2014-04-14 16:26:48 +02:00
|
|
|
{ config, lib, pkgs, ... }:
|
2013-05-13 15:13:06 +02:00
|
|
|
|
2012-07-17 01:47:41 +02:00
|
|
|
let
|
2015-03-12 10:11:25 +01:00
|
|
|
inherit (lib) mkIf mkOption types concatMapStrings;
|
2012-07-17 01:47:41 +02:00
|
|
|
cfg = config.security.apparmor;
|
|
|
|
in
|
2015-03-12 10:11:25 +01:00
|
|
|
|
2012-07-17 01:47:41 +02:00
|
|
|
{
|
2015-03-12 10:11:25 +01:00
|
|
|
options = {
|
|
|
|
security.apparmor = {
|
|
|
|
enable = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
|
|
|
description = "Enable the AppArmor Mandatory Access Control system.";
|
|
|
|
};
|
|
|
|
profiles = mkOption {
|
|
|
|
type = types.listOf types.path;
|
|
|
|
default = [];
|
|
|
|
description = "List of files containing AppArmor profiles.";
|
|
|
|
};
|
2017-01-10 22:47:23 +01:00
|
|
|
packages = mkOption {
|
|
|
|
type = types.listOf types.package;
|
|
|
|
default = [];
|
|
|
|
description = "List of packages to be added to apparmor's include path";
|
|
|
|
};
|
2015-03-12 10:11:25 +01:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
config = mkIf cfg.enable {
|
2015-03-17 11:04:31 +01:00
|
|
|
environment.systemPackages = [ pkgs.apparmor-utils ];
|
2015-03-12 10:11:25 +01:00
|
|
|
|
2019-05-11 18:19:35 +02:00
|
|
|
boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
|
|
|
|
|
2017-01-10 22:47:23 +01:00
|
|
|
systemd.services.apparmor = let
|
|
|
|
paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d")
|
|
|
|
([ pkgs.apparmor-profiles ] ++ cfg.packages);
|
|
|
|
in {
|
2019-04-28 14:22:19 +02:00
|
|
|
after = [ "local-fs.target" ];
|
|
|
|
before = [ "sysinit.target" ];
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
unitConfig = {
|
|
|
|
DefaultDependencies = "no";
|
|
|
|
};
|
2015-03-12 10:11:25 +01:00
|
|
|
serviceConfig = {
|
|
|
|
Type = "oneshot";
|
|
|
|
RemainAfterExit = "yes";
|
2017-01-10 22:47:23 +01:00
|
|
|
ExecStart = map (p:
|
|
|
|
''${pkgs.apparmor-parser}/bin/apparmor_parser -rKv ${paths} "${p}"''
|
2015-03-12 10:11:25 +01:00
|
|
|
) cfg.profiles;
|
2017-01-10 22:47:23 +01:00
|
|
|
ExecStop = map (p:
|
|
|
|
''${pkgs.apparmor-parser}/bin/apparmor_parser -Rv "${p}"''
|
2015-03-12 10:11:25 +01:00
|
|
|
) cfg.profiles;
|
2019-04-28 15:12:37 +02:00
|
|
|
ExecReload = map (p:
|
|
|
|
''${pkgs.apparmor-parser}/bin/apparmor_parser --reload ${paths} "${p}"''
|
|
|
|
) cfg.profiles;
|
2015-03-12 10:11:25 +01:00
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
2012-07-17 01:47:41 +02:00
|
|
|
}
|