2014-04-14 14:26:48 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
2013-05-13 13:13:06 +00:00
|
|
|
|
2014-04-15 11:50:39 +00:00
|
|
|
with lib;
|
|
|
|
|
2012-07-16 23:47:41 +00:00
|
|
|
let
|
|
|
|
cfg = config.security.apparmor;
|
|
|
|
in
|
|
|
|
{
|
|
|
|
options = {
|
|
|
|
security.apparmor = {
|
|
|
|
enable = mkOption {
|
2013-10-28 15:14:15 +00:00
|
|
|
type = types.bool;
|
2012-07-16 23:47:41 +00:00
|
|
|
default = false;
|
2014-04-15 11:50:39 +00:00
|
|
|
description = "Enable the AppArmor Mandatory Access Control system.";
|
2012-07-16 23:47:41 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
profiles = mkOption {
|
2013-10-28 15:14:15 +00:00
|
|
|
type = types.listOf types.path;
|
2012-07-16 23:47:41 +00:00
|
|
|
default = [];
|
2014-04-15 11:50:39 +00:00
|
|
|
description = "List of files containing AppArmor profiles.";
|
2012-07-16 23:47:41 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2014-04-15 11:50:39 +00:00
|
|
|
config = mkIf cfg.enable {
|
|
|
|
assertions =
|
|
|
|
[ { assertion = config.boot.kernelPackages.kernel.features ? apparmor
|
|
|
|
&& config.boot.kernelPackages.kernel.features.apparmor;
|
|
|
|
message = "Your selected kernel does not have AppArmor support";
|
|
|
|
}
|
|
|
|
];
|
2013-05-10 13:07:56 +00:00
|
|
|
|
2013-05-11 05:40:45 +00:00
|
|
|
environment.systemPackages = [ pkgs.apparmor ];
|
|
|
|
systemd.services.apparmor = {
|
|
|
|
wantedBy = [ "local-fs.target" ];
|
2014-04-15 11:50:39 +00:00
|
|
|
path = [ pkgs.apparmor ];
|
2013-05-11 05:40:45 +00:00
|
|
|
|
|
|
|
serviceConfig = {
|
2013-05-13 13:13:06 +00:00
|
|
|
Type = "oneshot";
|
|
|
|
RemainAfterExit = "yes";
|
2013-05-28 16:15:16 +00:00
|
|
|
ExecStart = concatMapStrings (profile:
|
|
|
|
''${pkgs.apparmor}/sbin/apparmor_parser -rKv -I ${pkgs.apparmor}/etc/apparmor.d/ "${profile}" ; ''
|
|
|
|
) cfg.profiles;
|
|
|
|
ExecStop = concatMapStrings (profile:
|
2013-05-28 17:49:52 +00:00
|
|
|
''${pkgs.apparmor}/sbin/apparmor_parser -Rv -I ${pkgs.apparmor}/etc/apparmor.d/ "${profile}" ; ''
|
2013-05-28 16:15:16 +00:00
|
|
|
) cfg.profiles;
|
2012-07-16 23:47:41 +00:00
|
|
|
};
|
2013-05-11 05:40:45 +00:00
|
|
|
};
|
2012-07-16 23:47:41 +00:00
|
|
|
};
|
|
|
|
}
|