···

       
6
       
 
       
in

     

       
7
       
 
       


     

       
8
       
 
       
{

     

       
9
       
-
       
   #### interface

     

       
10
       
 
       
   options = {

     

       
11
       
-
       


     

       
12
       
 
       
     security.apparmor = {

     

       
13
       
-
       


     

       
14
       
 
       
       enable = mkOption {

     

       
15
       
 
       
         type = types.bool;

     

       
16
       
 
       
         default = false;

     

       
17
       
 
       
         description = "Enable the AppArmor Mandatory Access Control system.";

     

       
18
       
 
       
       };

     

       
19
       
-
       


     

       
20
       
 
       
       profiles = mkOption {

     

       
21
       
 
       
         type = types.listOf types.path;

     

       
22
       
 
       
         default = [];

     

       
23
       
 
       
         description = "List of files containing AppArmor profiles.";

     

       
24
       
 
       
       };

     

       
25
       
-
       


     

       
26
       
 
       
     };

     

       
27
       
-
       


     

       
28
       
 
       
   };

     

       
29
       
 
       


     

       
30
       
-
       
   #### implementation

     

       
31
       
 
       
   config = mkIf cfg.enable {

     

       
32
       
-
       


     

       
33
       
-
       
     environment.systemPackages = [

     

       
34
       
-
       
       pkgs.apparmor-utils

     

       
35
       
-
       
     ];

     

       
36
       
 
       


     

       
37
       
 
       
     systemd.services.apparmor = {

     

       
38
       
 
       
       wantedBy = [ "local-fs.target" ];

     

       
39
       
-
       


     

       
40
       
 
       
       serviceConfig = {

     

       
41
       
 
       
         Type = "oneshot";

     

       
42
       
 
       
         RemainAfterExit = "yes";

     
···

       
50
       
 
       
     };

     

       
51
       
 
       


     

       
52
       
 
       
     security.pam.services.apparmor.text = ''

     

       
53
       
-
       
       ## The AppArmor service changes hats according to order: first try

     

       
54
       
-
       
       ## user, then group, and finally fall back to a hat called "DEFAULT"

     

       
55
       
 
       
       ##

     

       
56
       
 
       
       ## For now, enable debugging as this is an experimental feature.

     

       
57
       
 
       
       session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug

     

       
58
       
 
       
     '';

     

       
59
       
-
       


     

       
60
       
 
       
   };

     

       
61
       
 
       
}

     

···

       
6
       
 
       
in

     

       
7
       
 
       


     

       
8
       
 
       
{

     

       
0
       
 
       

     

       
9
       
 
       
   options = {

     

       
0
       
 
       

     

       
10
       
 
       
     security.apparmor = {

     

       
0
       
 
       

     

       
11
       
 
       
       enable = mkOption {

     

       
12
       
 
       
         type = types.bool;

     

       
13
       
 
       
         default = false;

     

       
14
       
 
       
         description = "Enable the AppArmor Mandatory Access Control system.";

     

       
15
       
 
       
       };

     

       
0
       
 
       

     

       
16
       
 
       
       profiles = mkOption {

     

       
17
       
 
       
         type = types.listOf types.path;

     

       
18
       
 
       
         default = [];

     

       
19
       
 
       
         description = "List of files containing AppArmor profiles.";

     

       
20
       
 
       
       };

     

       
0
       
 
       

     

       
21
       
 
       
     };

     

       
0
       
 
       

     

       
22
       
 
       
   };

     

       
23
       
 
       


     

       
0
       
 
       

     

       
24
       
 
       
   config = mkIf cfg.enable {

     

       
25
       
+
       
     environment.systemPackages = [ pkgs.apparmor-utils ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
26
       
 
       


     

       
27
       
 
       
     systemd.services.apparmor = {

     

       
28
       
 
       
       wantedBy = [ "local-fs.target" ];

     

       
0
       
 
       

     

       
29
       
 
       
       serviceConfig = {

     

       
30
       
 
       
         Type = "oneshot";

     

       
31
       
 
       
         RemainAfterExit = "yes";

     
···

       
39
       
 
       
     };

     

       
40
       
 
       


     

       
41
       
 
       
     security.pam.services.apparmor.text = ''

     

       
42
       
+
       
       ## AppArmor changes hats according to `order`: first try user, then

     

       
43
       
+
       
       ## group, and finally fall back to a hat called "DEFAULT"

     

       
44
       
 
       
       ##

     

       
45
       
 
       
       ## For now, enable debugging as this is an experimental feature.

     

       
46
       
 
       
       session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug

     

       
47
       
 
       
     '';

     

       
0
       
 
       

     

       
48
       
 
       
   };

     

       
49
       
 
       
}

     

···

       
20
       
 
       
    sha256 = "a63b8724c36c29ed438c9e3ca403bfeeb6c998a45990e300aa1b10faa23a0a22";

     

       
21
       
 
       
  };

     

       
22
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
23
       
 
       
  libapparmor = stdenv.mkDerivation {

     

       
24
       
 
       
    name = "libapparmor-${apparmor-version}";

     

       
25
       
 
       
    src = apparmor-sources;

     
···

       
39
       
 
       
      which

     

       
40
       
 
       
    ];

     

       
41
       
 
       


     

       
42
       
-
       
    prePatch = ''

     

       
43
       
-
       
      ### common

     

       
44
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"

     

       
45
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"

     

       
46
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     

       
47
       
-
       


     

       
48
       
-
       
      ### libapparmor

     

       
49
       
 
       
      substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h"

     

       
50
       
 
       
      substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h"

     

       
51
       
 
       
      '';

     

       
52
       
 
       


     

       
53
       
 
       
    buildPhase = ''

     

       
54
       
-
       
      ### libapparmor

     

       
55
       
 
       
      cd ./libraries/libapparmor

     

       
56
       
 
       
      ./autogen.sh

     

       
57
       
 
       
      ./configure --prefix="$out" --with-python

     
···

       
75
       
 
       
      which

     

       
76
       
 
       
    ];

     

       
77
       
 
       


     

       
78
       
-
       
    prePatch = ''

     

       
79
       
-
       
      ### common

     

       
80
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"

     

       
81
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"

     

       
82
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     

       
83
       
-
       
    '';

     

       
84
       
 
       


     

       
85
       
 
       
    buildPhase = ''

     

       
86
       
 
       
      cd ./utils

     
···

       
88
       
 
       
    '';

     

       
89
       
 
       


     

       
90
       
 
       
    installPhase = ''

     

       
91
       
-
       
      make install LANGS="" DESTDIR="$out" BINDIR="$out/bin"

     

       
92
       
 
       
    '';

     

       
93
       
 
       


     

       
94
       
 
       
    meta = apparmor-meta "user-land utilities";

     
···

       
105
       
 
       
      which

     

       
106
       
 
       
    ];

     

       
107
       
 
       


     

       
108
       
-
       
    prePatch = ''

     

       
109
       
-
       
      ### common

     

       
110
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"

     

       
111
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"

     

       
112
       
-
       
      substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     

       
113
       
-
       


     

       
114
       
-
       
      ### apparmor-parser

     

       
115
       
 
       
      substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison"

     

       
116
       
 
       
      substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex"

     

       
117
       
 
       
      substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     
···

       
158
       
 
       
    name = "apparmor-profiles-${apparmor-version}";

     

       
159
       
 
       
    src = apparmor-sources;

     

       
160
       
 
       


     

       
161
       
-
       
    buildInputs = [

     

       
162
       
-
       
      which

     

       
163
       
-
       
    ];

     

       
164
       
 
       


     

       
165
       
 
       
    buildPhase = ''

     

       
166
       
 
       
      cd ./profiles

     
···

       
168
       
 
       
    '';

     

       
169
       
 
       


     

       
170
       
 
       
    installPhase = ''

     

       
171
       
-
       
      make install DESTDIR="$out"

     

       
172
       
 
       
    '';

     

       
173
       
 
       


     

       
174
       
 
       
    meta = apparmor-meta "profiles";

     

···

       
20
       
 
       
    sha256 = "a63b8724c36c29ed438c9e3ca403bfeeb6c998a45990e300aa1b10faa23a0a22";

     

       
21
       
 
       
  };

     

       
22
       
 
       


     

       
23
       
+
       
  prePatchCommon = ''

     

       
24
       
+
       
    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"

     

       
25
       
+
       
    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"

     

       
26
       
+
       
    substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     

       
27
       
+
       
    substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"

     

       
28
       
+
       
  '';

     

       
29
       
+
       


     

       
30
       
 
       
  libapparmor = stdenv.mkDerivation {

     

       
31
       
 
       
    name = "libapparmor-${apparmor-version}";

     

       
32
       
 
       
    src = apparmor-sources;

     
···

       
46
       
 
       
      which

     

       
47
       
 
       
    ];

     

       
48
       
 
       


     

       
49
       
+
       
    prePatch = prePatchCommon + ''

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
50
       
 
       
      substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h"

     

       
51
       
 
       
      substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h"

     

       
52
       
 
       
      '';

     

       
53
       
 
       


     

       
54
       
 
       
    buildPhase = ''

     

       
0
       
 
       

     

       
55
       
 
       
      cd ./libraries/libapparmor

     

       
56
       
 
       
      ./autogen.sh

     

       
57
       
 
       
      ./configure --prefix="$out" --with-python

     
···

       
75
       
 
       
      which

     

       
76
       
 
       
    ];

     

       
77
       
 
       


     

       
78
       
+
       
    prePatch = prePatchCommon;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
79
       
 
       


     

       
80
       
 
       
    buildPhase = ''

     

       
81
       
 
       
      cd ./utils

     
···

       
83
       
 
       
    '';

     

       
84
       
 
       


     

       
85
       
 
       
    installPhase = ''

     

       
86
       
+
       
      make install LANGS="" DESTDIR="$out" BINDIR="$out/bin" VIM_INSTALL_PATH="$out/share" PYPREFIX=""

     

       
87
       
 
       
    '';

     

       
88
       
 
       


     

       
89
       
 
       
    meta = apparmor-meta "user-land utilities";

     
···

       
100
       
 
       
      which

     

       
101
       
 
       
    ];

     

       
102
       
 
       


     

       
103
       
+
       
    prePatch = prePatchCommon + ''

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
104
       
 
       
      substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison"

     

       
105
       
 
       
      substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex"

     

       
106
       
 
       
      substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"

     
···

       
147
       
 
       
    name = "apparmor-profiles-${apparmor-version}";

     

       
148
       
 
       
    src = apparmor-sources;

     

       
149
       
 
       


     

       
150
       
+
       
    buildInputs = [ which ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
151
       
 
       


     

       
152
       
 
       
    buildPhase = ''

     

       
153
       
 
       
      cd ./profiles

     
···

       
155
       
 
       
    '';

     

       
156
       
 
       


     

       
157
       
 
       
    installPhase = ''

     

       
158
       
+
       
      make install DESTDIR="$out" EXTRAS_DEST="$out/share/apparmor/extra-profiles"

     

       
159
       
 
       
    '';

     

       
160
       
 
       


     

       
161
       
 
       
    meta = apparmor-meta "profiles";