apparmor: fix and improve the service

2020-09-06 07:43:03 +02:00
parent 539ae5c932
commit fb6d63f3fd
20 changed files with 793 additions and 164 deletions
@@ -1089,6 +1089,21 @@ in
    } else {
      ping.source = "${pkgs.iputils.out}/bin/ping";
    };
+    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
+      /run/wrappers/bin/ping {
+        include <abstractions/base>
+        include <nixos/security.wrappers>
+        rpx /run/wrappers/wrappers.*/ping,
+      }
+      /run/wrappers/wrappers.*/ping {
+        include <abstractions/base>
+        include <nixos/security.wrappers>
+        r /run/wrappers/wrappers.*/ping.real,
+        mrpx ${config.security.wrappers.ping.source},
+        capability net_raw,
+        capability setpcap,
+      }
+    '');

    # Set the host and domain names in the activation script.  Don't
    # clear it if it's not configured in the NixOS configuration,