From 68f5d1fa4cd6400fa697cd7cf6dbb2cf8de17e34 Mon Sep 17 00:00:00 2001
From: Joachim Fasting <joachifm@fastmail.fm>
Date: Sat, 11 May 2019 18:19:35 +0200
Subject: [PATCH 1/2] nixos/apparmor: ensure that apparmor is selected at boot

Otherwise we're subject to whatever defaults were selected at kernel build
time.

See also: https://github.com/NixOS/nixpkgs/issues/61145
---
 nixos/modules/security/apparmor.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix
index 4512a7a80f6..cfc65b347bc 100644
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@@ -29,6 +29,8 @@ in
    config = mkIf cfg.enable {
      environment.systemPackages = [ pkgs.apparmor-utils ];
 
+     boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+
      systemd.services.apparmor = let
        paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d")
          ([ pkgs.apparmor-profiles ] ++ cfg.packages);

From 92d41f83fdf8153bd76440e88302d649ea6f7b9e Mon Sep 17 00:00:00 2001
From: Joachim Fasting <joachifm@fastmail.fm>
Date: Sat, 11 May 2019 18:20:41 +0200
Subject: [PATCH 2/2] nixos/tests/hardened: check that apparmor is properly
 loaded

---
 nixos/tests/hardened.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index 07bd10963ba..614889c4d73 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -30,6 +30,16 @@ import ./make-test.nix ({ pkgs, ...} : {
     ''
       $machine->waitForUnit("multi-user.target");
 
+      subtest "apparmor-loaded", sub {
+          $machine->succeed("systemctl status apparmor.service");
+      };
+
+      # AppArmor securityfs
+      subtest "apparmor-securityfs", sub {
+          $machine->succeed("mountpoint -q /sys/kernel/security");
+          $machine->succeed("cat /sys/kernel/security/apparmor/profiles");
+      };
+
       # Test loading out-of-tree modules
       subtest "extra-module-packages", sub {
           $machine->succeed("grep -Fq wireguard /proc/modules");