commit 45e5d726b22db783731f0460870e9ab4f06bc5c4 · pyrox.dev/nixpkgs

+33 -29

nixos/modules/security/apparmor.nix

···

       1
       1
        
       { config, lib, pkgs, ... }:

     

       2
       2
        
       

     

       3
       3
       +
       with lib;

     

       4
       4
       +
       

     

       3
       5
        
       let

     

       4
       6
        
         inherit (builtins) attrNames head map match readFile;

     

       5
       7
        
         inherit (lib) types;

     

       6
       8
        
         inherit (config.environment) etc;

     

       7
       9
        
         cfg = config.security.apparmor;

     

       8
       8
       -
         mkDisableOption = name: lib.mkEnableOption name // {

     

       10
       10
       +
         mkDisableOption = name: mkEnableOption name // {

     

       9
       11
        
           default = true;

     

       10
       12
        
           example = false;

     

       11
       13
        
         };

     

       12
       12
       -
         enabledPolicies = lib.filterAttrs (n: p: p.enable) cfg.policies;

     

       14
       14
       +
         enabledPolicies = filterAttrs (n: p: p.enable) cfg.policies;

     

       13
       15
        
       in

     

       14
       16
        
       

     

       15
       17
        
       {

     

       16
       18
        
         imports = [

     

       17
       17
       -
           (lib.mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])

     

       18
       18
       -
           (lib.mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")

     

       19
       19
       -
           (lib.mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")

     

       19
       19
       +
           (mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")

     

       20
       20
       +
           (mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")

     

       20
       21
        
           apparmor/includes.nix

     

       21
       22
        
           apparmor/profiles.nix

     

       22
       23
        
         ];

     

       23
       24
        
       

     

       24
       25
        
         options = {

     

       25
       26
        
           security.apparmor = {

     

       26
       26
       -
             enable = lib.mkEnableOption ''the AppArmor Mandatory Access Control system.

     

       27
       27
       +
             enable = mkEnableOption ''

     

       28
       28
       +
               the AppArmor Mandatory Access Control system.

     

       27
       29
        
       

     

       28
       30
        
               If you're enabling this module on a running system,

     

       29
       31
        
               note that a reboot will be required to activate AppArmor in the kernel.

     
···

       38
       40
        
               but leaves already running processes unconfined.

     

       39
       41
        
               Set <link linkend="opt-security.apparmor.killUnconfinedConfinables">killUnconfinedConfinables</link>

     

       40
       42
        
               to <literal>false</literal> if you prefer to leave those processes running'';

     

       41
       41
       -
             policies = lib.mkOption {

     

       43
       43
       +
             policies = mkOption {

     

       42
       44
        
               description = ''

     

       43
       45
        
                 AppArmor policies.

     

       44
       46
        
               '';

     
···

       46
       48
        
                 options = {

     

       47
       49
        
                   enable = mkDisableOption "loading of the profile into the kernel";

     

       48
       50
        
                   enforce = mkDisableOption "enforcing of the policy or only complain in the logs";

     

       49
       49
       -
                   profile = lib.mkOption {

     

       51
       51
       +
                   profile = mkOption {

     

       50
       52
        
                     description = "The policy of the profile.";

     

       51
       53
        
                     type = types.lines;

     

       52
       54
        
                     apply = pkgs.writeText name;

     
···

       55
       57
        
               }));

     

       56
       58
        
               default = {};

     

       57
       59
        
             };

     

       58
       58
       -
             includes = lib.mkOption {

     

       60
       60
       +
             includes = mkOption {

     

       59
       61
        
               type = types.attrsOf types.lines;

     

       60
       62
        
               default = {};

     

       61
       63
        
               description = ''

     

       62
       64
        
                 List of paths to be added to AppArmor's searched paths

     

       63
       65
        
                 when resolving <literal>include</literal> directives.

     

       64
       66
        
               '';

     

       65
       65
       -
               apply = lib.mapAttrs pkgs.writeText;

     

       67
       67
       +
               apply = mapAttrs pkgs.writeText;

     

       66
       68
        
             };

     

       67
       67
       -
             packages = lib.mkOption {

     

       69
       69
       +
             packages = mkOption {

     

       68
       70
        
               type = types.listOf types.package;

     

       69
       71
        
               default = [];

     

       70
       72
        
               description = "List of packages to be added to AppArmor's include path";

     

       71
       73
        
             };

     

       72
       72
       -
             enableCache = lib.mkEnableOption ''caching of AppArmor policies

     

       74
       74
       +
             enableCache = mkEnableOption ''

     

       75
       75
       +
               caching of AppArmor policies

     

       73
       76
        
               in <literal>/var/cache/apparmor/</literal>.

     

       74
       77
        
       

     

       75
       78
        
               Beware that AppArmor policies almost always contain Nix store paths,

     

       76
       79
        
               and thus produce at each change of these paths

     

       77
       80
        
               a new cached version accumulating in the cache'';

     

       78
       78
       -
             killUnconfinedConfinables = mkDisableOption ''killing of processes

     

       79
       79
       -
               which have an AppArmor profile enabled

     

       81
       81
       +
             killUnconfinedConfinables = mkDisableOption ''

     

       82
       82
       +
               killing of processes which have an AppArmor profile enabled

     

       80
       83
        
               (in <link linkend="opt-security.apparmor.policies">policies</link>)

     

       81
       84
        
               but are not confined (because AppArmor can only confine new processes).

     

       82
       85
        
               Beware that due to a current limitation of AppArmor,

     
···

       84
       87
        
           };

     

       85
       88
        
         };

     

       86
       89
        
       

     

       87
       87
       -
         config = lib.mkIf cfg.enable {

     

       90
       90
       +
         config = mkIf cfg.enable {

     

       88
       91
        
           assertions = map (policy:

     

       89
       92
        
             { assertion = match ".*/.*" policy == null;

     

       90
       93
        
               message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";

     
···

       100
       103
        
           environment.etc."apparmor.d".source = pkgs.linkFarm "apparmor.d" (

     

       101
       104
        
             # It's important to put only enabledPolicies here and not all cfg.policies

     

       102
       105
        
             # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*

     

       103
       103
       -
             lib.mapAttrsToList (name: p: {inherit name; path=p.profile;}) enabledPolicies ++

     

       104
       104
       -
             lib.mapAttrsToList (name: path: {inherit name path;}) cfg.includes

     

       106
       106
       +
             mapAttrsToList (name: p: { inherit name; path = p.profile; }) enabledPolicies ++

     

       107
       107
       +
             mapAttrsToList (name: path: { inherit name path; }) cfg.includes

     

       105
       108
        
           );

     

       106
       109
        
           environment.etc."apparmor/parser.conf".text = ''

     

       107
       107
       -
             ${if cfg.enableCache then "write-cache" else "skip-cache"}

     

       108
       108
       -
             cache-loc /var/cache/apparmor

     

       109
       109
       -
             Include /etc/apparmor.d

     

       110
       110
       -
           '' +

     

       111
       111
       -
           lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;

     

       110
       110
       +
               ${if cfg.enableCache then "write-cache" else "skip-cache"}

     

       111
       111
       +
               cache-loc /var/cache/apparmor

     

       112
       112
       +
               Include /etc/apparmor.d

     

       113
       113
       +
             '' +

     

       114
       114
       +
             concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;

     

       112
       115
        
           # For aa-logprof

     

       113
       116
        
           environment.etc."apparmor/apparmor.conf".text = ''

     

       114
       117
        
           '';

     
···

       134
       137
        
                 # 3 - force all perms on the rule to be user

     

       135
       138
        
                 default_owner_prompt = 1

     

       136
       139
        
       

     

       137
       137
       -
                 custom_includes = /etc/apparmor.d ${lib.concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}

     

       140
       140
       +
                 custom_includes = /etc/apparmor.d ${concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}

     

       138
       141
        
       

     

       139
       142
        
               [qualifiers]

     

       140
       143
        
                 ${pkgs.runtimeShell} = icnu

     

       141
       144
        
                 ${pkgs.bashInteractive}/bin/sh = icnu

     

       142
       145
        
                 ${pkgs.bashInteractive}/bin/bash = icnu

     

       146
       146
       +
                 ${config.users.defaultUserShell} = icnu

     

       143
       147
        
             '';

     

       144
       148
        
             footer = "${pkgs.apparmor-utils}/etc/apparmor/logprof.conf";

     

       145
       149
        
             passAsFile = [ "header" ];

     
···

       177
       181
        
                 xargs --verbose --no-run-if-empty --delimiter='\n' \

     

       178
       182
        
                 kill

     

       179
       183
        
               '';

     

       180
       180
       -
               commonOpts = p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";

     

       184
       184
       +
               commonOpts = p: "--verbose --show-cache ${optionalString (!p.enforce) "--complain "}${p.profile}";

     

       181
       185
        
               in {

     

       182
       186
        
               Type = "oneshot";

     

       183
       187
        
               RemainAfterExit = "yes";

     

       184
       188
        
               ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";

     

       185
       185
       -
               ExecStart = lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;

     

       186
       186
       -
               ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;

     

       189
       189
       +
               ExecStart = mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;

     

       190
       190
       +
               ExecStartPost = optional cfg.killUnconfinedConfinables killUnconfinedConfinables;

     

       187
       191
        
               ExecReload =

     

       188
       192
        
                 # Add or replace into the kernel profiles in enabledPolicies

     

       189
       193
        
                 # (because AppArmor can do that without stopping the processes already confined).

     

       190
       190
       -
                 lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++

     

       194
       194
       +
                 mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++

     

       191
       195
        
                 # Remove from the kernel any profile whose name is not

     

       192
       196
        
                 # one of the names within the content of the profiles in enabledPolicies

     

       193
       197
        
                 # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).

     
···

       195
       199
        
                 [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ] ++

     

       196
       200
        
                 # Optionaly kill the processes which are unconfined but now have a profile loaded

     

       197
       201
        
                 # (because AppArmor can only start to confine new processes).

     

       198
       198
       -
                 lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;

     

       202
       202
       +
                 optional cfg.killUnconfinedConfinables killUnconfinedConfinables;

     

       199
       203
        
               ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";

     

       200
       204
        
               CacheDirectory = [ "apparmor" "apparmor/logprof" ];

     

       201
       205
        
               CacheDirectoryMode = "0700";

     
···

       203
       207
        
           };

     

       204
       208
        
         };

     

       205
       209
        
       

     

       206
       206
       -
         meta.maintainers = with lib.maintainers; [ julm ];

     

       210
       210
       +
         meta.maintainers = with maintainers; [ julm ];

     

       207
       211
        
       }

+169 -153

nixos/modules/security/apparmor/includes.nix

···

       3
       3
        
         inherit (builtins) attrNames hasAttr isAttrs;

     

       4
       4
        
         inherit (lib) getLib;

     

       5
       5
        
         inherit (config.environment) etc;

     

       6
       6
       +
         # Utility to generate an AppArmor rule

     

       7
       7
       +
         # only when the given path exists in config.environment.etc

     

       6
       8
        
         etcRule = arg:

     

       7
       7
       -
           let go = {path ? null, mode ? "r", trail ? ""}:

     

       9
       9
       +
           let go = { path ? null, mode ? "r", trail ? "" }:

     

       8
       10
        
             lib.optionalString (hasAttr path etc)

     

       9
       11
        
               "${mode} ${config.environment.etc.${path}.source}${trail},";

     

       10
       12
        
           in if isAttrs arg

     

       11
       13
        
           then go arg

     

       12
       12
       -
           else go {path=arg;};

     

       14
       14
       +
           else go { path = arg; };

     

       13
       15
        
       in

     

       14
       16
        
       {

     

       15
       17
        
       # FIXME: most of the etcRule calls below have been

     
···

       29
       31
        
         '';

     

       30
       32
        
         "abstractions/audio" = ''

     

       31
       33
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/audio"

     

       32
       32
       -
           ${etcRule "asound.conf"}

     

       33
       33
       -
           ${etcRule "esound/esd.conf"}

     

       34
       34
       -
           ${etcRule "libao.conf"}

     

       35
       35
       -
           ${etcRule {path="pulse"; trail="/";}}

     

       36
       36
       -
           ${etcRule {path="pulse"; trail="/**";}}

     

       37
       37
       -
           ${etcRule {path="sound"; trail="/";}}

     

       38
       38
       -
           ${etcRule {path="sound"; trail="/**";}}

     

       39
       39
       -
           ${etcRule {path="alsa/conf.d"; trail="/";}}

     

       40
       40
       -
           ${etcRule {path="alsa/conf.d"; trail="/*";}}

     

       41
       41
       -
           ${etcRule "openal/alsoft.conf"}

     

       42
       42
       -
           ${etcRule "wildmidi/wildmidi.conf"}

     

       43
       43
       -
         '';

     

       34
       34
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       35
       35
       +
             "asound.conf"

     

       36
       36
       +
             "esound/esd.conf"

     

       37
       37
       +
             "libao.conf"

     

       38
       38
       +
             { path = "pulse";  trail = "/"; }

     

       39
       39
       +
             { path = "pulse";  trail = "/**"; }

     

       40
       40
       +
             { path = "sound";  trail = "/"; }

     

       41
       41
       +
             { path = "sound";  trail = "/**"; }

     

       42
       42
       +
             { path = "alsa/conf.d";  trail = "/"; }

     

       43
       43
       +
             { path = "alsa/conf.d";  trail = "/*"; }

     

       44
       44
       +
             "openal/alsoft.conf"

     

       45
       45
       +
             "wildmidi/wildmidi.conf"

     

       46
       46
       +
           ];

     

       44
       47
        
         "abstractions/authentication" = ''

     

       45
       48
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/authentication"

     

       46
       49
        
           # Defined in security.pam

     

       47
       50
        
           include <abstractions/pam>

     

       48
       48
       -
           ${etcRule "nologin"}

     

       49
       49
       -
           ${etcRule "securetty"}

     

       50
       50
       -
           ${etcRule {path="security"; trail="/*";}}

     

       51
       51
       -
           ${etcRule "shadow"}

     

       52
       52
       -
           ${etcRule "gshadow"}

     

       53
       53
       -
           ${etcRule "pwdb.conf"}

     

       54
       54
       -
           ${etcRule "default/passwd"}

     

       55
       55
       -
           ${etcRule "login.defs"}

     

       56
       56
       -
         '';

     

       51
       51
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       52
       52
       +
             "nologin"

     

       53
       53
       +
             "securetty"

     

       54
       54
       +
             { path = "security";  trail = "/*"; }

     

       55
       55
       +
             "shadow"

     

       56
       56
       +
             "gshadow"

     

       57
       57
       +
             "pwdb.conf"

     

       58
       58
       +
             "default/passwd"

     

       59
       59
       +
             "login.defs"

     

       60
       60
       +
           ];

     

       57
       61
        
         "abstractions/base" = ''

     

       58
       58
       -
            include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"

     

       59
       59
       -
            r ${pkgs.stdenv.cc.libc}/share/locale/**,

     

       60
       60
       -
            r ${pkgs.stdenv.cc.libc}/share/locale.alias,

     

       61
       61
       -
            ${lib.optionalString (pkgs.glibcLocales != null) "r ${pkgs.glibcLocales}/lib/locale/locale-archive,"}

     

       62
       62
       -
            ${etcRule "localtime"}

     

       63
       63
       -
            r ${pkgs.tzdata}/share/zoneinfo/**,

     

       64
       64
       -
            r ${pkgs.stdenv.cc.libc}/share/i18n/**,

     

       62
       62
       +
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"

     

       63
       63
       +
           r ${pkgs.stdenv.cc.libc}/share/locale/**,

     

       64
       64
       +
           r ${pkgs.stdenv.cc.libc}/share/locale.alias,

     

       65
       65
       +
           ${lib.optionalString (pkgs.glibcLocales != null) "r ${pkgs.glibcLocales}/lib/locale/locale-archive,"}

     

       66
       66
       +
           ${etcRule "localtime"}

     

       67
       67
       +
           r ${pkgs.tzdata}/share/zoneinfo/**,

     

       68
       68
       +
           r ${pkgs.stdenv.cc.libc}/share/i18n/**,

     

       65
       69
        
         '';

     

       66
       70
        
         "abstractions/bash" = ''

     

       67
       71
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash"

     

       68
       68
       -
           # system-wide bash configuration

     

       69
       69
       -
           ${etcRule "profile.dos"}

     

       70
       70
       -
           ${etcRule "profile"}

     

       71
       71
       -
           ${etcRule "profile.d"}

     

       72
       72
       -
           ${etcRule {path="profile.d"; trail="/*";}}

     

       73
       73
       -
           ${etcRule "bashrc"}

     

       74
       74
       -
           ${etcRule "bash.bashrc"}

     

       75
       75
       -
           ${etcRule "bash.bashrc.local"}

     

       76
       76
       -
           ${etcRule "bash_completion"}

     

       77
       77
       -
           ${etcRule "bash_completion.d"}

     

       78
       78
       -
           ${etcRule {path="bash_completion.d"; trail="/*";}}

     

       79
       79
       -
           # bash relies on system-wide readline configuration

     

       80
       80
       -
           ${etcRule "inputrc"}

     

       72
       72
       +
       

     

       81
       73
        
           # bash inspects filesystems at startup

     

       82
       74
        
           # and /etc/mtab is linked to /proc/mounts

     

       83
       75
        
           @{PROC}/mounts

     

       84
       76
        
       

     

       85
       85
       -
           # run out of /etc/bash.bashrc

     

       86
       86
       -
           ${etcRule "DIR_COLORS"}

     

       77
       77
       +
           # system-wide bash configuration

     

       78
       78
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       79
       79
       +
             "profile.dos"

     

       80
       80
       +
             "profile"

     

       81
       81
       +
             "profile.d"

     

       82
       82
       +
             { path = "profile.d";  trail = "/*"; }

     

       83
       83
       +
             "bashrc"

     

       84
       84
       +
             "bash.bashrc"

     

       85
       85
       +
             "bash.bashrc.local"

     

       86
       86
       +
             "bash_completion"

     

       87
       87
       +
             "bash_completion.d"

     

       88
       88
       +
             { path = "bash_completion.d";  trail = "/*"; }

     

       89
       89
       +
             # bash relies on system-wide readline configuration

     

       90
       90
       +
             "inputrc"

     

       91
       91
       +
             # run out of /etc/bash.bashrc

     

       92
       92
       +
             "DIR_COLORS"

     

       93
       93
       +
           ];

     

       94
       94
       +
         "abstractions/consoles" = ''

     

       95
       95
       +
            include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/consoles"

     

       87
       96
        
         '';

     

       88
       97
        
         "abstractions/cups-client" = ''

     

       89
       98
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/cpus-client"

     

       90
       99
        
           ${etcRule "cups/cups-client.conf"}

     

       91
       100
        
         '';

     

       92
       92
       -
         "abstractions/consoles" = ''

     

       93
       93
       -
            include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/consoles"

     

       94
       94
       -
         '';

     

       95
       101
        
         "abstractions/dbus-session-strict" = ''

     

       96
       102
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dbus-session-strict"

     

       97
       103
        
           ${etcRule "machine-id"}

     

       98
       104
        
         '';

     

       99
       105
        
         "abstractions/dconf" = ''

     

       100
       106
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dconf"

     

       101
       101
       -
           ${etcRule {path="dconf"; trail="/**";}}

     

       107
       107
       +
           ${etcRule { path = "dconf";  trail = "/**"; }}

     

       102
       108
        
         '';

     

       103
       109
        
         "abstractions/dri-common" = ''

     

       104
       110
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dri-common"

     
···

       109
       115
        
         # those are therefore added there to this "abstractions/fonts".

     

       110
       116
        
         "abstractions/fonts" = ''

     

       111
       117
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/fonts"

     

       112
       112
       -
           ${etcRule {path="fonts"; trail="/**";}}

     

       118
       118
       +
           ${etcRule { path = "fonts";  trail = "/**"; }}

     

       113
       119
        
         '';

     

       114
       120
        
         "abstractions/gnome" = ''

     

       115
       121
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/gnome"

     

       116
       116
       -
           ${etcRule {path="gnome"; trail="/gtkrc*";}}

     

       117
       117
       -
           ${etcRule {path="gtk"; trail="/*";}}

     

       118
       118
       -
           ${etcRule {path="gtk-2.0"; trail="/*";}}

     

       119
       119
       -
           ${etcRule {path="gtk-3.0"; trail="/*";}}

     

       120
       120
       -
           ${etcRule "orbitrc"}

     

       121
       122
        
           include <abstractions/fonts>

     

       122
       122
       -
           ${etcRule {path="pango"; trail="/*";}}

     

       123
       123
       -
           ${etcRule {path="/etc/gnome-vfs-2.0"; trail="/modules/";}}

     

       124
       124
       -
           ${etcRule {path="/etc/gnome-vfs-2.0"; trail="/modules/*";}}

     

       125
       125
       -
           ${etcRule "papersize"}

     

       126
       126
       -
           ${etcRule {path="cups"; trail="/lpoptions";}}

     

       127
       127
       -
           ${etcRule {path="gnome"; trail="/defaults.list";}}

     

       128
       128
       -
           ${etcRule {path="xdg"; trail="/{,*-}mimeapps.list";}}

     

       129
       129
       -
           ${etcRule "xdg/mimeapps.list"}

     

       130
       130
       -
         '';

     

       123
       123
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       124
       124
       +
             { path = "gnome";  trail = "/gtkrc*"; }

     

       125
       125
       +
             { path = "gtk";  trail = "/*"; }

     

       126
       126
       +
             { path = "gtk-2.0";  trail = "/*"; }

     

       127
       127
       +
             { path = "gtk-3.0";  trail = "/*"; }

     

       128
       128
       +
             "orbitrc"

     

       129
       129
       +
             { path = "pango";  trail = "/*"; }

     

       130
       130
       +
             { path = "/etc/gnome-vfs-2.0";  trail = "/modules/"; }

     

       131
       131
       +
             { path = "/etc/gnome-vfs-2.0";  trail = "/modules/*"; }

     

       132
       132
       +
             "papersize"

     

       133
       133
       +
             { path = "cups";  trail = "/lpoptions"; }

     

       134
       134
       +
             { path = "gnome";  trail = "/defaults.list"; }

     

       135
       135
       +
             { path = "xdg";  trail = "/{,*-}mimeapps.list"; }

     

       136
       136
       +
             "xdg/mimeapps.list"

     

       137
       137
       +
           ];

     

       131
       138
        
         "abstractions/kde" = ''

     

       132
       139
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kde"

     

       133
       133
       -
           ${etcRule {path="qt3"; trail="/kstylerc";}}

     

       134
       134
       -
           ${etcRule {path="qt3"; trail="/qt_plugins_3.3rc";}}

     

       135
       135
       -
           ${etcRule {path="qt3"; trail="/qtrc";}}

     

       136
       136
       -
           ${etcRule "kderc"}

     

       137
       137
       -
           ${etcRule {path="kde3"; trail="/*";}}

     

       138
       138
       -
           ${etcRule "kde4rc"}

     

       139
       139
       -
           ${etcRule {path="xdg"; trail="/kdeglobals";}}

     

       140
       140
       -
           ${etcRule {path="xdg"; trail="/Trolltech.conf";}}

     

       141
       141
       -
         '';

     

       140
       140
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       141
       141
       +
             { path = "qt3";  trail = "/kstylerc"; }

     

       142
       142
       +
             { path = "qt3";  trail = "/qt_plugins_3.3rc"; }

     

       143
       143
       +
             { path = "qt3";  trail = "/qtrc"; }

     

       144
       144
       +
             "kderc"

     

       145
       145
       +
             { path = "kde3";  trail = "/*"; }

     

       146
       146
       +
             "kde4rc"

     

       147
       147
       +
             { path = "xdg";  trail = "/kdeglobals"; }

     

       148
       148
       +
             { path = "xdg";  trail = "/Trolltech.conf"; }

     

       149
       149
       +
           ];

     

       142
       150
        
         "abstractions/kerberosclient" = ''

     

       143
       151
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kerberosclient"

     

       144
       144
       -
           ${etcRule {path="krb5.keytab"; mode="rk";}}

     

       145
       145
       -
           ${etcRule "krb5.conf"}

     

       146
       146
       -
           ${etcRule "krb5.conf.d"}

     

       147
       147
       -
           ${etcRule {path="krb5.conf.d"; trail="/*";}}

     

       152
       152
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       153
       153
       +
           { path = "krb5.keytab"; mode="rk"; }

     

       154
       154
       +
           "krb5.conf"

     

       155
       155
       +
           "krb5.conf.d"

     

       156
       156
       +
           { path = "krb5.conf.d";  trail = "/*"; }

     

       148
       157
        
       

     

       149
       158
        
           # config files found via strings on libs

     

       150
       150
       -
           ${etcRule "krb.conf"}

     

       151
       151
       -
           ${etcRule "krb.realms"}

     

       152
       152
       -
           ${etcRule "srvtab"}

     

       153
       153
       -
         '';

     

       159
       159
       +
           "krb.conf"

     

       160
       160
       +
           "krb.realms"

     

       161
       161
       +
           "srvtab"

     

       162
       162
       +
           ];

     

       154
       163
        
         "abstractions/ldapclient" = ''

     

       155
       164
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ldapclient"

     

       156
       156
       -
           ${etcRule "ldap.conf"}

     

       157
       157
       -
           ${etcRule "ldap.secret"}

     

       158
       158
       -
           ${etcRule {path="openldap"; trail="/*";}}

     

       159
       159
       -
           ${etcRule {path="openldap"; trail="/cacerts/*";}}

     

       160
       160
       -
           ${etcRule {path="sasl2"; trail="/*";}}

     

       161
       161
       -
         '';

     

       165
       165
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       166
       166
       +
             "ldap.conf"

     

       167
       167
       +
             "ldap.secret"

     

       168
       168
       +
             { path = "openldap";  trail = "/*"; }

     

       169
       169
       +
             { path = "openldap";  trail = "/cacerts/*"; }

     

       170
       170
       +
             { path = "sasl2";  trail = "/*"; }

     

       171
       171
       +
           ];

     

       162
       172
        
         "abstractions/likewise" = ''

     

       163
       173
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/likewise"

     

       164
       174
        
         '';

     

       165
       175
        
         "abstractions/mdns" = ''

     

       166
       176
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/mdns"

     

       167
       167
       -
            ${etcRule "nss_mdns.conf"}

     

       177
       177
       +
           ${etcRule "nss_mdns.conf"}

     

       168
       178
        
         '';

     

       169
       179
        
         "abstractions/nameservice" = ''

     

       170
       180
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nameservice"

     
···

       173
       183
        
           # looking up users by name or id, groups by name or id, hosts by name

     

       174
       184
        
           # or IP, etc. These operations may be performed through files, dns,

     

       175
       185
        
           # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.

     

       176
       176
       -
           ${etcRule "group"}

     

       177
       177
       -
           ${etcRule "host.conf"}

     

       178
       178
       -
           ${etcRule "hosts"}

     

       179
       179
       -
           ${etcRule "nsswitch.conf"}

     

       180
       180
       -
           ${etcRule "gai.conf"}

     

       181
       181
       -
           ${etcRule "passwd"}

     

       182
       182
       -
           ${etcRule "protocols"}

     

       186
       186
       +
           mr ${getLib pkgs.nss}/lib/libnss_*.so*,

     

       187
       187
       +
           mr ${getLib pkgs.nss}/lib64/libnss_*.so*,

     

       188
       188
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       189
       189
       +
             "group"

     

       190
       190
       +
             "host.conf"

     

       191
       191
       +
             "hosts"

     

       192
       192
       +
             "nsswitch.conf"

     

       193
       193
       +
             "gai.conf"

     

       194
       194
       +
             "passwd"

     

       195
       195
       +
             "protocols"

     

       183
       196
        
       

     

       184
       184
       -
           # libtirpc (used for NIS/YP login) needs this

     

       185
       185
       -
           ${etcRule "netconfig"}

     

       186
       186
       -
       

     

       187
       187
       -
           ${etcRule "resolv.conf"}

     

       197
       197
       +
             # libtirpc (used for NIS/YP login) needs this

     

       198
       198
       +
             "netconfig"

     

       188
       199
        
       

     

       189
       189
       -
           ${etcRule {path="samba"; trail="/lmhosts";}}

     

       190
       190
       -
           ${etcRule "services"}

     

       200
       200
       +
             "resolv.conf"

     

       191
       201
        
       

     

       192
       192
       -
           ${etcRule "default/nss"}

     

       202
       202
       +
             { path = "samba";  trail = "/lmhosts"; }

     

       203
       203
       +
             "services"

     

       193
       204
        
       

     

       194
       194
       -
           # libnl-3-200 via libnss-gw-name

     

       195
       195
       -
           ${etcRule {path="libnl"; trail="/classid";}}

     

       196
       196
       -
           ${etcRule {path="libnl-3"; trail="/classid";}}

     

       205
       205
       +
             "default/nss"

     

       197
       206
        
       

     

       198
       198
       -
           mr ${getLib pkgs.nss}/lib/libnss_*.so*,

     

       199
       199
       -
           mr ${getLib pkgs.nss}/lib64/libnss_*.so*,

     

       200
       200
       -
         '';

     

       207
       207
       +
             # libnl-3-200 via libnss-gw-name

     

       208
       208
       +
             { path = "libnl";  trail = "/classid"; }

     

       209
       209
       +
             { path = "libnl-3";  trail = "/classid"; }

     

       210
       210
       +
           ];

     

       201
       211
        
         "abstractions/nis" = ''

     

       202
       212
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nis"

     

       203
       213
        
         '';

     
···

       207
       217
        
         '';

     

       208
       218
        
         "abstractions/opencl-common" = ''

     

       209
       219
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/opencl-common"

     

       210
       210
       -
           ${etcRule {path="OpenCL"; trail="/**";}}

     

       220
       220
       +
           ${etcRule { path = "OpenCL";  trail = "/**"; }}

     

       211
       221
        
         '';

     

       212
       222
        
         "abstractions/opencl-mesa" = ''

     

       213
       223
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/opencl-mesa"

     
···

       215
       225
        
         '';

     

       216
       226
        
         "abstractions/openssl" = ''

     

       217
       227
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/openssl"

     

       218
       218
       -
           ${etcRule {path="ssl"; trail="/openssl.cnf";}}

     

       228
       228
       +
           ${etcRule { path = "ssl";  trail = "/openssl.cnf"; }}

     

       219
       229
        
         '';

     

       220
       230
        
         "abstractions/p11-kit" = ''

     

       221
       231
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/p11-kit"

     

       222
       222
       -
           ${etcRule {path="pkcs11"; trail="/";}}

     

       223
       223
       -
           ${etcRule {path="pkcs11"; trail="/pkcs11.conf";}}

     

       224
       224
       -
           ${etcRule {path="pkcs11"; trail="/modules/";}}

     

       225
       225
       -
           ${etcRule {path="pkcs11"; trail="/modules/*";}}

     

       226
       226
       -
         '';

     

       232
       232
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       233
       233
       +
             { path = "pkcs11";  trail = "/"; }

     

       234
       234
       +
             { path = "pkcs11";  trail = "/pkcs11.conf"; }

     

       235
       235
       +
             { path = "pkcs11";  trail = "/modules/"; }

     

       236
       236
       +
             { path = "pkcs11";  trail = "/modules/*"; }

     

       237
       237
       +
           ];

     

       227
       238
        
         "abstractions/perl" = ''

     

       228
       239
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/perl"

     

       229
       229
       -
           ${etcRule {path="perl"; trail="/**";}}

     

       240
       240
       +
           ${etcRule { path = "perl";  trail = "/**"; }}

     

       230
       241
        
         '';

     

       231
       242
        
         "abstractions/php" = ''

     

       232
       243
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/php"

     

       233
       233
       -
           ${etcRule {path="php"; trail="/**/";}}

     

       234
       234
       -
           ${etcRule {path="php5"; trail="/**/";}}

     

       235
       235
       -
           ${etcRule {path="php7"; trail="/**/";}}

     

       236
       236
       -
           ${etcRule {path="php"; trail="/**.ini";}}

     

       237
       237
       -
           ${etcRule {path="php5"; trail="/**.ini";}}

     

       238
       238
       -
           ${etcRule {path="php7"; trail="/**.ini";}}

     

       239
       239
       -
         '';

     

       244
       244
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       245
       245
       +
             { path = "php";  trail = "/**/"; }

     

       246
       246
       +
             { path = "php5";  trail = "/**/"; }

     

       247
       247
       +
             { path = "php7";  trail = "/**/"; }

     

       248
       248
       +
             { path = "php";  trail = "/**.ini"; }

     

       249
       249
       +
             { path = "php5";  trail = "/**.ini"; }

     

       250
       250
       +
             { path = "php7";  trail = "/**.ini"; }

     

       251
       251
       +
           ];

     

       240
       252
        
         "abstractions/postfix-common" = ''

     

       241
       253
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/postfix-common"

     

       242
       242
       -
           ${etcRule "mailname"}

     

       243
       243
       -
           ${etcRule {path="postfix"; trail="/*.cf";}}

     

       244
       244
       -
           ${etcRule "postfix/main.cf"}

     

       245
       245
       -
           ${etcRule "postfix/master.cf"}

     

       246
       246
       -
         '';

     

       254
       254
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       255
       255
       +
             "mailname"

     

       256
       256
       +
             { path = "postfix";  trail = "/*.cf"; }

     

       257
       257
       +
             "postfix/main.cf"

     

       258
       258
       +
             "postfix/master.cf"

     

       259
       259
       +
           ];

     

       247
       260
        
         "abstractions/python" = ''

     

       248
       261
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/python"

     

       249
       262
        
         '';

     

       250
       263
        
         "abstractions/qt5" = ''

     

       251
       264
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/qt5"

     

       252
       252
       -
           ${etcRule {path="xdg"; trail="/QtProject/qtlogging.ini";}}

     

       253
       253
       -
           ${etcRule {path="xdg/QtProject"; trail="/qtlogging.ini";}}

     

       254
       254
       -
           ${etcRule "xdg/QtProject/qtlogging.ini"}

     

       255
       255
       -
         '';

     

       265
       265
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       266
       266
       +
             { path = "xdg";  trail = "/QtProject/qtlogging.ini"; }

     

       267
       267
       +
             { path = "xdg/QtProject";  trail = "/qtlogging.ini"; }

     

       268
       268
       +
             "xdg/QtProject/qtlogging.ini"

     

       269
       269
       +
           ];

     

       256
       270
        
         "abstractions/samba" = ''

     

       257
       271
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/samba"

     

       258
       258
       -
           ${etcRule {path="samba"; trail="/*";}}

     

       272
       272
       +
           ${etcRule { path = "samba";  trail = "/*"; }}

     

       259
       273
        
         '';

     

       260
       274
        
         "abstractions/ssl_certs" = ''

     

       261
       275
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs"

     

       262
       262
       -
           ${etcRule "ssl/certs/ca-certificates.crt"}

     

       263
       263
       -
           ${etcRule "ssl/certs/ca-bundle.crt"}

     

       264
       264
       -
           ${etcRule "pki/tls/certs/ca-bundle.crt"}

     

       265
       265
       -
       

     

       266
       266
       -
           ${etcRule {path="ssl/trust"; trail="/";}}

     

       267
       267
       -
           ${etcRule {path="ssl/trust"; trail="/*";}}

     

       268
       268
       -
           ${etcRule {path="ssl/trust/anchors"; trail="/";}}

     

       269
       269
       -
           ${etcRule {path="ssl/trust/anchors"; trail="/**";}}

     

       270
       270
       -
           ${etcRule {path="pki/trust"; trail="/";}}

     

       271
       271
       -
           ${etcRule {path="pki/trust"; trail="/*";}}

     

       272
       272
       -
           ${etcRule {path="pki/trust/anchors"; trail="/";}}

     

       273
       273
       -
           ${etcRule {path="pki/trust/anchors"; trail="/**";}}

     

       274
       276
        
       

     

       275
       275
       -
           # security.acme NixOS module

     

       277
       277
       +
           # For the NixOS module: security.acme

     

       276
       278
        
           r /var/lib/acme/*/cert.pem,

     

       277
       279
        
           r /var/lib/acme/*/chain.pem,

     

       278
       280
        
           r /var/lib/acme/*/fullchain.pem,

     

       279
       279
       -
         '';

     

       281
       281
       +
       

     

       282
       282
       +
           '' + lib.concatMapStringsSep "\n" etcRule [

     

       283
       283
       +
             "ssl/certs/ca-certificates.crt"

     

       284
       284
       +
             "ssl/certs/ca-bundle.crt"

     

       285
       285
       +
             "pki/tls/certs/ca-bundle.crt"

     

       286
       286
       +
       

     

       287
       287
       +
             { path = "ssl/trust";  trail = "/"; }

     

       288
       288
       +
             { path = "ssl/trust";  trail = "/*"; }

     

       289
       289
       +
             { path = "ssl/trust/anchors";  trail = "/"; }

     

       290
       290
       +
             { path = "ssl/trust/anchors";  trail = "/**"; }

     

       291
       291
       +
             { path = "pki/trust";  trail = "/"; }

     

       292
       292
       +
             { path = "pki/trust";  trail = "/*"; }

     

       293
       293
       +
             { path = "pki/trust/anchors";  trail = "/"; }

     

       294
       294
       +
             { path = "pki/trust/anchors";  trail = "/**"; }

     

       295
       295
       +
           ];

     

       280
       296
        
         "abstractions/ssl_keys" = ''

     

       281
       297
        
           # security.acme NixOS module

     

       282
       298
        
           r /var/lib/acme/*/full.pem,

     
···

       284
       300
        
         '';

     

       285
       301
        
         "abstractions/vulkan" = ''

     

       286
       302
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/vulkan"

     

       287
       287
       -
           ${etcRule {path="vulkan/icd.d"; trail="/";}}

     

       288
       288
       -
           ${etcRule {path="vulkan/icd.d"; trail="/*.json";}}

     

       303
       303
       +
           ${etcRule { path = "vulkan/icd.d";  trail = "/"; }}

     

       304
       304
       +
           ${etcRule { path = "vulkan/icd.d";  trail = "/*.json"; }}

     

       289
       305
        
         '';

     

       290
       306
        
         "abstractions/winbind" = ''

     

       291
       307
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/winbind"

     

       292
       292
       -
           ${etcRule {path="samba"; trail="/smb.conf";}}

     

       293
       293
       -
           ${etcRule {path="samba"; trail="/dhcp.conf";}}

     

       308
       308
       +
           ${etcRule { path = "samba";  trail = "/smb.conf"; }}

     

       309
       309
       +
           ${etcRule { path = "samba";  trail = "/dhcp.conf"; }}

     

       294
       310
        
         '';

     

       295
       311
        
         "abstractions/X" = ''

     

       296
       312
        
           include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/X"

     

       297
       297
       -
           ${etcRule {path="X11/cursors"; trail="/";}}

     

       298
       298
       -
           ${etcRule {path="X11/cursors"; trail="/**";}}

     

       313
       313
       +
           ${etcRule { path = "X11/cursors";  trail = "/"; }}

     

       314
       314
       +
           ${etcRule { path = "X11/cursors";  trail = "/**"; }}

     

       299
       315
        
         '';

     

       300
       316
        
       };

     

       301
       317
        
       }

nixos/modules/security/misc.nix

···

       7
       7
        
           maintainers = [ maintainers.joachifm ];

     

       8
       8
        
         };

     

       9
       9
        
       

     

       10
       10
       +
         imports = [

     

       11
       11
       +
           (lib.mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])

     

       12
       12
       +
         ];

     

       13
       13
       +
       

     

       10
       14
        
         options = {

     

       11
       15
        
           security.allowUserNamespaces = mkOption {

     

       12
       16
        
             type = types.bool;

+66 -46

nixos/modules/security/pam.nix

···

       897
       897
        
       

     

       898
       898
        
           security.apparmor.includes."abstractions/pam" = let

     

       899
       899
        
             isEnabled = test: fold or false (map test (attrValues config.security.pam.services));

     

       900
       900
       -
             in ''

     

       901
       901
       -
             ${lib.concatMapStringsSep "\n"

     

       902
       902
       -
                (name: "r ${config.environment.etc."pam.d/${name}".source},")

     

       903
       903
       -
                (attrNames config.security.pam.services)}

     

       900
       900
       +
             in

     

       901
       901
       +
             lib.concatMapStringsSep "\n"

     

       902
       902
       +
               (name: "r ${config.environment.etc."pam.d/${name}".source},")

     

       903
       903
       +
               (attrNames config.security.pam.services) +

     

       904
       904
       +
             ''

     

       904
       905
        
             mr ${getLib pkgs.pam}/lib/security/pam_filter/*,

     

       905
       906
        
             mr ${getLib pkgs.pam}/lib/security/pam_*.so,

     

       906
       907
        
             r ${getLib pkgs.pam}/lib/security/,

     

       907
       907
       -
             ${optionalString use_ldap

     

       908
       908
       -
               "mr ${pam_ldap}/lib/security/pam_ldap.so,"}

     

       909
       909
       -
             ${optionalString config.services.sssd.enable

     

       910
       910
       -
               "mr ${pkgs.sssd}/lib/security/pam_sss.so,"}

     

       911
       911
       -
             ${optionalString config.krb5.enable ''

     

       908
       908
       +
             '' +

     

       909
       909
       +
             optionalString use_ldap ''

     

       910
       910
       +
                mr ${pam_ldap}/lib/security/pam_ldap.so,

     

       911
       911
       +
             '' +

     

       912
       912
       +
             optionalString config.services.sssd.enable ''

     

       913
       913
       +
               mr ${pkgs.sssd}/lib/security/pam_sss.so,

     

       914
       914
       +
             '' +

     

       915
       915
       +
             optionalString config.krb5.enable ''

     

       912
       916
        
               mr ${pam_krb5}/lib/security/pam_krb5.so,

     

       913
       917
        
               mr ${pam_ccreds}/lib/security/pam_ccreds.so,

     

       914
       914
       -
             ''}

     

       915
       915
       -
             ${optionalString (isEnabled (cfg: cfg.googleOsLoginAccountVerification)) ''

     

       918
       918
       +
             '' +

     

       919
       919
       +
             optionalString (isEnabled (cfg: cfg.googleOsLoginAccountVerification)) ''

     

       916
       920
        
               mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,

     

       917
       921
        
               mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_admin.so,

     

       918
       918
       -
             ''}

     

       919
       919
       -
             ${optionalString (isEnabled (cfg: cfg.googleOsLoginAuthentication))

     

       920
       920
       -
               "mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,"}

     

       921
       921
       -
             ${optionalString (config.security.pam.enableSSHAgentAuth && isEnabled (cfg: cfg.sshAgentAuth))

     

       922
       922
       -
               "mr ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so,"}

     

       923
       923
       -
             ${optionalString (isEnabled (cfg: cfg.fprintAuth))

     

       924
       924
       -
               "mr ${pkgs.fprintd}/lib/security/pam_fprintd.so,"}

     

       925
       925
       -
             ${optionalString (isEnabled (cfg: cfg.u2fAuth))

     

       926
       926
       -
               "mr ${pkgs.pam_u2f}/lib/security/pam_u2f.so,"}

     

       927
       927
       -
             ${optionalString (isEnabled (cfg: cfg.usbAuth))

     

       928
       928
       -
               "mr ${pkgs.pam_usb}/lib/security/pam_usb.so,"}

     

       929
       929
       -
             ${optionalString (isEnabled (cfg: cfg.oathAuth))

     

       930
       930
       -
               "mr ${pkgs.oathToolkit}/lib/security/pam_oath.so,"}

     

       931
       931
       -
             ${optionalString (isEnabled (cfg: cfg.yubicoAuth))

     

       932
       932
       -
               "mr ${pkgs.yubico-pam}/lib/security/pam_yubico.so,"}

     

       933
       933
       -
             ${optionalString (isEnabled (cfg: cfg.duoSecurity.enable))

     

       934
       934
       -
               "mr ${pkgs.duo-unix}/lib/security/pam_duo.so,"}

     

       935
       935
       -
             ${optionalString (isEnabled (cfg: cfg.otpwAuth))

     

       936
       936
       -
               "mr ${pkgs.otpw}/lib/security/pam_otpw.so,"}

     

       937
       937
       -
             ${optionalString config.security.pam.enableEcryptfs

     

       938
       938
       -
               "mr ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so,"}

     

       939
       939
       -
             ${optionalString (isEnabled (cfg: cfg.pamMount))

     

       940
       940
       -
               "mr ${pkgs.pam_mount}/lib/security/pam_mount.so,"}

     

       941
       941
       -
             ${optionalString (isEnabled (cfg: cfg.enableGnomeKeyring))

     

       942
       942
       -
               "mr ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so,"}

     

       943
       943
       -
             ${optionalString (isEnabled (cfg: cfg.startSession))

     

       944
       944
       -
               "mr ${pkgs.systemd}/lib/security/pam_systemd.so,"}

     

       945
       945
       -
             ${optionalString (isEnabled (cfg: cfg.enableAppArmor) && config.security.apparmor.enable)

     

       946
       946
       -
               "mr ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so,"}

     

       947
       947
       -
             ${optionalString (isEnabled (cfg: cfg.enableKwallet))

     

       948
       948
       -
               "mr ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so,"}

     

       949
       949
       -
             ${optionalString config.virtualisation.lxc.lxcfs.enable

     

       950
       950
       -
               "mr ${pkgs.lxc}/lib/security/pam_cgfs.so"}

     

       951
       951
       -
           '';

     

       952
       952
       -
       

     

       922
       922
       +
             '' +

     

       923
       923
       +
             optionalString (isEnabled (cfg: cfg.googleOsLoginAuthentication)) ''

     

       924
       924
       +
               mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,

     

       925
       925
       +
             '' +

     

       926
       926
       +
             optionalString (config.security.pam.enableSSHAgentAuth

     

       927
       927
       +
                            && isEnabled (cfg: cfg.sshAgentAuth)) ''

     

       928
       928
       +
               mr ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so,

     

       929
       929
       +
             '' +

     

       930
       930
       +
             optionalString (isEnabled (cfg: cfg.fprintAuth)) ''

     

       931
       931
       +
               mr ${pkgs.fprintd}/lib/security/pam_fprintd.so,

     

       932
       932
       +
             '' +

     

       933
       933
       +
             optionalString (isEnabled (cfg: cfg.u2fAuth)) ''

     

       934
       934
       +
               mr ${pkgs.pam_u2f}/lib/security/pam_u2f.so,

     

       935
       935
       +
             '' +

     

       936
       936
       +
             optionalString (isEnabled (cfg: cfg.usbAuth)) ''

     

       937
       937
       +
               mr ${pkgs.pam_usb}/lib/security/pam_usb.so,

     

       938
       938
       +
             '' +

     

       939
       939
       +
             optionalString (isEnabled (cfg: cfg.oathAuth)) ''

     

       940
       940
       +
               "mr ${pkgs.oathToolkit}/lib/security/pam_oath.so,

     

       941
       941
       +
             '' +

     

       942
       942
       +
             optionalString (isEnabled (cfg: cfg.yubicoAuth)) ''

     

       943
       943
       +
               mr ${pkgs.yubico-pam}/lib/security/pam_yubico.so,

     

       944
       944
       +
             '' +

     

       945
       945
       +
             optionalString (isEnabled (cfg: cfg.duoSecurity.enable)) ''

     

       946
       946
       +
               mr ${pkgs.duo-unix}/lib/security/pam_duo.so,

     

       947
       947
       +
             '' +

     

       948
       948
       +
             optionalString (isEnabled (cfg: cfg.otpwAuth)) ''

     

       949
       949
       +
               mr ${pkgs.otpw}/lib/security/pam_otpw.so,

     

       950
       950
       +
             '' +

     

       951
       951
       +
             optionalString config.security.pam.enableEcryptfs ''

     

       952
       952
       +
               mr ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so,

     

       953
       953
       +
             '' +

     

       954
       954
       +
             optionalString (isEnabled (cfg: cfg.pamMount)) ''

     

       955
       955
       +
               mr ${pkgs.pam_mount}/lib/security/pam_mount.so,

     

       956
       956
       +
             '' +

     

       957
       957
       +
             optionalString (isEnabled (cfg: cfg.enableGnomeKeyring)) ''

     

       958
       958
       +
               mr ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so,

     

       959
       959
       +
             '' +

     

       960
       960
       +
             optionalString (isEnabled (cfg: cfg.startSession)) ''

     

       961
       961
       +
               mr ${pkgs.systemd}/lib/security/pam_systemd.so,

     

       962
       962
       +
             '' +

     

       963
       963
       +
             optionalString (isEnabled (cfg: cfg.enableAppArmor)

     

       964
       964
       +
                            && config.security.apparmor.enable) ''

     

       965
       965
       +
               mr ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so,

     

       966
       966
       +
             '' +

     

       967
       967
       +
             optionalString (isEnabled (cfg: cfg.enableKwallet)) ''

     

       968
       968
       +
               mr ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so,

     

       969
       969
       +
             '' +

     

       970
       970
       +
             optionalString config.virtualisation.lxc.lxcfs.enable ''

     

       971
       971
       +
               mr ${pkgs.lxc}/lib/security/pam_cgfs.so

     

       972
       972
       +
             '';

     

       953
       973
        
         };

     

       954
       974
        
       

     

       955
       975
        
       }

+1 -1

pkgs/os-specific/linux/apparmor/default.nix

···

       290
       290
        
           , name ? ""

     

       291
       291
        
           }: rootPaths: runCommand

     

       292
       292
        
             ( "apparmor-closure-rules"

     

       293
       293
       -
             + lib.optionalString (name != "") "-${name}") {} ''

     

       293
       293
       +
             + lib.optionalString (name != "") "-${name}" ) {} ''

     

       294
       294
        
           touch $out

     

       295
       295
        
           while read -r path

     

       296
       296
        
           do printf >>$out "%s,\n" ${lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules)}