Revert "Revert "apparmor: fix and improve the service""

This reverts commit 420f89ceb2.
2021-04-23 07:17:55 +02:00
parent d239bc3643
commit 05d334cfe2
20 changed files with 805 additions and 164 deletions
@@ -1111,6 +1111,21 @@ in
    } else {
      ping.source = "${pkgs.iputils.out}/bin/ping";
    };
+    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
+      /run/wrappers/bin/ping {
+        include <abstractions/base>
+        include <nixos/security.wrappers>
+        rpx /run/wrappers/wrappers.*/ping,
+      }
+      /run/wrappers/wrappers.*/ping {
+        include <abstractions/base>
+        include <nixos/security.wrappers>
+        r /run/wrappers/wrappers.*/ping.real,
+        mrpx ${config.security.wrappers.ping.source},
+        capability net_raw,
+        capability setpcap,
+      }
+    '');

    # Set the host and domain names in the activation script.  Don't
    # clear it if it's not configured in the NixOS configuration,