From 4cee2f4e9c565d0cf01d5355b119f911df34777a Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Fri, 19 Sep 2025 19:34:21 +0200
Subject: [PATCH] nixos/apparmor: add abstraction for golang

Since "Container-aware GOMAXPROCS" was introduced in golang version
1.25.0, there are new paths accessed on every go runtime startup.

Release notes: https://tip.golang.org/doc/go1.25#container-aware-gomaxprocs

> At startup (defaultGOMAXPROCSInit), we read /proc/self/cgroup and
> /proc/self/mountinfo to find our current CPU cgroup and open its
> limit file(s), which remain open for the entire process lifetime. We
> periodically read the current limit by  rereading the limit file(s)
> from the beginning.
>
> https://github.com/golang/go/blob/go1.25.0/src/runtime/cgroup_linux.go#L13
---
 nixos/modules/security/apparmor/includes.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix
index 03f8f5df9d5f..4b759e1d94f9 100644
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@@ -431,6 +431,13 @@ in
     "abstractions/python" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/python"
     '';
+    "abstractions/golang" = ''
+      # Container-aware GOMAXPROCS
+      owner @{PROC}/@{pid}/mountinfo r,
+      owner @{PROC}/@{pid}/cgroup r,
+      @{sys}/fs/cgroup/**/{cpu.cfs_quota_us,cpu.cfs_period_us} r, # V1
+      @{sys}/fs/cgroup/**/cpu.max r, # V2
+    '';
     "abstractions/qt5" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/qt5"
     ''