diff --git a/nixos/modules/services/system/dbus.nix b/nixos/modules/services/system/dbus.nix
index f8d909a4a3c..d4cacb85694 100644
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@@ -11,6 +11,7 @@ let
homeDir = "/run/dbus";
configDir = pkgs.makeDBusConf {
+ inherit (cfg) apparmor;
suidHelper = "${config.security.wrapperDir}/dbus-daemon-launch-helper";
serviceDirectories = cfg.packages;
};
@@ -51,6 +52,20 @@ in
'';
};
+ apparmor = mkOption {
+ type = types.enum [ "enabled" "disabled" "required" ];
+ description = ''
+ AppArmor mode for dbus.
+
+ enabled enables mediation when it's
+ supported in the kernel, disabled
+ always disables AppArmor even with kernel support, and
+ required fails when AppArmor was not found
+ in the kernel.
+ '';
+ default = "disabled";
+ };
+
socketActivated = mkOption {
type = types.nullOr types.bool;
default = null;