nixos/apparmor: move release note to 21.05
This commit is contained in:
parent
7996dfb1a1
commit
03b2156d26
|
@ -1513,24 +1513,6 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
|
|||
to get the previous behavior of listening on all network interfaces.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <literal>security.apparmor</literal> module,
|
||||
for the <link xlink:href="https://gitlab.com/apparmor/apparmor/-/wikis/Documentation">AppArmor</link>
|
||||
Mandatory Access Control system,
|
||||
has been substantialy improved along with related tools,
|
||||
so that module maintainers can now more easily write AppArmor profiles for NixOS.
|
||||
The most notable change on the user-side is the new option <xref linkend="opt-security.apparmor.policies"/>,
|
||||
replacing the previous <literal>profiles</literal> option
|
||||
to provide a way to disable a profile
|
||||
and to select whether to confine in enforce mode (default)
|
||||
or in complain mode (see <literal>journalctl -b --grep apparmor</literal>).
|
||||
Before enabling this module, either directly
|
||||
or by importing <literal><nixpkgs/nixos/modules/profiles/hardened.nix></literal>,
|
||||
please be sure to read the documentation of <link linkend="opt-security.apparmor.enable">security.apparmor.enable</link>,
|
||||
and especially the part about <xref linkend="opt-security.apparmor.killUnconfinedConfinables"/>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
With this release <literal>systemd-networkd</literal> (when enabled through <xref linkend="opt-networking.useNetworkd"/>)
|
||||
|
|
|
@ -857,6 +857,24 @@ environment.systemPackages = [
|
|||
Note that users defined with an explicit UID below 500 are exempted from this check, as <xref linkend="opt-users.users._name_.isSystemUser" /> has no effect for those.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <literal>security.apparmor</literal> module,
|
||||
for the <link xlink:href="https://gitlab.com/apparmor/apparmor/-/wikis/Documentation">AppArmor</link>
|
||||
Mandatory Access Control system,
|
||||
has been substantialy improved along with related tools,
|
||||
so that module maintainers can now more easily write AppArmor profiles for NixOS.
|
||||
The most notable change on the user-side is the new option <xref linkend="opt-security.apparmor.policies"/>,
|
||||
replacing the previous <literal>profiles</literal> option
|
||||
to provide a way to disable a profile
|
||||
and to select whether to confine in enforce mode (default)
|
||||
or in complain mode (see <literal>journalctl -b --grep apparmor</literal>).
|
||||
Before enabling this module, either directly
|
||||
or by importing <literal><nixpkgs/nixos/modules/profiles/hardened.nix></literal>,
|
||||
please be sure to read the documentation of <link linkend="opt-security.apparmor.enable">security.apparmor.enable</link>,
|
||||
and especially the part about <xref linkend="opt-security.apparmor.killUnconfinedConfinables"/>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The GNOME desktop manager once again installs <package>gnome3.epiphany</package> by default.
|
||||
|
|
Loading…
Reference in a new issue