From eba90bba663352aec63632d2547c07e19414923b Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 21 Apr 2025 03:00:11 +0200 Subject: [PATCH 1/5] apparmor: 4.0.3 -> 4.1.0, rewrite Upstream release: https://gitlab.com/apparmor/apparmor/-/releases/v4.1.0 Notable changes made to the packaging: - apparmor-kernel-patches: drop. This was outdated and unused, and wouldn't even apply to any kernel anymore. - aa-teardown: migrate to writeShellAPplication - apparmor-*: migrate to by-name - apparmor-*: enable checks and actually run checks - libapparmor: test python module imports correctly - libapparmor: no seperate $python output (makes no sense) --- .../by-name/ap/apparmor-bin-utils/package.nix | 53 +++ pkgs/by-name/ap/apparmor-pam/package.nix | 40 ++ .../fix-rc.apparmor.functions.sh | 0 pkgs/by-name/ap/apparmor-parser/package.nix | 75 +++ pkgs/by-name/ap/apparmor-profiles/package.nix | 42 ++ .../ap/apparmor-profiles/test_config.nix | 47 ++ pkgs/by-name/ap/apparmor-teardown/package.nix | 33 ++ pkgs/by-name/ap/apparmor-utils/package.nix | 86 ++++ .../libapparmor/apparmorRulesFromClosure.nix | 35 ++ pkgs/by-name/li/libapparmor/package.nix | 108 +++++ ...0001-aa-remove-unknown_empty-ruleset.patch | 30 -- pkgs/os-specific/linux/apparmor/default.nix | 435 ------------------ pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 11 +- 14 files changed, 521 insertions(+), 475 deletions(-) create mode 100644 pkgs/by-name/ap/apparmor-bin-utils/package.nix create mode 100644 pkgs/by-name/ap/apparmor-pam/package.nix rename pkgs/{os-specific/linux/apparmor => by-name/ap/apparmor-parser}/fix-rc.apparmor.functions.sh (100%) create mode 100644 pkgs/by-name/ap/apparmor-parser/package.nix create mode 100644 pkgs/by-name/ap/apparmor-profiles/package.nix create mode 100644 pkgs/by-name/ap/apparmor-profiles/test_config.nix create mode 100644 pkgs/by-name/ap/apparmor-teardown/package.nix create mode 100644 pkgs/by-name/ap/apparmor-utils/package.nix create mode 100644 pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix create mode 100644 pkgs/by-name/li/libapparmor/package.nix delete mode 100644 pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch delete mode 100644 pkgs/os-specific/linux/apparmor/default.nix diff --git a/pkgs/by-name/ap/apparmor-bin-utils/package.nix b/pkgs/by-name/ap/apparmor-bin-utils/package.nix new file mode 100644 index 000000000000..5c4c555abcf4 --- /dev/null +++ b/pkgs/by-name/ap/apparmor-bin-utils/package.nix @@ -0,0 +1,53 @@ +{ + lib, + stdenv, + pkg-config, + which, + buildPackages, + + # apparmor deps + libapparmor, + + # testing + perl, +}: +stdenv.mkDerivation { + pname = "apparmor-bin-utils"; + inherit (libapparmor) + version + src + ; + + sourceRoot = "${libapparmor.src.name}/binutils"; + + nativeBuildInputs = [ + pkg-config + libapparmor + which + ]; + + buildInputs = [ + libapparmor + ]; + + makeFlags = [ + "LANGS=" + "USE_SYSTEM=1" + "POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}" + "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}" + "MANDIR=share/man" + ]; + + doCheck = true; + checkInputs = [ perl ]; + + installFlags = [ + "DESTDIR=$(out)" + "BINDIR=$(out)/bin" + "SBINDIR=$(out)/bin" + ]; + + meta = libapparmor.meta // { + description = "Mandatory access control system - binary user-land utilities"; + }; +} diff --git a/pkgs/by-name/ap/apparmor-pam/package.nix b/pkgs/by-name/ap/apparmor-pam/package.nix new file mode 100644 index 000000000000..0ff8d62aa310 --- /dev/null +++ b/pkgs/by-name/ap/apparmor-pam/package.nix @@ -0,0 +1,40 @@ +{ + stdenv, + pkg-config, + which, + pam, + + # apparmor deps + libapparmor, +}: +stdenv.mkDerivation { + pname = "apparmor-pam"; + inherit (libapparmor) + version + src + ; + + postPatch = '' + substituteInPlace Makefile \ + --replace-fail "pkg-config" "$PKG_CONFIG" + ''; + + nativeBuildInputs = [ + pkg-config + which + ]; + + buildInputs = [ + libapparmor + pam + ]; + + sourceRoot = "${libapparmor.src.name}/changehat/pam_apparmor"; + + makeFlags = [ "USE_SYSTEM=1" ]; + installFlags = [ "DESTDIR=$(out)" ]; + + meta = libapparmor.meta // { + description = "Mandatory access control system - PAM service"; + }; +} diff --git a/pkgs/os-specific/linux/apparmor/fix-rc.apparmor.functions.sh b/pkgs/by-name/ap/apparmor-parser/fix-rc.apparmor.functions.sh similarity index 100% rename from pkgs/os-specific/linux/apparmor/fix-rc.apparmor.functions.sh rename to pkgs/by-name/ap/apparmor-parser/fix-rc.apparmor.functions.sh diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix new file mode 100644 index 000000000000..f3b884aa9b10 --- /dev/null +++ b/pkgs/by-name/ap/apparmor-parser/package.nix @@ -0,0 +1,75 @@ +{ + lib, + stdenv, + which, + flex, + bison, + linuxHeaders ? stdenv.cc.libc.linuxHeaders, + buildPackages, + + # apparmor deps + libapparmor, + + # testing + perl, + python3, + bashInteractive, +}: +stdenv.mkDerivation (finalAttrs: { + pname = "apparmor-parser"; + inherit (libapparmor) version src; + + postPatch = '' + patchShebangs . + cd parser + + substituteInPlace Makefile \ + --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" + substituteInPlace rc.apparmor.functions \ + --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" # FIXME + substituteInPlace rc.apparmor.functions \ + --replace-fail "/usr/sbin/aa-status" '$(which aa-status)' + sed -i rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}' + ''; + + nativeBuildInputs = [ + bison + flex + which + ]; + + buildInputs = [ libapparmor ]; + + makeFlags = [ + "LANGS=" + "USE_SYSTEM=1" + "INCLUDEDIR=${libapparmor}/include" + "AR=${stdenv.cc.bintools.targetPrefix}ar" + "POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}" + "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}" + "MANDIR=share/man" + ] ++ lib.optional finalAttrs.doCheck "PROVE=${lib.getExe' perl "prove"}"; + + installFlags = [ + "DESTDIR=$(out)" + "DISTRO=unknown" + ]; + + preCheck = "pushd ./tst"; + + checkTarget = "tests"; + + postCheck = "popd"; + + doCheck = stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isMusl; + checkInputs = [ + bashInteractive + perl + python3 + ]; + + meta = libapparmor.meta // { + description = "Mandatory access control system - core library"; + mainProgram = "apparmor_parser"; + }; +}) diff --git a/pkgs/by-name/ap/apparmor-profiles/package.nix b/pkgs/by-name/ap/apparmor-profiles/package.nix new file mode 100644 index 000000000000..384249b8ac93 --- /dev/null +++ b/pkgs/by-name/ap/apparmor-profiles/package.nix @@ -0,0 +1,42 @@ +{ + stdenv, + which, + callPackage, + + # apparmor deps + libapparmor, + apparmor-parser, + apparmor-utils, +}: +stdenv.mkDerivation { + pname = "apparmor-profiles"; + inherit (libapparmor) version src; + + sourceRoot = "${libapparmor.src.name}/profiles"; + + nativeBuildInputs = [ which ]; + + installFlags = [ + "DESTDIR=$(out)" + "EXTRAS_DEST=$(out)/share/apparmor/extra-profiles" + ]; + + checkTarget = "check"; + + checkInputs = [ + apparmor-parser + apparmor-utils + ]; + + preCheck = '' + export USE_SYSTEM=1 + export LOGPROF="aa-logprof --configdir ${callPackage ./test_config.nix { }} --no-check-mountpoint" + ''; + + doCheck = true; + + meta = libapparmor.meta // { + description = "Mandatory access control system - profiles"; + mainProgram = "apparmor_parser"; + }; +} diff --git a/pkgs/by-name/ap/apparmor-profiles/test_config.nix b/pkgs/by-name/ap/apparmor-profiles/test_config.nix new file mode 100644 index 000000000000..3aa3d2ee2b32 --- /dev/null +++ b/pkgs/by-name/ap/apparmor-profiles/test_config.nix @@ -0,0 +1,47 @@ +{ + lib, + runCommand, + util-linux, + stdenv, + runtimeShell, + bashInteractive, + + # apparmor deps + libapparmor, + apparmor-parser, +}: +(runCommand "logprof_conf" + { + header = '' + [settings] + # /etc/apparmor.d/ is read-only on NixOS + profiledir = /var/cache/apparmor/logprof + inactive_profiledir = /etc/apparmor.d/disable + # Use: journalctl -b --since today --grep audit: | aa-logprof + logfiles = /dev/stdin + + parser = ${lib.getExe apparmor-parser} + ldd = ${lib.getExe' stdenv.cc.libc "ldd"} + logger = ${util-linux}/bin/logger + + # customize how file ownership permissions are presented + # 0 - off + # 1 - default of what ever mode the log reported + # 2 - force the new permissions to be user + # 3 - force all perms on the rule to be user + default_owner_prompt = 1 + + [qualifiers] + ${runtimeShell} = icnu + ${bashInteractive}/bin/sh = icnu + ${bashInteractive}/bin/bash = icnu + ''; + passAsFile = [ "header" ]; + } + '' + mkdir $out + cp $headerPath $out/logprof.conf + ln -s ${libapparmor.src}/utils/severity.db $out/severity.db + sed '1,/\[qualifiers\]/d' ${libapparmor.src}/utils/logprof.conf >> $out/logprof.conf + '' +) diff --git a/pkgs/by-name/ap/apparmor-teardown/package.nix b/pkgs/by-name/ap/apparmor-teardown/package.nix new file mode 100644 index 000000000000..f5c299b24d76 --- /dev/null +++ b/pkgs/by-name/ap/apparmor-teardown/package.nix @@ -0,0 +1,33 @@ +{ + writeShellApplication, + coreutils, + gnused, + gnugrep, + which, + + # apparmor deps + apparmor-parser, + apparmor-bin-utils, + libapparmor, +}: +writeShellApplication { + name = "apparmor-teardown"; + runtimeInputs = [ + apparmor-parser + apparmor-bin-utils + coreutils + gnused + gnugrep + which + ]; + + text = '' + set +e # the imported script tries to `read` an empty line + # shellcheck source=/dev/null + . ${apparmor-parser}/lib/apparmor/rc.apparmor.functions + remove_profiles + exit 0 + ''; + + inherit (libapparmor) meta; +} diff --git a/pkgs/by-name/ap/apparmor-utils/package.nix b/pkgs/by-name/ap/apparmor-utils/package.nix new file mode 100644 index 000000000000..06e773dcc5f9 --- /dev/null +++ b/pkgs/by-name/ap/apparmor-utils/package.nix @@ -0,0 +1,86 @@ +{ + lib, + makeWrapper, + gawk, + perl, + bash, + stdenv, + which, + linuxHeaders ? stdenv.cc.libc.linuxHeaders, + python3Packages, + bashNonInteractive, + buildPackages, + + # apparmor deps + libapparmor, + apparmor-parser, + apparmor-teardown, +}: +python3Packages.buildPythonApplication { + pname = "apparmor-utils"; + inherit (libapparmor) version src; + + postPatch = + '' + patchShebangs . + cd utils + + substituteInPlace aa-remove-unknown \ + --replace-fail "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions" + substituteInPlace Makefile \ + --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" + sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' Makefile + sed -i aa-unconfined -e "/my_env\['PATH'\]/d" + '' + + (lib.optionalString stdenv.hostPlatform.isMusl '' + sed -i Makefile -e "/\/d" + ''); + + format = "other"; + strictDeps = true; + + doCheck = true; + + nativeBuildInputs = [ + makeWrapper + which + bashNonInteractive + python3Packages.setuptools + ]; + + buildInputs = [ + bash + perl + ]; + + pythonPath = [ + python3Packages.notify2 + python3Packages.psutil + libapparmor + ]; + + makeFlags = [ + "LANGS=" + "POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}" + "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}" + "MANDIR=share/man" + ]; + + installFlags = [ + "DESTDIR=$(out)" + "BINDIR=$(out)/bin" + "VIM_INSTALL_PATH=$(out)/share" + "PYPREFIX=" + ]; + + postInstall = '' + wrapProgram $out/bin/aa-remove-unknown \ + --prefix PATH : ${lib.makeBinPath [ gawk ]} + + ln -s ${lib.getExe apparmor-teardown} $out/bin/aa-teardown + ''; + + meta = libapparmor.meta // { + description = "Mandatory access control system - script user-land utilities"; + }; +} diff --git a/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix b/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix new file mode 100644 index 000000000000..a12b8f0459be --- /dev/null +++ b/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix @@ -0,0 +1,35 @@ +{ + runCommand, + closureInfo, + lib, +}: +{ + # The store path of the derivation is given in $path + additionalRules ? [ ], + # TODO: factorize here some other common paths + # that may emerge from use cases. + baseRules ? [ + "r $path" + "r $path/etc/**" + "mr $path/share/**" + # Note that not all libraries are prefixed with "lib", + # eg. glibc-2.30/lib/ld-2.30.so + "mr $path/lib/**.so*" + "mr $path/lib64/**.so*" + # eg. glibc-2.30/lib/gconv/gconv-modules + "r $path/lib/**" + "r $path/lib64/**" + # Internal executables + "ixr $path/libexec/**" + ], + name ? "", +}: +rootPaths: +runCommand ("apparmor-closure-rules" + lib.optionalString (name != "") "-${name}") { } '' + touch $out + while read -r path + do printf >>$out "%s,\n" ${ + lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules) + } + done <${closureInfo { inherit rootPaths; }}/store-paths +'' diff --git a/pkgs/by-name/li/libapparmor/package.nix b/pkgs/by-name/li/libapparmor/package.nix new file mode 100644 index 000000000000..a9f83c87bef2 --- /dev/null +++ b/pkgs/by-name/li/libapparmor/package.nix @@ -0,0 +1,108 @@ +{ + stdenv, + lib, + fetchFromGitLab, + autoreconfHook, + autoconf-archive, + pkg-config, + which, + flex, + bison, + withPerl ? + stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl, + perl, + withPython ? lib.meta.availableOn stdenv.hostPlatform python3Packages.python, + python3Packages, + swig, + ncurses, + libxcrypt, + + # test + dejagnu, + + # passthru + nix-update-script, + nixosTests, + callPackage, +}: +stdenv.mkDerivation (finalAttrs: { + pname = "libapparmor"; + version = "4.1.0"; + + src = fetchFromGitLab { + owner = "apparmor"; + repo = "apparmor"; + tag = "v${finalAttrs.version}"; + hash = "sha256-oj6mGw/gvoRGpJqw72Lk6LJuurg8efjiV1pvZYbXz6A="; + }; + sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor"; + + postPatch = '' + substituteInPlace swig/perl/Makefile.am \ + --replace-fail install_vendor install_site + ''; + + strictDeps = true; + + nativeBuildInputs = + [ + autoconf-archive + autoreconfHook + bison + flex + pkg-config + swig + ncurses + which + dejagnu + ] + ++ lib.optionals withPython [ + python3Packages.setuptools + ]; + + nativeCheckInputs = [ + python3Packages.pythonImportsCheckHook + perl + ]; + + buildInputs = + [ libxcrypt ] ++ (lib.optional withPerl perl) ++ (lib.optional withPython python3Packages.python); + + # required to build apparmor-parser + dontDisableStatic = true; + + # https://gitlab.com/apparmor/apparmor/issues/1 + configureFlags = [ + (lib.withFeature withPerl "perl") + (lib.withFeature withPython "python") + ]; + + doCheck = withPerl && withPython; + + checkInputs = [ dejagnu ]; + + pythonImportsCheck = [ + "LibAppArmor" + ]; + + passthru = { + updateScript = nix-update-script { }; + tests.nixos = nixosTests.apparmor; + apparmorRulesFromClosure = callPackage ./apparmorRulesFromClosure.nix { }; + }; + + meta = { + homepage = "https://apparmor.net/"; + description = "Mandatory access control system - core library"; + license = with lib.licenses; [ + gpl2Only + lgpl21Only + ]; + maintainers = with lib.maintainers; [ + julm + thoughtpolice + grimmauld + ]; + platforms = lib.platforms.linux; + }; +}) diff --git a/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch b/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch deleted file mode 100644 index ce2a0e7cc5b3..000000000000 --- a/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch +++ /dev/null @@ -1,30 +0,0 @@ -commit 166afaf144d6473464975438353257359dd51708 -Author: Andreas Wiese -Date: Thu Feb 1 11:35:02 2024 +0100 - - aa-remove-unknown: fix readability check - - This check is intended for ensuring that the profiles file can actually - be opened. The *actual* check is performed by the shell, not the read - utility, which won't even be executed if the input redirection (and - hence the test) fails. - - If the test succeeds, though, using `read` here might actually - jeopardize the test result if there are no profiles loaded and the file - is empty. - - This commit fixes that case by simply using `true` instead of `read`. - -diff --git a/utils/aa-remove-unknown b/utils/aa-remove-unknown -index 0e00d6a0..3351feef 100755 ---- a/utils/aa-remove-unknown -+++ b/utils/aa-remove-unknown -@@ -63,7 +63,7 @@ fi - # We have to do this check because error checking awk's getline() below is - # tricky and, as is, results in an infinite loop when apparmorfs returns an - # error from open(). --if ! IFS= read -r _ < "$PROFILES" ; then -+if ! true < "$PROFILES" ; then - echo "ERROR: Unable to read apparmorfs profiles file" 1>&2 - exit 1 - elif [ ! -w "$REMOVE" ] ; then diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix deleted file mode 100644 index b9cc52fb5bb8..000000000000 --- a/pkgs/os-specific/linux/apparmor/default.nix +++ /dev/null @@ -1,435 +0,0 @@ -{ - stdenv, - lib, - fetchFromGitLab, - fetchpatch, - makeWrapper, - autoreconfHook, - autoconf-archive, - pkg-config, - which, - flex, - bison, - linuxHeaders ? stdenv.cc.libc.linuxHeaders, - gawk, - withPerl ? - stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl, - perl, - withPython ? - stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python3, - python3, - swig, - ncurses, - pam, - libnotify, - buildPackages, - coreutils, - bash, - gnugrep, - gnused, - kmod, - writeShellScript, - closureInfo, - runCommand, - libxcrypt, -}: - -let - apparmor-version = "4.0.3"; - - apparmor-meta = - component: with lib; { - homepage = "https://apparmor.net/"; - description = "Mandatory access control system - ${component}"; - license = with licenses; [ - gpl2Only - lgpl21Only - ]; - maintainers = with maintainers; [ - julm - thoughtpolice - grimmauld - ]; - platforms = platforms.linux; - }; - - apparmor-sources = fetchFromGitLab { - owner = "apparmor"; - repo = "apparmor"; - rev = "v${apparmor-version}"; - hash = "sha256-6RMttvlXepxUyqdZeDujjVGOwuXl/nXnjii4sA/ppc4="; - }; - - aa-teardown = writeShellScript "aa-teardown" '' - PATH="${ - lib.makeBinPath [ - coreutils - gnused - gnugrep - ] - }:$PATH" - . ${apparmor-parser}/lib/apparmor/rc.apparmor.functions - remove_profiles - ''; - - prePatchCommon = '' - chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh - patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh - substituteInPlace ./common/Make.rules \ - --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man" \ - --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html" \ - --replace "/usr/share/man" "share/man" - substituteInPlace ./utils/Makefile \ - --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" - ''; - - patches = - [ - ./0001-aa-remove-unknown_empty-ruleset.patch - - (fetchpatch { - name = "basename.patch"; - url = "https://gitlab.com/apparmor/apparmor/-/commit/7fb040bde69ebdfce48cf1a01c1a62fd4f8eef0a.patch"; - hash = "sha256-RZ04nfcV8hTd2CO3mYcfOGCLke8+FhV7DPfmDqSSdWk="; - }) - ] - ++ lib.optionals stdenv.hostPlatform.isMusl [ - (fetchpatch { - url = "https://git.alpinelinux.org/aports/plain/testing/apparmor/0003-Added-missing-typedef-definitions-on-parser.patch?id=74b8427cc21f04e32030d047ae92caa618105b53"; - name = "0003-Added-missing-typedef-definitions-on-parser.patch"; - sha256 = "0yyaqz8jlmn1bm37arggprqz0njb4lhjni2d9c8qfqj0kll0bam0"; - }) - ]; - - python = python3.withPackages (ps: with ps; [ setuptools ]); - - # Set to `true` after the next FIXME gets fixed or this gets some - # common derivation infra. Too much copy-paste to fix one by one. - doCheck = false; - - # FIXME: convert these to a single multiple-outputs package? - - libapparmor = stdenv.mkDerivation { - pname = "libapparmor"; - version = apparmor-version; - - src = apparmor-sources; - - # checking whether python bindings are enabled... yes - # checking for python3... no - # configure: error: python is required when enabling python bindings - strictDeps = false; - - nativeBuildInputs = [ - autoconf-archive - autoreconfHook - bison - flex - pkg-config - swig - ncurses - which - perl - ] ++ lib.optional withPython python; - - buildInputs = [ libxcrypt ] ++ lib.optional withPerl perl ++ lib.optional withPython python; - - # required to build apparmor-parser - dontDisableStatic = true; - - prePatch = - prePatchCommon - + '' - substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.am --replace install_vendor install_site - ''; - inherit patches; - - postPatch = '' - cd ./libraries/libapparmor - ''; - - # https://gitlab.com/apparmor/apparmor/issues/1 - configureFlags = [ - (lib.withFeature withPerl "perl") - (lib.withFeature withPython "python") - ]; - - outputs = [ "out" ] ++ lib.optional withPython "python"; - - postInstall = lib.optionalString withPython '' - mkdir -p $python/lib - mv $out/lib/python* $python/lib/ - ''; - - inherit doCheck; - - meta = apparmor-meta "library"; - }; - - apparmor-utils = python.pkgs.buildPythonApplication { - pname = "apparmor-utils"; - version = apparmor-version; - format = "other"; - - src = apparmor-sources; - - strictDeps = true; - - nativeBuildInputs = [ - makeWrapper - which - python - ]; - - buildInputs = [ - bash - perl - python - libapparmor - (libapparmor.python or null) - ]; - - propagatedBuildInputs = [ - (libapparmor.python or null) - - # Used by aa-notify - python.pkgs.notify2 - python.pkgs.psutil - ]; - - prePatch = - prePatchCommon - + - # Do not build vim file - lib.optionalString stdenv.hostPlatform.isMusl '' - sed -i ./utils/Makefile -e "/\/d" - '' - + '' - sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' ./utils/Makefile - - sed -i utils/aa-unconfined -e "/my_env\['PATH'\]/d" - - substituteInPlace utils/aa-remove-unknown \ - --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions" - ''; - inherit patches; - postPatch = "cd ./utils"; - makeFlags = [ "LANGS=" ]; - installFlags = [ - "DESTDIR=$(out)" - "BINDIR=$(out)/bin" - "VIM_INSTALL_PATH=$(out)/share" - "PYPREFIX=" - ]; - - postInstall = '' - wrapProgram $out/bin/aa-remove-unknown \ - --prefix PATH : ${lib.makeBinPath [ gawk ]} - - ln -s ${aa-teardown} $out/bin/aa-teardown - ''; - - inherit doCheck; - - meta = apparmor-meta "user-land utilities" // { - broken = !(withPython && withPerl); - }; - }; - - apparmor-bin-utils = stdenv.mkDerivation { - pname = "apparmor-bin-utils"; - version = apparmor-version; - - src = apparmor-sources; - - nativeBuildInputs = [ - pkg-config - libapparmor - which - ]; - - buildInputs = [ - libapparmor - ]; - - prePatch = prePatchCommon; - postPatch = '' - cd ./binutils - ''; - makeFlags = [ - "LANGS=" - "USE_SYSTEM=1" - ]; - installFlags = [ - "DESTDIR=$(out)" - "BINDIR=$(out)/bin" - "SBINDIR=$(out)/bin" - ]; - - inherit doCheck; - - meta = apparmor-meta "binary user-land utilities"; - }; - - apparmor-parser = stdenv.mkDerivation { - pname = "apparmor-parser"; - version = apparmor-version; - - src = apparmor-sources; - - nativeBuildInputs = [ - bison - flex - which - ]; - - buildInputs = [ libapparmor ]; - - prePatch = - prePatchCommon - + '' - ## techdoc.pdf still doesn't build ... - substituteInPlace ./parser/Makefile \ - --replace "/usr/bin/bison" "${bison}/bin/bison" \ - --replace "/usr/bin/flex" "${flex}/bin/flex" \ - --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" \ - --replace "manpages htmlmanpages pdf" "manpages htmlmanpages" - substituteInPlace parser/rc.apparmor.functions \ - --replace "/sbin/apparmor_parser" "$out/bin/apparmor_parser" - sed -i parser/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}' - ''; - inherit patches; - postPatch = '' - cd ./parser - ''; - makeFlags = [ - "LANGS=" - "USE_SYSTEM=1" - "INCLUDEDIR=${libapparmor}/include" - "AR=${stdenv.cc.bintools.targetPrefix}ar" - ]; - installFlags = [ - "DESTDIR=$(out)" - "DISTRO=unknown" - ]; - - inherit doCheck; - - meta = apparmor-meta "rule parser"; - }; - - apparmor-pam = stdenv.mkDerivation { - pname = "apparmor-pam"; - version = apparmor-version; - - src = apparmor-sources; - - nativeBuildInputs = [ - pkg-config - which - ]; - - buildInputs = [ - libapparmor - pam - ]; - - postPatch = '' - cd ./changehat/pam_apparmor - ''; - makeFlags = [ "USE_SYSTEM=1" ]; - installFlags = [ "DESTDIR=$(out)" ]; - - inherit doCheck; - - meta = apparmor-meta "PAM service"; - }; - - apparmor-profiles = stdenv.mkDerivation { - pname = "apparmor-profiles"; - version = apparmor-version; - - src = apparmor-sources; - - nativeBuildInputs = [ which ]; - - postPatch = '' - cd ./profiles - ''; - - installFlags = [ - "DESTDIR=$(out)" - "EXTRAS_DEST=$(out)/share/apparmor/extra-profiles" - ]; - - inherit doCheck; - - meta = apparmor-meta "profiles"; - }; - - apparmor-kernel-patches = stdenv.mkDerivation { - pname = "apparmor-kernel-patches"; - version = apparmor-version; - - src = apparmor-sources; - - dontBuild = true; - - installPhase = '' - mkdir "$out" - cp -R ./kernel-patches/* "$out" - ''; - - inherit doCheck; - - meta = apparmor-meta "kernel patches"; - }; - - # Generate generic AppArmor rules in a file, from the closure of given - # rootPaths. To be included in an AppArmor profile like so: - # - # include "${apparmorRulesFromClosure { } [ pkgs.hello ]}" - apparmorRulesFromClosure = - { - # The store path of the derivation is given in $path - additionalRules ? [ ], - # TODO: factorize here some other common paths - # that may emerge from use cases. - baseRules ? [ - "r $path" - "r $path/etc/**" - "mr $path/share/**" - # Note that not all libraries are prefixed with "lib", - # eg. glibc-2.30/lib/ld-2.30.so - "mr $path/lib/**.so*" - "mr $path/lib64/**.so*" - # eg. glibc-2.30/lib/gconv/gconv-modules - "r $path/lib/**" - "r $path/lib64/**" - # Internal executables - "ixr $path/libexec/**" - ], - name ? "", - }: - rootPaths: - runCommand ("apparmor-closure-rules" + lib.optionalString (name != "") "-${name}") { } '' - touch $out - while read -r path - do printf >>$out "%s,\n" ${ - lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules) - } - done <${closureInfo { inherit rootPaths; }}/store-paths - ''; -in -{ - inherit - libapparmor - apparmor-utils - apparmor-bin-utils - apparmor-parser - apparmor-pam - apparmor-profiles - apparmor-kernel-patches - apparmorRulesFromClosure - ; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 566df1693f5f..86c0d0e8b71c 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -290,6 +290,7 @@ mapAliases { apacheKafka_3_6 = throw "apacheKafka_2_8 through _3_6 have been removed from nixpkgs as outdated"; # Added 2024-11-27 antimicroX = throw "'antimicroX' has been renamed to/replaced by 'antimicrox'"; # Converted to throw 2024-10-17 apacheAnt = ant; # Added 2024-11-28 + apparmor-kernel-patches = throw "'apparmor-kernel-patches' has been removed as they were unmaintained, irrelevant and effectively broken"; # Added 2025-04-20 appimagekit = throw "'appimagekit' has been removed as it was broken in nixpkgs and archived upstream"; # Added 2025-04-19 apple-sdk_10_12 = throw "apple-sdk_10_12 was removed as Nixpkgs no longer supports macOS 10.12; see the 25.05 release notes"; # Added 2024-10-27 apple-sdk_10_13 = throw "apple-sdk_10_13 was removed as Nixpkgs no longer supports macOS 10.13; see the 25.05 release notes"; # Added 2024-10-27 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 31b2b77af70c..aef1b7c921d0 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -12689,16 +12689,7 @@ with pkgs; armTrustedFirmwareS905 ; - inherit (callPackages ../os-specific/linux/apparmor { }) - libapparmor - apparmor-utils - apparmor-bin-utils - apparmor-parser - apparmor-pam - apparmor-profiles - apparmor-kernel-patches - apparmorRulesFromClosure - ; + inherit (libapparmor.passthru) apparmorRulesFromClosure; ath9k-htc-blobless-firmware = callPackage ../os-specific/linux/firmware/ath9k { }; ath9k-htc-blobless-firmware-unstable = callPackage ../os-specific/linux/firmware/ath9k { From f8a3ea075a9892a27d0f73848bdfd4ce50118a64 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 22 Apr 2025 20:08:11 +0200 Subject: [PATCH 2/5] nixos/apparmor: don't hardcode glibc for logprof --- nixos/modules/security/apparmor.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix index e0b768b60af4..79e6b6b474a8 100644 --- a/nixos/modules/security/apparmor.nix +++ b/nixos/modules/security/apparmor.nix @@ -172,7 +172,7 @@ in logfiles = /dev/stdin parser = ${pkgs.apparmor-parser}/bin/apparmor_parser - ldd = ${pkgs.glibc.bin}/bin/ldd + ldd = ${lib.getExe' pkgs.stdenv.cc.libc "ldd"} logger = ${pkgs.util-linux}/bin/logger # customize how file ownership permissions are presented From 5bfcedeb918337e766095ab1f374a64b6195afc5 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 22 Apr 2025 23:46:54 +0200 Subject: [PATCH 3/5] maintainers/team-list: apparmor: init --- maintainers/team-list.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix index c35493850e35..61ecc339ca68 100644 --- a/maintainers/team-list.nix +++ b/maintainers/team-list.nix @@ -68,6 +68,16 @@ with lib.maintainers; ]; }; + apparmor = { + scope = "AppArmor-related modules, userspace tool packages and profiles"; + shortName = "apparmor"; + members = [ + julm + thoughtpolice + grimmauld + ]; + }; + bazel = { members = [ mboes From 1d315c8bb16cdcc8a8334ff0a28d32e63e2dae46 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 22 Apr 2025 23:47:20 +0200 Subject: [PATCH 4/5] libapparmor: transfer maintenance to team --- pkgs/by-name/li/libapparmor/package.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/pkgs/by-name/li/libapparmor/package.nix b/pkgs/by-name/li/libapparmor/package.nix index a9f83c87bef2..500aa9b45d9c 100644 --- a/pkgs/by-name/li/libapparmor/package.nix +++ b/pkgs/by-name/li/libapparmor/package.nix @@ -98,11 +98,7 @@ stdenv.mkDerivation (finalAttrs: { gpl2Only lgpl21Only ]; - maintainers = with lib.maintainers; [ - julm - thoughtpolice - grimmauld - ]; + maintainers = lib.teams.apparmor.members; platforms = lib.platforms.linux; }; }) From 5467162f9a65a40b20e39b2df2092b384b1c64be Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Tue, 22 Apr 2025 23:47:43 +0200 Subject: [PATCH 5/5] nixos/apparmor: transfer maintenance to team --- nixos/modules/security/apparmor.nix | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix index 79e6b6b474a8..2a20a673d5af 100644 --- a/nixos/modules/security/apparmor.nix +++ b/nixos/modules/security/apparmor.nix @@ -275,8 +275,5 @@ in }; }; - meta.maintainers = with lib.maintainers; [ - julm - grimmauld - ]; + meta.maintainers = lib.teams.apparmor.members; }