From 68f5d1fa4cd6400fa697cd7cf6dbb2cf8de17e34 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Sat, 11 May 2019 18:19:35 +0200 Subject: [PATCH] nixos/apparmor: ensure that apparmor is selected at boot Otherwise we're subject to whatever defaults were selected at kernel build time. See also: https://github.com/NixOS/nixpkgs/issues/61145 --- nixos/modules/security/apparmor.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix index 4512a7a80f6..cfc65b347bc 100644 --- a/nixos/modules/security/apparmor.nix +++ b/nixos/modules/security/apparmor.nix @@ -29,6 +29,8 @@ in config = mkIf cfg.enable { environment.systemPackages = [ pkgs.apparmor-utils ]; + boot.kernelParams = [ "apparmor=1" "security=apparmor" ]; + systemd.services.apparmor = let paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d") ([ pkgs.apparmor-profiles ] ++ cfg.packages);