commit e87b9b1f3e4c5d4587fd05f5b1213be74d904a42 · pyrox.dev/nixpkgs

nixos/doc/manual/release-notes/rl-2505.section.md

···

       162
       162
        
         | virtualBoxOVA            | virtualbox-vagrant.box                                     | nixos-image-vagrant-virtualbox-25.05pre-git-x86_64-linux.ova    |

     

       163
       163
        
         | vmwareImage              | nixos-25.05pre-git-x86_64-linux.vmdk                       | nixos-image-vmware-25.05pre-git-x86_64-linux.vmdk               |

     

       164
       164
        
       

     

       165
       165
       +
       - `security.apparmor.policies.<name>.enforce` and `security.apparmor.policies.<name>.enable` were removed.

     

       166
       166
       +
         Configuring the state of apparmor policies must now be done using `security.apparmor.policies.<name>.state` tristate option.

     

       167
       167
       +
       

     

       165
       168
        
       - the notmuch vim plugin now lives in a separate output of the `notmuch`

     

       166
       169
        
         package. Installing `notmuch` will not bring the notmuch vim package anymore,

     

       167
       170
        
         add `vimPlugins.notmuch-vim` to your (Neo)vim configuration if you want the

+58 -40

nixos/modules/security/apparmor.nix

···

       5
       5
        
         ...

     

       6
       6
        
       }:

     

       7
       7
        
       let

     

       8
       8
       -
         inherit (builtins)

     

       9
       9
       -
           attrNames

     

       10
       10
       -
           head

     

       11
       11
       -
           map

     

       12
       12
       -
           match

     

       13
       13
       -
           readFile

     

       14
       14
       -
           ;

     

       15
       8
        
         inherit (lib) types;

     

       16
       9
        
         inherit (config.environment) etc;

     

       17
       10
        
         cfg = config.security.apparmor;

     

       18
       18
       -
         mkDisableOption =

     

       19
       19
       -
           name:

     

       20
       20
       -
           lib.mkEnableOption name

     

       21
       21
       -
           // {

     

       22
       22
       -
             default = true;

     

       23
       23
       -
             example = false;

     

       24
       24
       -
           };

     

       25
       25
       -
         enabledPolicies = lib.filterAttrs (n: p: p.enable) cfg.policies;

     

       11
       11
       +
         enabledPolicies = lib.filterAttrs (n: p: p.state != "disable") cfg.policies;

     

       12
       12
       +
         buildPolicyPath = n: p: lib.defaultTo (pkgs.writeText n p.profile) p.path;

     

       13
       13
       +
       

     

       14
       14
       +
         # Accessing submodule options when not defined results in an error thunk rather than a regular option object

     

       15
       15
       +
         # We can emulate the behavior of `<option>.isDefined` by attempting to evaluate it instead

     

       16
       16
       +
         # This is required because getting isDefined on a submodule is not possible in global module asserts.

     

       17
       17
       +
         submoduleOptionIsDefined = value: (builtins.tryEval value).success;

     

       26
       18
        
       in

     

       27
       19
        
       

     

       28
       20
        
       {

     
···

       31
       23
        
             "security"

     

       32
       24
        
             "apparmor"

     

       33
       25
        
             "confineSUIDApplications"

     

       34
       34
       -
           ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")

     

       26
       26
       +
           ] "Please use the new options: `security.apparmor.policies.<policy>.state'.")

     

       35
       27
        
           (lib.mkRemovedOptionModule [

     

       36
       28
        
             "security"

     

       37
       29
        
             "apparmor"

     
···

       65
       57
        
                 AppArmor policies.

     

       66
       58
        
               '';

     

       67
       59
        
               type = types.attrsOf (

     

       68
       68
       -
                 types.submodule (

     

       69
       69
       -
                   { name, config, ... }:

     

       70
       70
       -
                   {

     

       71
       71
       -
                     options = {

     

       72
       72
       -
                       enable = mkDisableOption "loading of the profile into the kernel";

     

       73
       73
       -
                       enforce = mkDisableOption "enforcing of the policy or only complain in the logs";

     

       74
       74
       -
                       profile = lib.mkOption {

     

       75
       75
       -
                         description = "The policy of the profile.";

     

       76
       76
       -
                         type = types.lines;

     

       77
       77
       -
                         apply = pkgs.writeText name;

     

       78
       78
       -
                       };

     

       60
       60
       +
                 types.submodule {

     

       61
       61
       +
                   options = {

     

       62
       62
       +
                     state = lib.mkOption {

     

       63
       63
       +
                       description = "How strictly this policy should be enforced";

     

       64
       64
       +
                       type = types.enum [

     

       65
       65
       +
                         "disable"

     

       66
       66
       +
                         "complain"

     

       67
       67
       +
                         "enforce"

     

       68
       68
       +
                       ];

     

       69
       69
       +
                       # should enforce really be the default?

     

       70
       70
       +
                       # the docs state that this should only be used once one is REALLY sure nothing's gonna break

     

       71
       71
       +
                       default = "enforce";

     

       79
       72
        
                     };

     

       80
       80
       -
                   }

     

       81
       81
       -
                 )

     

       73
       73
       +
       

     

       74
       74
       +
                     profile = lib.mkOption {

     

       75
       75
       +
                       description = "The profile file contents. Incompatible with path.";

     

       76
       76
       +
                       type = types.lines;

     

       77
       77
       +
                     };

     

       78
       78
       +
       

     

       79
       79
       +
                     path = lib.mkOption {

     

       80
       80
       +
                       description = "A path of a profile file to include. Incompatible with profile.";

     

       81
       81
       +
                       type = types.nullOr types.path;

     

       82
       82
       +
                       default = null;

     

       83
       83
       +
                     };

     

       84
       84
       +
                   };

     

       85
       85
       +
                 }

     

       82
       86
        
               );

     

       83
       87
        
               default = { };

     

       84
       88
        
             };

     
···

       117
       121
        
         };

     

       118
       122
        
       

     

       119
       123
        
         config = lib.mkIf cfg.enable {

     

       120
       120
       -
           assertions = map (policy: {

     

       121
       121
       -
             assertion = match ".*/.*" policy == null;

     

       122
       122
       -
             message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";

     

       123
       123
       -
             # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions

     

       124
       124
       -
             # which does not recurse into sub-directories.

     

       125
       125
       -
           }) (attrNames cfg.policies);

     

       124
       124
       +
           assertions = lib.concatLists (

     

       125
       125
       +
             lib.mapAttrsToList (policyName: policyCfg: [

     

       126
       126
       +
               {

     

       127
       127
       +
                 assertion = builtins.match ".*/.*" policyName == null;

     

       128
       128
       +
                 message = "`security.apparmor.policies.\"${policyName}\"' must not contain a slash.";

     

       129
       129
       +
                 # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions

     

       130
       130
       +
                 # which does not recurse into sub-directories.

     

       131
       131
       +
               }

     

       132
       132
       +
               {

     

       133
       133
       +
                 assertion = lib.xor (policyCfg.path != null) (submoduleOptionIsDefined policyCfg.profile);

     

       134
       134
       +
                 message = "`security.apparmor.policies.\"${policyName}\"` must define exactly one of either path or profile.";

     

       135
       135
       +
               }

     

       136
       136
       +
             ]) cfg.policies

     

       137
       137
       +
           );

     

       126
       138
        
       

     

       127
       139
        
           environment.systemPackages = [

     

       128
       140
        
             pkgs.apparmor-utils

     
···

       133
       145
        
             # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*

     

       134
       146
        
             lib.mapAttrsToList (name: p: {

     

       135
       147
        
               inherit name;

     

       136
       136
       -
               path = p.profile;

     

       148
       148
       +
               path = buildPolicyPath name p;

     

       137
       149
        
             }) enabledPolicies

     

       138
       150
        
             ++ lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes

     

       139
       151
        
           );

     
···

       226
       238
        
                   kill

     

       227
       239
        
                 '';

     

       228
       240
        
                 commonOpts =

     

       229
       229
       -
                   p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";

     

       241
       241
       +
                   n: p:

     

       242
       242
       +
                   "--verbose --show-cache ${

     

       243
       243
       +
                     lib.optionalString (p.state == "complain") "--complain "

     

       244
       244
       +
                   }${buildPolicyPath n p}";

     

       230
       245
        
               in

     

       231
       246
        
               {

     

       232
       247
        
                 Type = "oneshot";

     

       233
       248
        
                 RemainAfterExit = "yes";

     

       234
       249
        
                 ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";

     

       235
       250
        
                 ExecStart = lib.mapAttrsToList (

     

       236
       236
       -
                   n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}"

     

       251
       251
       +
                   n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts n p}"

     

       237
       252
        
                 ) enabledPolicies;

     

       238
       253
        
                 ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;

     

       239
       254
        
                 ExecReload =

     

       240
       255
        
                   # Add or replace into the kernel profiles in enabledPolicies

     

       241
       256
        
                   # (because AppArmor can do that without stopping the processes already confined).

     

       242
       257
        
                   lib.mapAttrsToList (

     

       243
       243
       -
                     n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}"

     

       258
       258
       +
                     n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts n p}"

     

       244
       259
        
                   ) enabledPolicies

     

       245
       260
        
                   ++

     

       246
       261
        
                     # Remove from the kernel any profile whose name is not

     
···

       262
       277
        
           };

     

       263
       278
        
         };

     

       264
       279
        
       

     

       265
       265
       -
         meta.maintainers = with lib.maintainers; [ julm grimmauld ];

     

       280
       280
       +
         meta.maintainers = with lib.maintainers; [

     

       281
       281
       +
           julm

     

       282
       282
       +
           grimmauld

     

       283
       283
       +
         ];

     

       266
       284
        
       }