commit 3ff22a924f1bd9c67a57566fe81d68120ce1d37f · pyrox.dev/nixpkgs

+3 -15

nixos/modules/security/apparmor.nix

···

       6
       6
        
       in

     

       7
       7
        
       

     

       8
       8
        
       {

     

       9
       9
       -
          #### interface

     

       10
       9
        
          options = {

     

       11
       11
       -
       

     

       12
       10
        
            security.apparmor = {

     

       13
       13
       -
       

     

       14
       11
        
              enable = mkOption {

     

       15
       12
        
                type = types.bool;

     

       16
       13
        
                default = false;

     

       17
       14
        
                description = "Enable the AppArmor Mandatory Access Control system.";

     

       18
       15
        
              };

     

       19
       19
       -
       

     

       20
       16
        
              profiles = mkOption {

     

       21
       17
        
                type = types.listOf types.path;

     

       22
       18
        
                default = [];

     

       23
       19
        
                description = "List of files containing AppArmor profiles.";

     

       24
       20
        
              };

     

       25
       25
       -
       

     

       26
       21
        
            };

     

       27
       27
       -
       

     

       28
       22
        
          };

     

       29
       23
        
       

     

       30
       30
       -
          #### implementation

     

       31
       24
        
          config = mkIf cfg.enable {

     

       32
       32
       -
       

     

       33
       33
       -
            environment.systemPackages = [

     

       34
       34
       -
              pkgs.apparmor-utils

     

       35
       35
       -
            ];

     

       25
       25
       +
            environment.systemPackages = [ pkgs.apparmor-utils ];

     

       36
       26
        
       

     

       37
       27
        
            systemd.services.apparmor = {

     

       38
       28
        
              wantedBy = [ "local-fs.target" ];

     

       39
       39
       -
       

     

       40
       29
        
              serviceConfig = {

     

       41
       30
        
                Type = "oneshot";

     

       42
       31
        
                RemainAfterExit = "yes";

     
···

       50
       39
        
            };

     

       51
       40
        
       

     

       52
       41
        
            security.pam.services.apparmor.text = ''

     

       53
       53
       -
              ## The AppArmor service changes hats according to order: first try

     

       54
       54
       -
              ## user, then group, and finally fall back to a hat called "DEFAULT"

     

       42
       42
       +
              ## AppArmor changes hats according to `order`: first try user, then

     

       43
       43
       +
              ## group, and finally fall back to a hat called "DEFAULT"

     

       55
       44
        
              ##

     

       56
       45
        
              ## For now, enable debugging as this is an experimental feature.

     

       57
       46
        
              session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug

     

       58
       47
        
            '';

     

       59
       59
       -
       

     

       60
       48
        
          };

     

       61
       49
        
       }

+13 -26

pkgs/os-specific/linux/apparmor/2.9/default.nix

···

       20
       20
        
           sha256 = "a63b8724c36c29ed438c9e3ca403bfeeb6c998a45990e300aa1b10faa23a0a22";

     

       21
       21
        
         };

     

       22
       22
        
       

     

       23
       23
       +
         prePatchCommon = ''

     

       24
       24
       +
           substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"

     

       25
       25
       +
           substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"

     

       26
       26
       +
           substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     

       27
       27
       +
           substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"

     

       28
       28
       +
         '';

     

       29
       29
       +
       

     

       23
       30
        
         libapparmor = stdenv.mkDerivation {

     

       24
       31
        
           name = "libapparmor-${apparmor-version}";

     

       25
       32
        
           src = apparmor-sources;

     
···

       39
       46
        
             which

     

       40
       47
        
           ];

     

       41
       48
        
       

     

       42
       42
       -
           prePatch = ''

     

       43
       43
       -
             ### common

     

       44
       44
       -
             substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"

     

       45
       45
       -
             substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"

     

       46
       46
       -
             substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     

       47
       47
       -
       

     

       48
       48
       -
             ### libapparmor

     

       49
       49
       +
           prePatch = prePatchCommon + ''

     

       49
       50
        
             substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h"

     

       50
       51
        
             substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h"

     

       51
       52
        
             '';

     

       52
       53
        
       

     

       53
       54
        
           buildPhase = ''

     

       54
       54
       -
             ### libapparmor

     

       55
       55
        
             cd ./libraries/libapparmor

     

       56
       56
        
             ./autogen.sh

     

       57
       57
        
             ./configure --prefix="$out" --with-python

     
···

       75
       75
        
             which

     

       76
       76
        
           ];

     

       77
       77
        
       

     

       78
       78
       -
           prePatch = ''

     

       79
       79
       -
             ### common

     

       80
       80
       -
             substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"

     

       81
       81
       -
             substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"

     

       82
       82
       -
             substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     

       83
       83
       -
           '';

     

       78
       78
       +
           prePatch = prePatchCommon;

     

       84
       79
        
       

     

       85
       80
        
           buildPhase = ''

     

       86
       81
        
             cd ./utils

     
···

       88
       83
        
           '';

     

       89
       84
        
       

     

       90
       85
        
           installPhase = ''

     

       91
       91
       -
             make install LANGS="" DESTDIR="$out" BINDIR="$out/bin"

     

       86
       86
       +
             make install LANGS="" DESTDIR="$out" BINDIR="$out/bin" VIM_INSTALL_PATH="$out/share" PYPREFIX=""

     

       92
       87
        
           '';

     

       93
       88
        
       

     

       94
       89
        
           meta = apparmor-meta "user-land utilities";

     
···

       105
       100
        
             which

     

       106
       101
        
           ];

     

       107
       102
        
       

     

       108
       108
       -
           prePatch = ''

     

       109
       109
       -
             ### common

     

       110
       110
       -
             substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"

     

       111
       111
       -
             substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"

     

       112
       112
       -
             substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     

       113
       113
       -
       

     

       114
       114
       -
             ### apparmor-parser

     

       103
       103
       +
           prePatch = prePatchCommon + ''

     

       115
       104
        
             substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison"

     

       116
       105
        
             substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex"

     

       117
       106
        
             substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     
···

       158
       147
        
           name = "apparmor-profiles-${apparmor-version}";

     

       159
       148
        
           src = apparmor-sources;

     

       160
       149
        
       

     

       161
       161
       -
           buildInputs = [

     

       162
       162
       -
             which

     

       163
       163
       -
           ];

     

       150
       150
       +
           buildInputs = [ which ];

     

       164
       151
        
       

     

       165
       152
        
           buildPhase = ''

     

       166
       153
        
             cd ./profiles

     
···

       168
       155
        
           '';

     

       169
       156
        
       

     

       170
       157
        
           installPhase = ''

     

       171
       171
       -
             make install DESTDIR="$out"

     

       158
       158
       +
             make install DESTDIR="$out" EXTRAS_DEST="$out/share/apparmor/extra-profiles"

     

       172
       159
        
           '';

     

       173
       160
        
       

     

       174
       161
        
           meta = apparmor-meta "profiles";