Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable AppArmor in NixOS module #2

Draft
wants to merge 21 commits into
base: main
Choose a base branch
from
Draft

Enable AppArmor in NixOS module #2

wants to merge 21 commits into from

Conversation

io12
Copy link
Member

@io12 io12 commented Nov 25, 2023

No description provided.

@io12 io12 marked this pull request as draft November 25, 2023 09:32
@io12
Copy link
Member Author

io12 commented Nov 25, 2023

The current issue is for some reason snap-confine can't read libudev even though the AppArmor profile was patched to have this rule.

/{,usr/,/nix/store/aglgni7yskphxmpdkc8yvah61drjfkqk-systemd-minimal-libs-254.3/}lib{,32,64,x32}/{,@{multiarch}/}libudev.so* mr,

@io12 io12 mentioned this pull request Nov 25, 2023
Open
@io12
Copy link
Member Author

io12 commented Nov 26, 2023

The current issue is for some reason snap-confine can't read libudev even though the AppArmor profile was patched to have this rule.

/{,usr/,/nix/store/aglgni7yskphxmpdkc8yvah61drjfkqk-systemd-minimal-libs-254.3/}lib{,32,64,x32}/{,@{multiarch}/}libudev.so* mr,

Making a new rule instead of extending the old one with the {a,b} expansion seems to work.

io12 added 21 commits April 25, 2024 15:46
@io12
Enable AppArmor in NixOS module
7b12d88
@io12
Add apparmor_parser to PATH of snapd
a6e5750
@io12
Read apparmor_parser from PATH
15f6292
@io12
Add snap to AppArmor include path
76a6183
@io12
Try to fix AppArmor policy load
77ffdf3
@io12
Try again to load policy
1720342
@io12
Pre-create /var/lib/snapd/apparmor/snap-confine
d290536
@io12
Precreate it before apparmor loads
4ee7ccd
@io12
Temporarily remove microk8s tests
ef39a50
@io12
Use full apparmor_parser path
28c3857
@io12
Change apparmor profile to point to unwrapped
66de8ea
@io12
Add nix store paths to apparmor profile
75aefbd
@io12
Fix build
3abaa9d
@io12
Actually fix build
46c37a8
@io12
Fix util-linux var
4593ebb
@io12
Add coreutils var
d440916
@io12
Fix apparmor parser error
b0ca442
@io12
Actually fix apparmor parser error
de448df
@io12
Actually actually fix apparmor parse error
a329973
@io12
Put nix-specific apparmor rules on separate lines
5b8d83d
@io12
Fix libcap path
173b8af
@io12 io12 force-pushed the enable-apparmor branch from 2274a72 to 173b8af Compare April 25, 2024 19:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@io12