nixos/modules/security/apparmor.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.security.apparmor;
in
{
  options = {
    security.apparmor = {
      enable = mkOption {
        type = types.bool;
        default = false;
        description = "Enable the AppArmor Mandatory Access Control system.";
      };

      profiles = mkOption {
        type = types.listOf types.path;
        default = [];
        description = "List of files containing AppArmor profiles.";
      };
    };
  };

  config = mkIf cfg.enable {
    environment.systemPackages = [ pkgs.apparmor ];
    systemd.services.apparmor = {
      wantedBy = [ "local-fs.target" ];
      path     = [ pkgs.apparmor ];

      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = "yes";
        ExecStart = concatMapStrings (profile:
          ''${pkgs.apparmor}/sbin/apparmor_parser -rKv -I ${pkgs.apparmor}/etc/apparmor.d/ "${profile}" ; ''
        ) cfg.profiles;
        ExecStop = concatMapStrings (profile:
          ''${pkgs.apparmor}/sbin/apparmor_parser -Rv -I ${pkgs.apparmor}/etc/apparmor.d/ "${profile}" ; ''
        ) cfg.profiles;
      };
    };
  };
}