +239,12 @@ if test -z "$libsOnly"; then
   eval "$patchPhaseSamples"
 
   ( # build and install fgl_glxgears
-    cd fgl_glxgears; 
+    cd fgl_glxgears;
     gcc -DGL_ARB_texture_multisample=1 -g \
     -I$mesa/include \
     -I$out/include \
     -L$mesa/lib -lGL -lGLU -lX11 -lm \
-    -o $out/bin/fgl_glxgears -Wall  fgl_glxgears.c
+    -o $out/bin/fgl_glxgears -Wall fgl_glxgears.c
   )
 
   true || ( # build and install
@@ -267,12 +261,12 @@ if test -z "$libsOnly"; then
 	    -I${xf86vidmodeproto}/include \
 	    -I$out/X11R6/include \
 	    -L$out/lib \
-	    -Wall -lm -lfglrx_gamma -lX11 -lXext -o $out/bin/fglrx_xgamma fglrx_xgamma.c 
+	    -Wall -lm -lfglrx_gamma -lX11 -lXext -o $out/bin/fglrx_xgamma fglrx_xgamma.c
   )
 
   {
     # patch and copy statically linked qt libs used by amdcccle
-    patchelf --set-interpreter $(echo $glibc/lib/ld-linux*.so.2) $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtCore.so.4 &&
+    patchelf --set-interpreter $(echo $glibcDir/lib/ld-linux*.so.2) $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtCore.so.4 &&
     patchelf  --set-rpath $gcc/$lib_arch/ $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtCore.so.4 &&
     patchelf --set-rpath $gcc/$lib_arch/:$out/share/ati/:$libXrender/lib/:$libSM/lib/:$libICE/lib/:$libfontconfig/lib/:$libfreetype/lib/ $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtGui.so.4 &&
     mkdir -p $out/share/ati
@@ -285,7 +279,7 @@ if test -z "$libsOnly"; then
     patchelf --shrink-rpath $BIN/amdcccle
     for prog in $BIN/*; do
       cp -f $prog $out/bin &&
-      patchelf --set-interpreter $(echo $glibc/lib/ld-linux*.so.2) $out/bin/$(basename $prog) &&
+      patchelf --set-interpreter $(echo $glibcDir/lib/ld-linux*.so.2) $out/bin/$(basename $prog) &&
       wrapProgram $out/bin/$(basename $prog) --prefix LD_LIBRARY_PATH : $out/lib/:$gcc/lib/:$out/share/ati/:$libXinerama/lib/:$libXrandr/lib/:$libfontconfig/lib/:$libfreetype/lib/:$LD_LIBRARY_PATH
     done
   }
diff --git a/pkgs/os-specific/linux/ati-drivers/default.nix b/pkgs/os-specific/linux/ati-drivers/default.nix
index 78903da1f1a..a4f8b707c08 100644
--- a/pkgs/os-specific/linux/ati-drivers/default.nix
+++ b/pkgs/os-specific/linux/ati-drivers/default.nix
@@ -11,10 +11,6 @@ assert (!libsOnly) -> kernel != null;
 
 with stdenv.lib;
 
-let
-  version = "15.7";
-in
-
 # This derivation requires a maximum of gcc49, Linux kernel 4.1 and xorg.xserver 1.17
 # and will not build or run using versions newer
 
@@ -31,11 +27,14 @@ in
 
 # http://wiki.cchtml.com/index.php/Main_Page
 
-# 
 # /usr/lib/dri/fglrx_dri.so must point to /run/opengl-driver/lib/fglrx_dri.so
 # This is done in the builder script.
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
+
+  version = "15.12";
+  pname = "ati-drivers";
+  build = "15.302";
 
   linuxonly =
     if stdenv.system == "i686-linux" then
@@ -44,7 +43,7 @@ stdenv.mkDerivation {
       true
     else throw "ati-drivers are Linux only. Sorry. The build was stopped.";
 
-  name = "ati-drivers-${version}" + (optionalString (!libsOnly) "-${kernel.version}");
+  name = pname + "-" + version + (optionalString (!libsOnly) "-${kernelDir.version}");
 
   builder = ./builder.sh;
   gcc = stdenv.cc.cc;
@@ -57,15 +56,16 @@ stdenv.mkDerivation {
   libICE = xorg.libICE;
   libfreetype = freetype;
   libfontconfig = fontconfig;
+  libStdCxx = stdenv.cc.cc.lib;
 
   src = fetchurl {
-    url = "http://www2.ati.com/drivers/linux/amd-driver-installer-15.20.1046-x86.x86_64.zip";
-    sha256 = "ffde64203f49d9288eaa25f4d744187b6f4f14a87a444bab6a001d822b327a9d";
-    curlOpts = "--referer http://support.amd.com/en-us/download/desktop?os=Linux%20x86_64";
+    url =
+    "https://www2.ati.com/drivers/linux/radeon-crimson-15.12-15.302-151217a-297685e.zip";
+    sha256 = "0n0ynqmjkjp5dl5q07as7ps3rlyyn63hq4mlwgd7c7v82ky2skvh";
+    curlOpts = "--referer http://support.amd.com/en-us/download/desktop?os=Linux+x86_64";
   };
 
   patchPhaseSamples = "patch -p2 < ${./patch-samples.patch}";
-  patchPhase1 = "patch -p1 < ${./kernel-api-fixes.patch}";
 
   buildInputs =
     [ xorg.libXrender xorg.libXext xorg.libX11 xorg.libXinerama xorg.libSM
@@ -81,28 +81,28 @@ stdenv.mkDerivation {
 
   inherit libsOnly;
 
-  kernel = if libsOnly then null else kernel.dev;
+  kernelDir = if libsOnly then null else kernel.dev;
 
-  inherit glibc /* glibc only used for setting interpreter */;
+  # glibc only used for setting the binaries interpreter
+  glibcDir = glibc.out;
 
   # outputs TODO: probably many fixes are needed;
-  # this in particular would be much better by lib.makeLibraryPath
-  LD_LIBRARY_PATH = stdenv.lib.concatStringsSep ":"
-    [ "${xorg.libXrandr.out}/lib/"
-      "${xorg.libXrender.out}/lib/"
-      "${xorg.libXext.out}/lib/"
-      "${xorg.libX11.out}/lib/"
-      "${xorg.libXinerama.out}/lib/"
-      "${xorg.libSM.out}/lib/"
-      "${xorg.libICE.out}/lib/"
-      "${stdenv.cc.cc.out}/lib/"
+  LD_LIBRARY_PATH = makeLibraryPath
+    [ xorg.libXrender xorg.libXext xorg.libX11 xorg.libXinerama xorg.libSM
+      xorg.libXrandr xorg.libXxf86vm xorg.xf86vidmodeproto xorg.imake xorg.libICE
+      mesa
+      fontconfig
+      freetype
+      stdenv.cc.cc
     ];
 
   # without this some applications like blender don't start, but they start
   # with nvidia. This causes them to be symlinked to $out/lib so that they
   # appear in /run/opengl-driver/lib which get's added to LD_LIBRARY_PATH
 
-  extraDRIlibs = [ xorg.libXrandr xorg.libXrender xorg.libXext xorg.libX11 xorg.libXinerama xorg.libSM xorg.libICE ];
+  extraDRIlibs = [ xorg.libXrandr.out xorg.libXrender.out xorg.libXext.out
+                   xorg.libX11.out xorg.libXinerama.out xorg.libSM.out 
+                   xorg.libICE.out ];
 
   inherit mesa; # only required to build the examples
 
@@ -119,6 +119,4 @@ stdenv.mkDerivation {
     priority = 4;
   };
 
-
-
 }
diff --git a/pkgs/os-specific/linux/bluez/bluez5.nix b/pkgs/os-specific/linux/bluez/bluez5.nix
index 9750a2a7649..a7e36d21dd4 100644
--- a/pkgs/os-specific/linux/bluez/bluez5.nix
+++ b/pkgs/os-specific/linux/bluez/bluez5.nix
@@ -6,7 +6,7 @@ assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   name = "bluez-5.37";
-   
+
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
     sha256 = "c14ba9ddcb0055522073477b8fd8bf1ddf5d219e75fdfd4699b7e0ce5350d6b0";
@@ -20,11 +20,13 @@ stdenv.mkDerivation rec {
       readline libsndfile udev libical
       # Disables GStreamer; not clear what it gains us other than a
       # zillion extra dependencies.
-      # gstreamer gst_plugins_base 
+      # gstreamer gst_plugins_base
     ];
 
+  outputs = [ "dev" "out" "test" ];
+
   patches = [ ./bluez-5.37-obexd_without_systemd-1.patch ];
-    
+
   preConfigure = ''
       substituteInPlace tools/hid2hci.rules --replace /sbin/udevadm ${systemd}/bin/udevadm
       substituteInPlace tools/hid2hci.rules --replace "hid2hci " "$out/lib/udev/hid2hci "
@@ -51,9 +53,9 @@ stdenv.mkDerivation rec {
   # FIXME: Move these into a separate package to prevent Bluez from
   # depending on Python etc.
   postInstall = ''
-    mkdir $out/test
-    cp -a test $out
-    pushd $out/test
+    mkdir -p $test/test
+    cp -a test $test
+    pushd $test/test
     for a in \
             simple-agent \
             test-adapter \
@@ -65,7 +67,7 @@ stdenv.mkDerivation rec {
       ln -s ../test/$a $out/bin/bluez-$a
     done
     popd
-    wrapPythonProgramsIn $out/test "$out/test $pythonPath"
+    wrapPythonProgramsIn $test/test "$test/test $pythonPath"
 
     # for bluez4 compatibility for NixOS
     mkdir $out/sbin
diff --git a/pkgs/os-specific/linux/cpupower/default.nix b/pkgs/os-specific/linux/cpupower/default.nix
index 269729917dd..d6d529627e2 100644
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "Tool to examine and tune power saving features";
-    homepage = https://www.kernel.org.org/;
+    homepage = https://www.kernel.org/;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index 7ca71a695e0..2d7c8a5f14e 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     homepage = http://dpdk.org/;
     license = with licenses; [ lgpl21 gpl2 bsd2 ];
     platforms =  [ "x86_64-linux" ];
-    maintainers = [ maintainers.iElectric ];
+    maintainers = [ maintainers.domenkozar ];
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/zd1211/default.nix b/pkgs/os-specific/linux/firmware/zd1211/default.nix
index 19cbdecca0c..2298cbd13c5 100644
--- a/pkgs/os-specific/linux/firmware/zd1211/default.nix
+++ b/pkgs/os-specific/linux/firmware/zd1211/default.nix
@@ -11,9 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "04ibs0qw8bh6h6zmm5iz6lddgknwhsjq8ib3gyck6a7psw83h7gi";
   };
 
-  buildPhase = "true";
+  dontBuild = true;
 
-  installPhase = "mkdir -p $out/lib/firmware/zd1211; cp * $out/lib/firmware/zd1211";
+  installPhase = ''
+    mkdir -p $out/lib/firmware/zd1211
+    cp * $out/lib/firmware/zd1211
+  '';
 
   meta = {
     description = "Firmware for the ZyDAS ZD1211(b) 802.11a/b/g USB WLAN chip";
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 5f328bd90c8..6813b5bcf1b 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "iproute2-4.3.0";
+  name = "iproute2-4.5.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "159988vv3fd78bzhisfl1dl4dd7km3vjzs2d8899a0vcvn412fzh";
+    sha256 = "0jj9phsi8m2sbnz7bbh9cf9vckm67hs62ab5srdwnrg4acpjj59z";
   };
 
   patches = lib.optionals enableFan [
diff --git a/pkgs/os-specific/linux/ipsec-tools/default.nix b/pkgs/os-specific/linux/ipsec-tools/default.nix
index fc3b0500fed..466ecb1efee 100644
--- a/pkgs/os-specific/linux/ipsec-tools/default.nix
+++ b/pkgs/os-specific/linux/ipsec-tools/default.nix
@@ -39,8 +39,6 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "http://ipsec-tools.sourceforge.net/";
     description = "Port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation";
-
     platforms = stdenv.lib.platforms.linux;
-    maintainers = [stdenv.lib.maintainers.simons];
   };
 }
diff --git a/pkgs/os-specific/linux/iptables/1.6.nix b/pkgs/os-specific/linux/iptables/1.6.nix
deleted file mode 100644
index 88821a15d73..00000000000
--- a/pkgs/os-specific/linux/iptables/1.6.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{stdenv, fetchurl, bison, flex, libnetfilter_conntrack, libnftnl, libmnl}:
-
-stdenv.mkDerivation rec {
-  name = "iptables-${version}";
-  version = "1.6.0";
-
-  src = fetchurl {
-    url = "http://www.netfilter.org/projects/iptables/files/${name}.tar.bz2";
-    sha256 = "0q0w1x4aijid8wj7dg1ny9fqwll483f1sqw7kvkskd8q1c52mdsb";
-  };
-
-  nativeBuildInputs = [bison flex];
-
-  buildInputs = [libnetfilter_conntrack libnftnl libmnl];
-  
-  preConfigure = ''
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lmnl -lnftnl"
-  '';
-
-  configureFlags = ''
-    --enable-devel
-    --enable-shared
-  '';
-
-  meta = {
-    description = "A program to configure the Linux IP packet filtering ruleset";
-    homepage = http://www.netfilter.org/projects/iptables/index.html;
-    platforms = stdenv.lib.platforms.linux;
-    downloadPage = "http://www.netfilter.org/projects/iptables/files/";
-    updateWalker = true;
-    inherit version;
-  };
-}
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index ba3ee64f08b..8c815029661 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,14 +1,22 @@
-{stdenv, fetchurl}:
+{stdenv, fetchurl, bison, flex, libnetfilter_conntrack, libnftnl, libmnl}:
 
 stdenv.mkDerivation rec {
   name = "iptables-${version}";
-  version = "1.4.21"; # before updating check #12178
+  version = "1.6.0";
 
   src = fetchurl {
     url = "http://www.netfilter.org/projects/iptables/files/${name}.tar.bz2";
-    sha256 = "1q6kg7sf0pgpq0qhab6sywl23cngxxfzc9zdzscsba8x09l4q02j";
+    sha256 = "0q0w1x4aijid8wj7dg1ny9fqwll483f1sqw7kvkskd8q1c52mdsb";
   };
 
+  nativeBuildInputs = [bison flex];
+
+  buildInputs = [libnetfilter_conntrack libnftnl libmnl];
+
+  preConfigure = ''
+    export NIX_LDFLAGS="$NIX_LDFLAGS -lmnl -lnftnl"
+  '';
+
   configureFlags = ''
     --enable-devel
     --enable-shared
diff --git a/pkgs/os-specific/linux/iw/default.nix b/pkgs/os-specific/linux/iw/default.nix
index 3cd2567d96f..53aa15ec62e 100644
--- a/pkgs/os-specific/linux/iw/default.nix
+++ b/pkgs/os-specific/linux/iw/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl, libnl, pkgconfig}:
 
 stdenv.mkDerivation rec {
-  name = "iw-4.1";
+  name = "iw-4.3";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/iw/${name}.tar.xz";
-    sha256 = "0jx3s5wdvm2qxd3h883fnyjsb1c29qcsz1r19bc029g8v2nalr2i";
+    sha256 = "085jyvrxzarvn5jl0fk618jjxy50nqx7ifngszc4jxk6a4ddibd6";
   };
 
   buildInputs = [ libnl pkgconfig ];
diff --git a/pkgs/os-specific/linux/jfbview/default.nix b/pkgs/os-specific/linux/jfbview/default.nix
index 73ce1e7780a..31ba5e1152c 100644
--- a/pkgs/os-specific/linux/jfbview/default.nix
+++ b/pkgs/os-specific/linux/jfbview/default.nix
@@ -1,22 +1,43 @@
-{ stdenv, fetchFromGitHub, freetype, imlib2, jbig2dec, libjpeg, libX11
-, mujs, mupdf, ncurses, openjpeg, openssl }:
+{ stdenv, fetchFromGitHub
+, freetype, harfbuzz, jbig2dec, libjpeg, libX11, mujs, mupdf, ncurses, openjpeg
+, openssl
+
+, imageSupport ? true, imlib2 ? null }:
 
 let
-  binaries = [ "jfbpdf" "jfbview" "jpdfcat" "jpdfgrep" ];
+  package = if imageSupport
+    then "jfbview"
+    else "jfbpdf";
+  binaries = if imageSupport
+    then [ "jfbview" "jpdfcat" "jpdfgrep" ]	# all require imlib2
+    else [ "jfbpdf" ];	       		  	# does not
 in
+
 stdenv.mkDerivation rec {
-  name = "jfbview-${version}";
-  version = "0.5.1";
+  name = "${package}-${version}";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
-    sha256 = "113bkf49q04k9rjps5l28ychmzsfjajp9cjhr433s9ld0972z01m";
+    sha256 = "1vd2ndl4ar2bzqf0k11qid6gvma59qg62imsa81mgczsqw7kvbx6";
     rev = version;
     repo = "JFBView";
     owner = "jichu4n";
   };
 
-  buildInputs = [ freetype imlib2 jbig2dec libjpeg libX11 mujs mupdf
-    ncurses openjpeg openssl ];
+  buildInputs = [
+    freetype harfbuzz jbig2dec libjpeg libX11 mujs mupdf ncurses openjpeg
+    openssl
+  ] ++ stdenv.lib.optionals imageSupport [
+    imlib2
+  ];
+
+  configurePhase = ''
+    # Hack. Probing (`ldconfig -p`) fails with ‘cannot execute binary file’.
+    # Overriding `OPENJP2 =` later works, but makes build output misleading:
+    substituteInPlace Makefile --replace "ldconfig -p" "echo libopenjp2"
+
+    make config.mk
+  '';
 
   buildFlags = binaries;
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/kernel-headers/4.4.nix b/pkgs/os-specific/linux/kernel-headers/4.4.nix
new file mode 100644
index 00000000000..be6dd847201
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel-headers/4.4.nix
@@ -0,0 +1,71 @@
+{ stdenv, fetchurl, perl, cross ? null }:
+
+assert cross == null -> stdenv.isLinux;
+
+let
+
+  version = "4.4.10";
+
+  kernelHeadersBaseConfig =
+    if cross == null
+    then stdenv.platform.kernelHeadersBaseConfig
+    else cross.platform.kernelHeadersBaseConfig;
+
+in
+
+stdenv.mkDerivation {
+  name = "linux-headers-${version}";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
+    sha256 = "1kpjvvd9q9wwr3314q5ymvxii4dv2d27295bzly225wlc552xhja";
+  };
+
+  targetConfig = if cross != null then cross.config else null;
+
+  platform =
+    if cross != null then cross.platform.kernelArch else
+    if stdenv.system == "i686-linux" then "i386" else
+    if stdenv.system == "x86_64-linux" then "x86_64" else
+    if stdenv.system == "powerpc-linux" then "powerpc" else
+    if stdenv.isArm then "arm" else
+    if stdenv.platform ? kernelArch then stdenv.platform.kernelArch else
+    abort "don't know what the kernel include directory is called for this platform";
+
+  buildInputs = [perl];
+
+  extraIncludeDirs =
+    if cross != null then
+        (if cross.arch == "powerpc" then ["ppc"] else [])
+    else if stdenv.system == "powerpc-linux" then ["ppc"] else [];
+
+  buildPhase = ''
+    if test -n "$targetConfig"; then
+       export ARCH=$platform
+    fi
+    make ${kernelHeadersBaseConfig} SHELL=bash
+    make mrproper headers_check SHELL=bash
+  '';
+
+  installPhase = ''
+    make INSTALL_HDR_PATH=$out headers_install
+
+    # Some builds (e.g. KVM) want a kernel.release.
+    mkdir -p $out/include/config
+    echo "${version}-default" > $out/include/config/kernel.release
+  '';
+
+  # !!! hacky
+  fixupPhase = ''
+    ln -s asm $out/include/asm-$platform
+    if test "$platform" = "i386" -o "$platform" = "x86_64"; then
+      ln -s asm $out/include/asm-x86
+    fi
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Header files and scripts for Linux kernel";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/grsecurity-path-3.14.patch b/pkgs/os-specific/linux/kernel/grsecurity-path-3.14.patch
deleted file mode 100644
index 6f477c22b5e..00000000000
--- a/pkgs/os-specific/linux/kernel/grsecurity-path-3.14.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/kernel/kmod.c b/kernel/kmod.c
-index a689506..30747b4 100644
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -294,10 +294,8 @@ static int ____call_usermodehelper(void *data)
- 	   out the path to be used prior to this point and are now operating
- 	   on that copy
- 	*/
--	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
--	     strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
--	     strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
--	     strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
-+	     strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) {
- 		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
- 		retval = -EPERM;
- 		goto out;
diff --git a/pkgs/os-specific/linux/kernel/grsecurity-path-4.4.patch b/pkgs/os-specific/linux/kernel/grsecurity-path-4.4.patch
deleted file mode 100644
index bef1a75c23d..00000000000
--- a/pkgs/os-specific/linux/kernel/grsecurity-path-4.4.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/kernel/kmod.c b/kernel/kmod.c
-index a689506..30747b4 100644
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -294,11 +294,8 @@ static int ____call_usermodehelper(void *data)
- 	   out the path to be used prior to this point and are now operating
- 	   on that copy
- 	*/
--	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
--	     strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
--	     strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
--	     strncmp(sub_info->path, "/usr/sbin/", 10) &&
--	     strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
-+	     strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) {
- 		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
- 		retval = -EPERM;
- 		goto out;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 6b997943d7c..bd7c7f636f8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.8";
+  version = "4.4.10";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "02gf7dkdibhxv8n4qfnyqh645d102g9z7pdid8pcq4jhd99sg9yj";
+    sha256 = "1kpjvvd9q9wwr3314q5ymvxii4dv2d27295bzly225wlc552xhja";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.5.nix b/pkgs/os-specific/linux/kernel/linux-4.5.nix
index 267d0d58de4..09bd490ccfe 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.5.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.5.2";
+  version = "4.5.4";
   extraMeta.branch = "4.5";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "17r063zx880ka3ayv9cf1yjfilvxlifhja1rhw5z3w35hgdkj8z3";
+    sha256 = "1s0mhhxx2sw93a9cin5mvjl82ah93a4sa2lfkvs6ay73mw3ifp2p";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.6.nix
index 36181308a8b..0a85af58473 100644
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.6.nix
@@ -1,12 +1,13 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.5";
-  extraMeta.branch = "4.4";
+  version = "4.6";
+  modDirVersion = "4.6.0";
+  extraMeta.branch = "4.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1daavrj2msl85aijh1izfm1cwf14c7mi75hldzidr1h2v629l89h";
+    sha256 = "a93771cd5a8ad27798f22e9240538dfea48d3a2bf2a6a6ab415de3f02d25d866";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity-3.14.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity-3.14.nix
deleted file mode 100644
index da628620764..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity-3.14.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ stdenv, fetchurl, perl, buildLinux, ... } @ args:
-
-throw "grsecurity stable is no longer supported; please update your configuration"
-
-import ./generic.nix (args // rec {
-  version = "3.14.51";
-  extraMeta.branch = "3.14";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1gqsd69cqijff4c4br4ydmcjl226d0yy6vrmgfvy16xiraavq1mk";
-  };
-
-  kernelPatches = args.kernelPatches;
-
-  features.iwlwifi = true;
-  features.efiBootStub = true;
-  features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
-  features.netfilterRPFilter = true;
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix
index 267d0d58de4..09bd490ccfe 100644
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.5.2";
+  version = "4.5.4";
   extraMeta.branch = "4.5";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "17r063zx880ka3ayv9cf1yjfilvxlifhja1rhw5z3w35hgdkj8z3";
+    sha256 = "1s0mhhxx2sw93a9cin5mvjl82ah93a4sa2lfkvs6ay73mw3ifp2p";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 7ba01d66729..ac7dc30c2a9 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -109,6 +109,7 @@ let
       buildFlags = [
         "KBUILD_BUILD_VERSION=1-NixOS"
         platform.kernelTarget
+        "vmlinux"  # for "perf" and things like that
       ] ++ optional isModular "modules";
 
       installFlags = [
@@ -122,10 +123,13 @@ let
                           if platform.kernelTarget == "zImage" then "zinstall" else
                           "install") ];
 
-      postInstall = (optionalString installsFirmware ''
+      postInstall = ''
+        mkdir -p $dev
+        cp $buildRoot/vmlinux $dev/
+      '' + (optionalString installsFirmware ''
         mkdir -p $out/lib/firmware
       '') + (if (platform ? kernelDTB && platform.kernelDTB) then ''
- 	make $makeFlags "''${makeFlagsArray[@]}" dtbs
+        make $makeFlags "''${makeFlagsArray[@]}" dtbs
         mkdir -p $out/dtbs
         cp $buildRoot/arch/$karch/boot/dts/*.dtb $out/dtbs
       '' else "") + (if isModular then ''
@@ -190,6 +194,8 @@ let
           $installFlags "''${installFlagsArray[@]}"
       '');
 
+      requiredSystemFeatures = [ "big-parallel" ];
+
       meta = {
         description =
           "The Linux kernel" +
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 14b0692dbad..8e198e7a3ed 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -22,10 +22,11 @@ let
     assert kversion == kernel.version;
     { name = "grsecurity-${grversion}-${kversion}";
       inherit grversion kernel patches kversion revision;
+      # When updating versions/hashes, ALWAYS use the official version; we use
+      # this mirror only because upstream removes sources files immediately upon
+      # releasing a new version ...
       patch = fetchurl {
-        url = if branch == "stable"
-              then "https://github.com/kdave/grsecurity-patches/blob/master/grsecurity_patches/grsecurity-${grversion}-${kversion}-${revision}.patch?raw=true"
-              else "https://github.com/slashbeast/grsecurity-scrape/blob/master/${branch}/grsecurity-${grversion}-${kversion}-${revision}.patch?raw=true";
+        url = "https://raw.githubusercontent.com/slashbeast/grsecurity-scrape/master/test/grsecurity-${grversion}-${kversion}-${revision}.patch";
         inherit sha256;
       };
       features.grsecurity = true;
@@ -87,43 +88,20 @@ rec {
     sha256 = "00b1rqgd4yr206dxp4mcymr56ymbjcjfa4m82pxw73khj032qw3j";
   };
 
-  grsecurity_3_14 = grsecPatch
-    { kernel    = pkgs.grsecurity_base_linux_3_14;
-      patches   = [ grsecurity_fix_path_3_14 ];
-      kversion  = "3.14.51";
-      revision  = "201508181951";
-      branch    = "stable";
-      sha256    = "1sp1gwa7ahzflq7ayb51bg52abrn5zx1hb3pff3axpjqq7vfai6f";
-    };
+  grsecurity_3_14 = throw "grsecurity stable is no longer supported";
 
-  grsecurity_4_4 = grsecPatch
-    { kernel    = pkgs.grsecurity_base_linux_4_4;
-      patches   = [ grsecurity_fix_path_4_4 ];
-      kversion  = "4.4.5";
-      revision  = "201603131305";
-      sha256    = "04k4nhshl6r5n41ha5620s7cd70dmmmvyf9mnn5359jr1720kxpf";
-    };
+  grsecurity_4_4 = throw "grsecurity stable is no longer supported";
 
   grsecurity_4_5 = grsecPatch
     { kernel    = pkgs.grsecurity_base_linux_4_5;
       patches   = [ grsecurity_fix_path_4_5 ];
-      kversion  = "4.5.2";
-      revision  = "201604290633";
-      sha256    = "0qrs4fk6lyqngq3fnsmrv0y3yp1lrbiwadfc6v7hy4lyv77wz107";
+      kversion  = "4.5.4";
+      revision  = "201605131918";
+      sha256    = "0f5s8lj6zc4jp2cpxm7r891px3dmb6m3ximfigwq809yydg5aimv";
     };
 
   grsecurity_latest = grsecurity_4_5;
 
-  grsecurity_fix_path_3_14 =
-    { name = "grsecurity-fix-path-3.14";
-      patch = ./grsecurity-path-3.14.patch;
-    };
-
-  grsecurity_fix_path_4_4 =
-    { name = "grsecurity-fix-path-4.4";
-      patch = ./grsecurity-path-4.4.patch;
-    };
-
   grsecurity_fix_path_4_5 =
     { name = "grsecurity-fix-path-4.5";
       patch = ./grsecurity-path-4.5.patch;
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index c8484babcdf..13d2fb7f5c5 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -1,27 +1,55 @@
-{ stdenv, fetchurl, attr, perl }:
+{ stdenv, fetchurl, attr, perl, pam ? null }:
+assert pam != null -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   name = "libcap-${version}";
-  version = "2.24";
+  version = "2.25";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${name}.tar.xz";
-    sha256 = "0rbc9qbqs5bp9am9s9g83wxj5k4ixps2agy9dxr1v1fwg27mdr6f";
+    sha256 = "0qjiqc5pknaal57453nxcbz3mn1r4hkyywam41wfcglq3v2qlg39";
   };
 
-  outputs = [ "dev" "out" ];
+  outputs = [ "dev" "lib" "doc" "out" ]
+    ++ stdenv.lib.optional (pam != null) "pam";
 
   nativeBuildInputs = [ perl ];
+
+  buildInputs = [ pam ];
+
   propagatedBuildInputs = [ attr ];
 
-  preConfigure = "cd libcap";
+  makeFlags = [
+    "lib=lib"
+    (stdenv.lib.optional (pam != null) "PAM_CAP=yes")
+  ];
+
+  prePatch = ''
+    # use relative bash path
+    substituteInPlace progs/capsh.c --replace "/bin/bash" "bash"
+
+    # ensure capsh can find bash in $PATH
+    substituteInPlace progs/capsh.c --replace execve execvpe
+  '';
+
+  preInstall = ''
+    substituteInPlace Make.Rules \
+      --replace 'prefix=/usr' "prefix=$lib" \
+      --replace 'exec_prefix=' "exec_prefix=$out" \
+      --replace 'lib_prefix=$(exec_prefix)' "lib_prefix=$lib" \
+      --replace 'inc_prefix=$(prefix)' "inc_prefix=$dev" \
+      --replace 'man_prefix=$(prefix)' "man_prefix=$doc"
+  '';
 
-  makeFlags = "lib=lib prefix=$(out)";
+  installFlags = "RAISE_SETFCAP=no";
 
   postInstall = ''
-    rm "$out"/lib/*.a
-    mkdir -p "$dev/share/doc/${name}"
-    cp ../License "$dev/share/doc/${name}/License"
+    rm "$lib"/lib/*.a
+    mkdir -p "$doc/share/doc/${name}"
+    cp License "$doc/share/doc/${name}/"
+  '' + stdenv.lib.optionalString (pam != null) ''
+    mkdir -p "$pam/lib/security"
+    mv "$lib"/lib/security "$pam/lib"
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/libcap/man.nix b/pkgs/os-specific/linux/libcap/man.nix
deleted file mode 100644
index eeb780f095b..00000000000
--- a/pkgs/os-specific/linux/libcap/man.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{stdenv, libcap}:
-
-assert stdenv.isLinux;
-
-stdenv.mkDerivation rec {
-  name = "libcap-docs-${libcap.version}";
-
-  inherit (libcap) src;
-
-  makeFlags = "MANDIR=$(out)/share/man";
-
-  preConfigure = "cd doc";
-}
diff --git a/pkgs/os-specific/linux/libcap/pam.nix b/pkgs/os-specific/linux/libcap/pam.nix
deleted file mode 100644
index 3dd7cd947af..00000000000
--- a/pkgs/os-specific/linux/libcap/pam.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{stdenv, pam, libcap}:
-
-assert stdenv.isLinux;
-
-stdenv.mkDerivation rec {
-  name = "libcap-pam-${libcap.version}";
-
-  inherit (libcap) src;
-
-  buildInputs = [ libcap pam ];
-
-  preConfigure = "cd pam_cap";
-
-  makeFlags = "${libcap.makeFlags} PAM_CAP=yes";
-}
diff --git a/pkgs/os-specific/linux/libcap/progs.nix b/pkgs/os-specific/linux/libcap/progs.nix
deleted file mode 100644
index e3871f15f88..00000000000
--- a/pkgs/os-specific/linux/libcap/progs.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{stdenv, libcap}:
-
-assert stdenv.isLinux;
-
-stdenv.mkDerivation rec {
-  name = "libcap-progs-${libcap.version}";
-
-  inherit (libcap) src makeFlags;
-
-  buildInputs = [ libcap ];
-
-  prePatch = ''
-    # use relative bash path
-    substituteInPlace progs/capsh.c --replace "/bin/bash" "bash"
-
-    # ensure capsh can find bash in $PATH
-    substituteInPlace progs/capsh.c --replace execve execvpe
-  '';
-
-  preConfigure = "cd progs";
-
-  installFlags = "RAISE_SETFCAP=no";
-
-  postInstall = ''
-    mkdir -p "$out/share/doc/${name}"
-    cp ../License "$out/share/doc/${name}/"
-  '';
-}
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index 1e1ed0a6112..6e5c63a2722 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub, autoreconfHook, bison, flex, pkgconfig }:
 
-let version = "3.2.26"; in
+let version = "3.2.27"; in
 stdenv.mkDerivation {
   name = "libnl-${version}";
 
   src = fetchFromGitHub {
-    sha256 = "1cbqdhirn6hxmv8xkm8xp3n6ayyxw7sbi15fym167rdz0h9rkhmm";
-    rev = "libnl3_2_26";
+    sha256 = "1rc8plgl2ijq2pwlzinpfr06kiggjyx71r3lw505m6rvxvdac82r";
+    rev = "libnl3_2_27";
     repo = "libnl";
     owner = "thom311";
   };
diff --git a/pkgs/os-specific/linux/libsmbios/default.nix b/pkgs/os-specific/linux/libsmbios/default.nix
index 7b7e1c96ab5..8d05a0d7d23 100644
--- a/pkgs/os-specific/linux/libsmbios/default.nix
+++ b/pkgs/os-specific/linux/libsmbios/default.nix
@@ -27,8 +27,6 @@ stdenv.mkDerivation {
     homepage = "http://linux.dell.com/libsmbios/main";
     description = "a library to obtain BIOS information";
     license = stdenv.lib.licenses.gpl2Plus; # alternatively, under the Open Software License version 2.1
-
     platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.simons ];
   };
 }
diff --git a/pkgs/os-specific/linux/lm-sensors/default.nix b/pkgs/os-specific/linux/lm-sensors/default.nix
index 388ec857b4a..90e373c7ee0 100644
--- a/pkgs/os-specific/linux/lm-sensors/default.nix
+++ b/pkgs/os-specific/linux/lm-sensors/default.nix
@@ -1,13 +1,15 @@
 { stdenv, fetchurl, bison, flex, which, perl }:
 
-let version = "3.3.5"; in
-
 stdenv.mkDerivation rec {
   name = "lm-sensors-${version}";
+  version = "3.4.0"; # don't forget to tweak fedoraproject mirror URL hash
   
   src = fetchurl {
-    url = "http://dl.lm-sensors.org/lm-sensors/releases/lm_sensors-${version}.tar.bz2";
-    sha256 = "1ksgrynxgrq590nb2fwxrl1gwzisjkqlyg3ljfd1al0ibrk6mbjx";
+    urls = [
+      "http://dl.lm-sensors.org/lm-sensors/releases/lm_sensors-${version}.tar.bz2"
+      "http://pkgs.fedoraproject.org/repo/pkgs/lm_sensors/lm_sensors-${version}.tar.bz2/c03675ae9d43d60322110c679416901a/lm_sensors-${version}.tar.bz2"
+    ];
+    sha256 = "07q6811l4pp0f7pxr8bk3s97ippb84mx5qdg7v92s9hs10b90mz0";
   };
 
   buildInputs = [ bison flex which perl ];
diff --git a/pkgs/os-specific/linux/lsscsi/default.nix b/pkgs/os-specific/linux/lsscsi/default.nix
index 70e82662b41..03a587cdd3e 100644
--- a/pkgs/os-specific/linux/lsscsi/default.nix
+++ b/pkgs/os-specific/linux/lsscsi/default.nix
@@ -3,11 +3,11 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation {
-  name = "lsscsi-0.27";
+  name = "lsscsi-0.28";
 
   src = fetchurl {
-    url = "http://sg.danny.cz/scsi/lsscsi-0.27.tgz";
-    sha256 = "1d6rl2jwpd6zlqymmp9z4ri5j43d44db2s71j0v0rzs1nbvm90kb";
+    url = "http://sg.danny.cz/scsi/lsscsi-0.28.tgz";
+    sha256 = "0l6xz8545lnfd9f4z974ar1pbzfdkr6c8r56zjrcaazl3ad00p82";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index 9147cb81371..5af100eacb2 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, systemd, libudev, utillinux, coreutils, enable_dmeventd ? false }:
+{ stdenv, fetchurl, pkgconfig, systemd, libudev, utillinux, coreutils, libuuid, enable_dmeventd ? false }:
 
 let
   version = "2.02.140";
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   ] ++ stdenv.lib.optional enable_dmeventd " --enable-dmeventd";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libudev ];
+  buildInputs = [ libudev libuuid ];
 
   preConfigure =
     ''
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 4ac5d0c7951..275f325b84a 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -80,6 +80,6 @@ stdenv.mkDerivation rec {
     '';
 
     platforms = platforms.linux;
-    maintainers = with maintainers; [ simons wkennington globin fpletz ];
+    maintainers = with maintainers; [ wkennington globin fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index 254a5ce4e28..a376e1f8459 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "mcelog-${version}";
-  version = "136";
+  version = "137";
 
   src = fetchFromGitHub {
-    sha256 = "0bk46vi39cifahqwrkzivqf4fr34aqfip960x7awks9hiil8skwr";
+    sha256 = "0kx4jcgs2h5jvrjyrkn92vl2wxg6ny4sipzs2mlszcr4ky27am6z";
     rev = "v${version}";
     repo = "mcelog";
     owner = "andikleen";
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index 3fe9d462412..3a04466ce41 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -29,7 +29,9 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = "-std=gnu89";
 
   preConfigure = ''
-    sed -e 's@/lib/udev@''${out}/lib/udev@' -e 's@ -Werror @ @' -i Makefile
+    sed -e 's@/lib/udev@''${out}/lib/udev@' \
+        -e 's@ -Werror @ @' \
+        -e 's@/usr/sbin/sendmail@/var/setuid-wrappers/sendmail@' -i Makefile
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/numad/default.nix b/pkgs/os-specific/linux/numad/default.nix
index 7310e7e36ad..ed84c41001b 100644
--- a/pkgs/os-specific/linux/numad/default.nix
+++ b/pkgs/os-specific/linux/numad/default.nix
@@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
     homepage = https://fedoraproject.org/wiki/Features/numad;
     license = licenses.lgpl21;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ iElectric ];
+    maintainers = with maintainers; [ domenkozar ];
   };
 }
diff --git a/pkgs/os-specific/linux/pm-utils/default.nix b/pkgs/os-specific/linux/pm-utils/default.nix
index cb74dc204a3..e2257642d0b 100644
--- a/pkgs/os-specific/linux/pm-utils/default.nix
+++ b/pkgs/os-specific/linux/pm-utils/default.nix
@@ -6,7 +6,7 @@ let
   binPath = stdenv.lib.makeBinPath
     [ coreutils gnugrep utillinux kmod procps kbd dbus_tools ];
 
-  sbinPath = stdenv.lib.makeSearchPathOutputs "sbin" ["bin"]
+  sbinPath = stdenv.lib.makeSearchPathOutput "bin" "sbin"
     [ procps ];
 
 in
diff --git a/pkgs/os-specific/linux/pmtools/default.nix b/pkgs/os-specific/linux/pmtools/default.nix
index 7fa32ce4c94..a284924f005 100644
--- a/pkgs/os-specific/linux/pmtools/default.nix
+++ b/pkgs/os-specific/linux/pmtools/default.nix
@@ -18,8 +18,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.lesswatts.org/projects/acpi/utilities.php;
     description = "Linux ACPI utilities";
     license = stdenv.lib.licenses.gpl2;
-
     platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.simons ];
   };
 }
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 0f066e380c1..15ec3202e6b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,7 +1,8 @@
 { stdenv, fetchFromGitHub, pkgconfig, intltool, gperf, libcap, kmod
 , zlib, xz, pam, acl, cryptsetup, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libapparmor, audit, lz4
-, kexectools, libmicrohttpd, linuxHeaders, libseccomp
+, kexectools, libmicrohttpd, linuxHeaders ? stdenv.cc.libc.linuxHeaders, libseccomp
+, iptables
 , autoreconfHook, gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
 , enableKDbus ? false
 }:
@@ -33,6 +34,7 @@ stdenv.mkDerivation rec {
     [ linuxHeaders pkgconfig intltool gperf libcap kmod xz pam acl
       /* cryptsetup */ libuuid m4 glib libxslt libgcrypt libgpgerror
       libmicrohttpd kexectools libseccomp libffi audit lz4 libapparmor
+      iptables
       /* FIXME: we may be able to prevent the following dependencies
          by generating an autoconf'd tarball, but that's probably not
          worth it. */
@@ -206,7 +208,6 @@ stdenv.mkDerivation rec {
     homepage = "http://www.freedesktop.org/wiki/Software/systemd";
     description = "A system and service manager for Linux";
     platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.eelco stdenv.lib.maintainers.simons ];
+    maintainers = [ stdenv.lib.maintainers.eelco ];
   };
 }
-
diff --git a/pkgs/os-specific/linux/tcp-wrappers/builder.sh b/pkgs/os-specific/linux/tcp-wrappers/builder.sh
deleted file mode 100644
index 7ea574fcf23..00000000000
--- a/pkgs/os-specific/linux/tcp-wrappers/builder.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-source "$stdenv/setup" || exit 1
-
-# Unpack
-unpackPhase
-cd "$sourceRoot/upstream/tarballs"
-tar xzvf *
-cd tcp_wrappers_7.6
-
-# Patch
-patchPhase
-for patch in debian/patches/*
-do
-  echo "applying Debian patch \`$(basename $patch)'..."
-  patch --batch -p1 < $patch
-done
-
-substituteInPlace "Makefile" --replace				\
-   "REAL_DAEMON_DIR=/usr/sbin" "REAL_DAEMON_DIR=$out/sbin"	\
-   --replace "/tmp" '$$TMPDIR'
-
-echo "building..."
-make REAL_DAEMON_DIR="$out/sbin" linux
-
-# Install
-mkdir -p "$out/sbin"
-cp -v safe_finger tcpd tcpdchk tcpdmatch try-from "$out/sbin"
-
-mkdir -p "$out/lib"
-cp -v shared/lib*.so* "$out/lib"
-
-mkdir -p "$out/include"
-cp -v *.h "$out/include"
-
-mkdir -p "$out/man"
-for i in 3 5 8;
-do
-  mkdir -p "$out/man/man$i"
-  cp *.$i "$out/man/man$i" ;
-done
diff --git a/pkgs/os-specific/linux/tcp-wrappers/default.nix b/pkgs/os-specific/linux/tcp-wrappers/default.nix
index a3f79cd05a8..eb50fc0abce 100644
--- a/pkgs/os-specific/linux/tcp-wrappers/default.nix
+++ b/pkgs/os-specific/linux/tcp-wrappers/default.nix
@@ -15,7 +15,40 @@ stdenv.mkDerivation {
      })
   ];
 
-  builder = ./builder.sh;
+  prePatch = ''
+    cd upstream/tarballs
+    tar xzvf *
+    cd tcp_wrappers_7.6
+  '';
+
+  postPatch = ''
+    for patch in debian/patches/*; do
+      echo "applying Debian patch \`$(basename $patch)'..."
+      patch --batch -p1 < $patch
+    done
+  '';
+
+  buildPhase = ''
+    make REAL_DAEMON_DIR="$out/sbin" linux
+  '';
+
+  installPhase = ''
+    mkdir -p "$out/sbin"
+    cp -v safe_finger tcpd tcpdchk tcpdmatch try-from "$out/sbin"
+
+    mkdir -p "$out/lib"
+    cp -v shared/lib*.so* "$out/lib"
+
+    mkdir -p "$out/include"
+    cp -v *.h "$out/include"
+
+    mkdir -p "$out/man"
+    for i in 3 5 8;
+    do
+      mkdir -p "$out/man/man$i"
+      cp *.$i "$out/man/man$i" ;
+    done
+  '';
 
   meta = {
     description = "TCP Wrappers, a network logger, also known as TCPD or LOG_TCP";
@@ -32,7 +65,7 @@ stdenv.mkDerivation {
     '';
 
     homepage = ftp://ftp.porcupine.org/pub/security/index.html;
-
     license = "BSD-style";
+    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/os-specific/linux/udev/182.nix b/pkgs/os-specific/linux/udev/182.nix
index fcf06e3e899..33a4907c7ca 100644
--- a/pkgs/os-specific/linux/udev/182.nix
+++ b/pkgs/os-specific/linux/udev/182.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
                      "--disable-introspection"
                    ];
 
+  postPatch = ''
+    sed -i 's:input.h:input-event-codes.h:' Makefile.in
+    sed -i '20a#include <stdint.h>' src/mtd_probe/mtd_probe.h
+  '';
+
   NIX_LDFLAGS = [ "-lrt" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 263fa4490dc..5c3a0d78d99 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl, pkgconfig, zlib, ncurses ? null, perl ? null, pam, systemd }:
 
 stdenv.mkDerivation rec {
-  name = "util-linux-2.27.1";
+  name = "util-linux-${version}";
+  version = "2.28";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/util-linux/v2.27/${name}.tar.xz";
-    sha256 = "1452hz5zx56a3mad8yrg5wb0vy5zi19mpjp6zx1yr6p9xp6qz08a";
+    url = "mirror://kernel/linux/utils/util-linux/v${version}/${name}.tar.xz";
+    sha256 = "1fql204qn3098j34yd358l85ffp7a4kqjf7jf1qk2b4al7i4fn1r";
   };
 
   patches = [
@@ -63,7 +64,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage = http://www.kernel.org/pub/linux/utils/util-linux/;
+    homepage = https://www.kernel.org/pub/linux/utils/util-linux/;
     description = "A set of system utilities for Linux";
     license = licenses.gpl2; # also contains parts under more permissive licenses
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
index 68970c655f1..3615984ed0c 100644
--- a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
+++ b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
@@ -3,23 +3,24 @@ which isn't valid on NixOS (and a compatibility link on most other modern
 distros anyway).
 
   -- nckx <tobias.geerinckx.rice@gmail.com>
-
-diff -ru util-linux-2.27-orig/include/pathnames.h util-linux-2.27/include/pathnames.h
---- util-linux-2.27-orig/include/pathnames.h	2015-06-29 13:13:14.669847478 +0200
-+++ util-linux-2.27/include/pathnames.h	2015-10-07 20:09:17.401022602 +0200
-@@ -54,7 +54,7 @@
- #define _PATH_INITTAB		"/etc/inittab"
- #define _PATH_RC		"/etc/rc"
- #define _PATH_REBOOT		"/sbin/reboot"
+diff --git a/include/pathnames.h b/include/pathnames.h
+index de6a13c..0c1aeb9 100644
+--- a/include/pathnames.h
++++ b/include/pathnames.h
+@@ -50,7 +50,7 @@
+ #define	_PATH_VAR_NOLOGIN	"/var/run/nologin"
+ 
+ #define _PATH_LOGIN		"/bin/login"
 -#define _PATH_SHUTDOWN		"/sbin/shutdown"
 +#define _PATH_SHUTDOWN		"shutdown"
- #define _PATH_SINGLE		"/etc/singleboot"
- #define _PATH_SHUTDOWN_CONF	"/etc/shutdown.conf"
  
-diff -ru util-linux-2.27-orig/sys-utils/rtcwake.c util-linux-2.27/sys-utils/rtcwake.c
---- util-linux-2.27-orig/sys-utils/rtcwake.c	2015-08-05 11:32:44.453821232 +0200
-+++ util-linux-2.27/sys-utils/rtcwake.c	2015-10-07 20:09:37.834032536 +0200
-@@ -576,7 +576,7 @@
+ #define _PATH_TERMCOLORS_DIRNAME "terminal-colors.d"
+ #define _PATH_TERMCOLORS_DIR	"/etc/" _PATH_TERMCOLORS_DIRNAME
+diff --git a/sys-utils/rtcwake.c b/sys-utils/rtcwake.c
+index 7c748dc..9a99a7c 100644
+--- a/sys-utils/rtcwake.c
++++ b/sys-utils/rtcwake.c
+@@ -575,7 +575,7 @@ int main(int argc, char **argv)
  		arg[i++] = "now";
  		arg[i]   = NULL;
  		if (!ctl.dryrun) {
diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index 17b21f92c17..476f3ffcac6 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
     sha256 = "0k46z5gqjzg702m2vs4sv6sxynq1sj14m0pgwvl2gkgg3dfbyjhn";
   };
 
+  outputs = [ "dev" "out" ];
+
   configureFlags = [
     "--enable-libv4l"
   ] ++ (if (alsaLib != null && libX11 != null && (qt4 != null || qt5 != null)) then [
@@ -36,15 +38,15 @@ stdenv.mkDerivation rec {
     "--disable-qv4l2"
   ]);
 
-  postInstall = ''
+  postFixup = ''
     # Create symlink for V4l1 compatibility
-    ln -s $out/include/libv4l1-videodev.h $out/include/videodev.h
+    ln -s "$dev/include/libv4l1-videodev.h" "$dev/include/videodev.h"
   '';
 
   nativeBuildInputs = [ pkgconfig ];
 
   buildInputs = [ alsaLib libX11 qt4 qt5 ];
-  
+
   propagatedBuildInputs = [ libjpeg ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 376a407d993..57f4b9ab674 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     description = "A kernel module to create V4L2 loopback devices";
     homepage = https://github.com/umlaeute/v4l2loopback;
     license = licenses.gpl2;
-    maintainers = [ maintainers.iElectric ];
+    maintainers = [ maintainers.domenkozar ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
index cca9dc09e93..b4997714cea 100644
--- a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
+++ b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "Set the energy versus performance policy preference bias on recent X86 processors";
-    homepage = https://www.kernel.org.org/;
+    homepage = https://www.kernel.org/;
     license = licenses.gpl2;
     platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
   };
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index bf15b208e1a..a9df0d29e09 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -4,14 +4,15 @@
 }:
 
 let
-  name = "mingw-w64-3.1.0";
+  version = "4.0.6";
+  name = "mingw-w64-${version}";
 in
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation ({
   inherit name;
 
   src = fetchurl {
-    url = "mirror://sourceforge/mingw-w64/mingw-w64-v3.1.0.tar.bz2";
-    sha256 = "1lhpw381gc59w8b1r9zzdwa9cdi2wx6qx7s6rvajapmbw7ksgrzc";
+    url = "mirror://sourceforge/mingw-w64/mingw-w64-v${version}.tar.bz2";
+    sha256 = "0p01vm5kx1ixc08402z94g1alip4vx66gjpvyi9maqyqn2a76h0c";
   };
 } //
 (if onlyHeaders then {