Skip to content

apparmor: try again to fix and improve #101071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
7c6f434c merged 10 commits into from
Apr 24, 2021
Merged

apparmor: try again to fix and improve #101071

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
05d334c
Revert "Revert "apparmor: fix and improve the service""
ju1m Oct 18, 2020
fca06b1
nixos/apparmor: remove an IFD
bqv Dec 3, 2020
27032f4
nixos/apparmor: fix logprof.conf generation
ju1m Dec 3, 2020
8f9b29d
apparmor: 2.13.5 -> 3.0.0
ju1m Dec 1, 2020
7996dfb
apparmor: 3.0.0 -> 3.0.1
ju1m Dec 25, 2020
03b2156
nixos/apparmor: move release note to 21.05
ju1m Jan 3, 2021
b280e64
transmission: move apparmor profile to Nixpkgs
ju1m Dec 3, 2020
45e5d72
nixos/apparmor: improve code readability
ju1m Feb 27, 2021
76887d7
nixos/apparmor: add test for apparmorRulesFromClosure
ju1m Feb 28, 2021
b42a0e2
nixos/apparmor: disable killUnconfinedConfinables by default
ju1m Feb 28, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion maintainers/maintainer-list.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4937,7 +4937,7 @@
name = "Julien Dehos";
};
julm = {
email = "julm+nix@sourcephile.fr";
email = "julm+nixpkgs@sourcephile.fr";
github = "ju1m";
githubId = 21160136;
name = "Julien Moutinho";
Expand Down
17 changes: 17 additions & 0 deletions nixos/doc/manual/release-notes/rl-2105.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -857,6 +857,23 @@ environment.systemPackages = [
Note that users defined with an explicit UID below 500 are exempted from this check, as <xref linkend="opt-users.users._name_.isSystemUser" /> has no effect for those.
</para>
</listitem>
<listitem>
<para>
The <literal>security.apparmor</literal> module,
for the <link xlink:href="https://gitlab.com/apparmor/apparmor/-/wikis/Documentation">AppArmor</link>
Mandatory Access Control system,
has been substantialy improved along with related tools,
so that module maintainers can now more easily write AppArmor profiles for NixOS.
The most notable change on the user-side is the new option <xref linkend="opt-security.apparmor.policies"/>,
replacing the previous <literal>profiles</literal> option
to provide a way to disable a profile
and to select whether to confine in enforce mode (default)
or in complain mode (see <literal>journalctl -b --grep apparmor</literal>).
Security-minded users may also want to enable <xref linkend="opt-security.apparmor.killUnconfinedConfinables"/>,
at the cost of having some of their processes killed
when updating to a NixOS version introducing new AppArmor profiles.
</para>
</listitem>
<listitem>
<para>
The GNOME desktop manager once again installs <package>gnome3.epiphany</package> by default.
Expand Down
34 changes: 34 additions & 0 deletions nixos/modules/config/fonts/fontconfig.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -448,6 +448,40 @@ in
(mkIf cfg.enable {
environment.systemPackages = [ pkgs.fontconfig ];
environment.etc.fonts.source = "${fontconfigEtc}/etc/fonts/";
security.apparmor.includes."abstractions/fonts" = ''
# fonts.conf
r ${pkg.out}/etc/fonts/fonts.conf,

# fontconfig default config files
r ${pkg.out}/etc/fonts/conf.d/*.conf,

# 00-nixos-cache.conf
r ${cacheConf},

# 10-nixos-rendering.conf
r ${renderConf},

# 50-user.conf
${optionalString cfg.includeUserConf ''
r ${pkg.out}/etc/fonts/conf.d.bak/50-user.conf,
''}

# local.conf (indirect priority 51)
${optionalString (cfg.localConf != "") ''
r ${localConf},
''}

# 52-nixos-default-fonts.conf
r ${defaultFontsConf},

# 53-no-bitmaps.conf
r ${rejectBitmaps},

${optionalString (!cfg.allowType1) ''
# 53-nixos-reject-type1.conf
r ${rejectType1},
''}
'';
})
(mkIf cfg.enable {
fonts.fontconfig.confPackages = [ confPkg ];
Expand Down
7 changes: 7 additions & 0 deletions nixos/modules/config/malloc.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,5 +87,12 @@ in
environment.etc."ld-nix.so.preload".text = ''
${providerLibPath}
'';
security.apparmor.includes = {
"abstractions/base" = ''
r /etc/ld-nix.so.preload,
r ${config.environment.etc."ld-nix.so.preload".source},
mr ${providerLibPath},
'';
};
};
}
1 change: 0 additions & 1 deletion nixos/modules/module-list.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,6 @@
./rename.nix
./security/acme.nix
./security/apparmor.nix
./security/apparmor-suid.nix
./security/audit.nix
./security/auditd.nix
./security/ca.nix
Expand Down
1 change: 1 addition & 0 deletions nixos/modules/profiles/hardened.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ with lib;
security.virtualisation.flushL1DataCache = mkDefault "always";

security.apparmor.enable = mkDefault true;
security.apparmor.killUnconfinedConfinables = mkDefault true;
Copy link
Contributor

@necessarily-equal necessarily-equal Apr 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't the doc you added say this default to false?

Copy link
Contributor Author

@ju1m ju1m Apr 23, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, it does not appear to contradict the doc to me, though I've tried to clarify a bit, but tell me if I've missed somthing or if that's not clear enough. See also #101071 (comment) where I explain why I proposed to still set killUnconfinedConfinables in the hardened.nix profile.


boot.kernelParams = [
# Slab/slub sanity checks, redzoning, and poisoning
Expand Down
49 changes: 0 additions & 49 deletions nixos/modules/security/apparmor-suid.nix
View file
Open in desktop

This file was deleted.

Loading