nixos/apparmor: ensure that apparmor is selected at boot

Otherwise we're subject to whatever defaults were selected at kernel build
time.

See also: https://github.com/NixOS/nixpkgs/issues/61145
This commit is contained in:
Joachim Fasting 2019-05-11 18:19:35 +02:00
parent bc94dcf500
commit 68f5d1fa4c
No known key found for this signature in database
GPG key ID: 5C204DF675C90294

View file

@ -29,6 +29,8 @@ in
config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.apparmor-utils ];
boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
systemd.services.apparmor = let
paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d")
([ pkgs.apparmor-profiles ] ++ cfg.packages);