nixpkgs/modules/security/apparmor-suid.nix

43 lines
996 B
Nix

{pkgs, config, ...}:
let
cfg = config.security.apparmor;
in
with pkgs.lib;
{
options.security.apparmor.confineSUIDApplications = mkOption {
default = true;
description = ''
Install AppArmor profiles for commonly-used SUID application
to mitigate potential privilege escalation attacks due to bugs
in such applications.
Currently available profiles: ping
'';
};
config = mkIf (cfg.confineSUIDApplications) {
security.apparmor.profiles = [ (pkgs.writeText "ping" ''
#include <tunables/global>
/var/setuid-wrappers/ping {
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice>
capability net_raw,
capability setuid,
network inet raw,
${pkgs.glibc}/lib/*.so mr,
/var/setuid-wrappers/ping.real mixr,
${pkgs.iputils}/sbin/ping mixr,
#/etc/modules.conf r,
## Site-specific additions and overrides. See local/README for details.
##include <local/bin.ping>
}
'') ];
};
}