AppArmor: packaged
This commit is contained in:
parent
8bde72d99c
commit
4549bad2f4
|
@ -47,6 +47,7 @@
|
|||
./programs/ssmtp.nix
|
||||
./programs/wvdial.nix
|
||||
./rename.nix
|
||||
./security/apparmor.nix
|
||||
./security/ca.nix
|
||||
./security/consolekit.nix
|
||||
./security/pam.nix
|
||||
|
|
52
modules/security/apparmor.nix
Normal file
52
modules/security/apparmor.nix
Normal file
|
@ -0,0 +1,52 @@
|
|||
{pkgs, config, ...}:
|
||||
let
|
||||
cfg = config.security.apparmor;
|
||||
in
|
||||
with pkgs.lib;
|
||||
{
|
||||
|
||||
###### interface
|
||||
|
||||
options = {
|
||||
|
||||
security.apparmor = {
|
||||
|
||||
enable = mkOption {
|
||||
default = false;
|
||||
description = ''
|
||||
Enable AppArmor application security system
|
||||
'';
|
||||
};
|
||||
|
||||
profiles = mkOption {
|
||||
default = [];
|
||||
merge = mergeListOption;
|
||||
description = ''
|
||||
List of file names of AppArmor profiles.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
###### implementation
|
||||
|
||||
config = mkIf (cfg.enable) {
|
||||
|
||||
jobs.apparmor =
|
||||
{ startOn = "startup";
|
||||
|
||||
path = [ pkgs.apparmor ];
|
||||
|
||||
preStart = concatMapStrings (profile: ''
|
||||
apparmor_parser -Kv -I ${pkgs.apparmor}/etc/apparmor.d/ "${profile}"
|
||||
'') cfg.profiles;
|
||||
|
||||
postStop = ''
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
Loading…
Reference in a new issue