···

       
37
       
37
       
 
       
         ) cfg.profiles;

     

       
38
       
38
       
 
       
       };

     

       
39
       
39
       
 
       
     };

     

       
40
       
40
       
-
       


     

       
41
       
41
       
-
       
     security.pam.services.apparmor.text = ''

     

       
42
       
42
       
-
       
       ## AppArmor changes hats according to `order`: first try user, then

     

       
43
       
43
       
-
       
       ## group, and finally fall back to a hat called "DEFAULT"

     

       
44
       
44
       
-
       
       ##

     

       
45
       
45
       
-
       
       ## For now, enable debugging as this is an experimental feature.

     

       
46
       
46
       
-
       
       session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug

     

       
47
       
47
       
-
       
     '';

     

       
48
       
40
       
 
       
   };

     

       
49
       
41
       
 
       
}

     

···

       
192
       
192
       
 
       
        description = "Whether to log authentication failures in <filename>/var/log/faillog</filename>.";

     

       
193
       
193
       
 
       
      };

     

       
194
       
194
       
 
       


     

       
195
       
195
       
+
       
      enableAppArmor = mkOption {

     

       
196
       
196
       
+
       
        default = false;

     

       
197
       
197
       
+
       
        type = types.bool;

     

       
198
       
198
       
+
       
        description = ''

     

       
199
       
199
       
+
       
          Enable support for attaching AppArmor profiles at the

     

       
200
       
200
       
+
       
          user/group level, e.g., as part of a role based access

     

       
201
       
201
       
+
       
          control scheme.

     

       
202
       
202
       
+
       
        '';

     

       
203
       
203
       
+
       
      };

     

       
204
       
204
       
+
       


     

       
195
       
205
       
 
       
      text = mkOption {

     

       
196
       
206
       
 
       
        type = types.nullOr types.lines;

     

       
197
       
207
       
 
       
        description = "Contents of the PAM service file.";

     
···

       
294
       
304
       
 
       
              "session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd}"}

     

       
295
       
305
       
 
       
          ${optionalString cfg.pamMount

     

       
296
       
306
       
 
       
              "session optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}

     

       
307
       
307
       
+
       
          ${optionalString (cfg.enableAppArmor && config.security.apparmor.enable)

     

       
308
       
308
       
+
       
              "session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug"}

     

       
297
       
309
       
 
       
        '';

     

       
298
       
310
       
 
       
    };

     

       
299
       
311