public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #61306 from joachifm/feat/fix-apparmor-boot-linux_5_1

Browse Source 
Fix apparmor boot on linux 5.1
This commit is contained in:
Joachim F
2019-05-12 15:17:38 +00:00
committed by GitHub
parent c99a01aa7a 92d41f83fd
commit 428ddf0619
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/security/apparmor.nix
+2
View File
@@ -29,6 +29,8 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.apparmor-utils ]; environment.systemPackages = [ pkgs.apparmor-utils ];
boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
systemd.services.apparmor = let systemd.services.apparmor = let
paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d") paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d")
([ pkgs.apparmor-profiles ] ++ cfg.packages); ([ pkgs.apparmor-profiles ] ++ cfg.packages);
nixos/tests/hardened.nix
+10
View File
@@ -30,6 +30,16 @@ import ./make-test.nix ({ pkgs, ...} : {
'' ''
$machine->waitForUnit("multi-user.target"); $machine->waitForUnit("multi-user.target");
subtest "apparmor-loaded", sub {
$machine->succeed("systemctl status apparmor.service");
};
# AppArmor securityfs
subtest "apparmor-securityfs", sub {
$machine->succeed("mountpoint -q /sys/kernel/security");
$machine->succeed("cat /sys/kernel/security/apparmor/profiles");
};
# Test loading out-of-tree modules # Test loading out-of-tree modules
subtest "extra-module-packages", sub { subtest "extra-module-packages", sub {
$machine->succeed("grep -Fq wireguard /proc/modules"); $machine->succeed("grep -Fq wireguard /proc/modules");