gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/apparmor: Fix broken teardown procedure (#541614)

Browse Source
This commit is contained in:
Grimmauld
2026-07-14 14:37:21 +00:00
committed by GitHub
parent 32785edab3 4ef20773d3
commit 7f3bd40ec6
9 changed files with 132 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/security/apparmor.nix
+2 -2
View File
@@ -241,7 +241,7 @@ in
{
Type = "oneshot";
RemainAfterExit = "yes";
ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
ExecStartPre = lib.getExe' pkgs.apparmor-init "aa-teardown";
ExecStart = lib.mapAttrsToList (
n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts n p}"
) enabledPolicies;
@@ -262,7 +262,7 @@ in
# Optionally kill the processes which are unconfined but now have a profile loaded
# (because AppArmor can only start to confine new processes).
lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
ExecStop = lib.getExe' pkgs.apparmor-init "aa-teardown";
CacheDirectory = [
"apparmor"
"apparmor/logprof"
nixos/modules/virtualisation/incus.nix
+1 -1
View File
@@ -396,7 +396,7 @@ in
abi <abi/4.0>,
include <tunables/global>
include "/var/lib/incus/security/apparmor/profiles"
include if exists "/var/lib/incus/security/apparmor/profiles"
'';
};
includes."abstractions/base" = ''
pkgs/by-name/ap/apparmor-init/fix-rc-apparmor-functions-FHS.patch
+34
View File
@@ -0,0 +1,34 @@
diff --git a/rc.apparmor.functions b/rc.apparmor.functions
index 96cb23d33..4401fc420 100644
--- a/rc.apparmor.functions
+++ b/rc.apparmor.functions
@@ -31,7 +31,10 @@
# Some nice defines that we use
-PARSER=/sbin/apparmor_parser
+PATH="@PATH@${PATH:+:$PATH}"
+export PATH
+
+PARSER=$(command -v apparmor_parser)
PARSER_OPTS=
# Suppress warnings when booting in quiet mode
if [ "${QUIET:-no}" = yes ] || [ "${quiet:-n}" = y ]; then
@@ -50,7 +53,7 @@ ADDITIONAL_PROFILE_DIR=
if [ -n "$ADDITIONAL_PROFILE_DIR" ] && [ -d "$ADDITIONAL_PROFILE_DIR" ]; then
PROFILE_DIRS="$PROFILE_DIRS $ADDITIONAL_PROFILE_DIR"
fi
-AA_STATUS=/usr/sbin/aa-status
+AA_STATUS=$(command -v aa-status)
SECURITYFS=/sys/kernel/security
SFS_MOUNTPOINT="${SECURITYFS}/apparmor"
@@ -91,7 +94,7 @@ is_container_with_internal_policy() {
local ns_name
# WSL needs to be detected explicitly
- if [ -x /usr/bin/systemd-detect-virt ] && \
+ if command -v systemd-detect-virt >/dev/null 2>&1 && \
[ "$(systemd-detect-virt --container)" = "wsl" ]; then
return 0
fi
pkgs/by-name/ap/apparmor-init/package.nix
+94
View File
@@ -0,0 +1,94 @@
{
lib,
stdenv,
which,
replaceVars,
perl,
buildPackages,
runtimeShellPackage,
# apparmor deps
libapparmor,
apparmor-bin-utils,
apparmor-parser,
# runtime deps
gnused,
gnugrep,
systemd,
coreutils,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "apparmor-init";
inherit (libapparmor) version src;
sourceRoot = "${finalAttrs.src.name}/init";
patches = [
(replaceVars ./fix-rc-apparmor-functions-FHS.patch {
PATH = lib.makeBinPath [
# bash script needs a bunch of binaries, but we can't wrapProgram because it is more a library that will be used with `source`
apparmor-bin-utils
apparmor-parser
coreutils
gnused
gnugrep
systemd
];
})
];
postPatch = ''
patchShebangs .
substituteInPlace apparmor.service \
--replace-fail "/bin/true" "${lib.getExe' coreutils "true"}"
# the various provided scripts hardcode /lib/apparmor
for FILE in aa-teardown apparmor.service apparmor.systemd profile-load
do
substituteInPlace "$FILE" \
--replace-fail "/lib/apparmor" "$out/lib/apparmor"
done
'';
nativeBuildInputs = [
which
perl
];
buildInputs = [
runtimeShellPackage
];
makeFlags = [
"POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}"
"POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
"MANDIR=share/man"
];
installFlags = [
"DESTDIR=${placeholder "out"}"
"DISTRO=unknown"
"USR_SBINDIR=${placeholder "out"}/bin"
"SBINDIR=${placeholder "out"}/bin"
"LOCALEDIR=${placeholder "out"}/share/locale"
"SYSTEMD_UNIT_DIR=${placeholder "out"}/lib/systemd/system"
];
doCheck = true;
installTargets = [
"install"
# Likely not very useful for NixOS, as this is missing some NixOS awareness such as loading declarative profiles from the store
# However, the cost is low, it may be useful in the future or on non-NixOS systems, so install the systemd service too.
"install-systemd"
];
strictDeps = true;
__structuredAttrs = true;
meta = libapparmor.meta // {
description = "Mandatory access control system - init files";
};
})
pkgs/by-name/ap/apparmor-parser/fix-rc.apparmor.functions.sh
-32
View File
@@ -1,32 +0,0 @@
aa_action() {
STRING=$1
shift
$*
rc=$?
if [ $rc -eq 0 ] ; then
aa_log_success_msg $"$STRING "
else
aa_log_failure_msg $"$STRING "
fi
return $rc
}
aa_log_success_msg() {
[ -n "$1" ] && echo -n $1
echo ": done."
}
aa_log_warning_msg() {
[ -n "$1" ] && echo -n $1
echo ": Warning."
}
aa_log_failure_msg() {
[ -n "$1" ] && echo -n $1
echo ": Failed."
}
aa_log_skipped_msg() {
[ -n "$1" ] && echo -n $1
echo ": Skipped."
}
pkgs/by-name/ap/apparmor-parser/package.nix
-7
View File
@@ -11,7 +11,6 @@
# apparmor deps
libapparmor,
apparmor-bin-utils,
runtimeShellPackage,
# testing
@@ -25,12 +24,6 @@ stdenv.mkDerivation (finalAttrs: {
postPatch = ''
patchShebangs .
substituteInPlace init/rc.apparmor.functions \
--replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" \
--replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
sed -i init/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
cd parser
substituteInPlace Makefile \
pkgs/by-name/ap/apparmor-teardown/package.nix
-33
View File
@@ -1,33 +0,0 @@
{
writeShellApplication,
coreutils,
gnused,
gnugrep,
which,
# apparmor deps
apparmor-parser,
apparmor-bin-utils,
libapparmor,
}:
writeShellApplication {
name = "apparmor-teardown";
runtimeInputs = [
apparmor-parser
apparmor-bin-utils
coreutils
gnused
gnugrep
which
];
text = ''
set +e # the imported script tries to `read` an empty line
# shellcheck source=/dev/null
. ${apparmor-parser}/lib/apparmor/rc.apparmor.functions
remove_profiles
exit 0
'';
inherit (libapparmor) meta;
}
pkgs/by-name/ap/apparmor-utils/package.nix
-3
View File
@@ -12,7 +12,6 @@
# apparmor deps
apparmor-parser,
apparmor-teardown,
}:
let
inherit (python3Packages) libapparmor;
@@ -75,8 +74,6 @@ python3Packages.buildPythonApplication {
postInstall = ''
wrapProgram $out/bin/aa-remove-unknown \
--prefix PATH : ${lib.makeBinPath [ gawk ]}
ln -s ${lib.getExe apparmor-teardown} $out/bin/aa-teardown
'';
meta = libapparmor.meta // {
pkgs/top-level/aliases.nix
+1
View File
@@ -313,6 +313,7 @@ mapAliases {
apacheKafka_3_9 = throw "apacheKafka_2_8 through _4_0 have been removed from nixpkgs as outdated"; # Added 2026-07-07
apacheKafka_4_0 = throw "apacheKafka_2_8 through _4_0 have been removed from nixpkgs as outdated"; # Added 2026-07-07
apmplanner2 = throw "'apmplanner2' has been removed as it depends on insecure&unmaintained qtwebkit"; # Added 2026-04-26
apparmor-teardown = warnAlias "'apparmor-teardown' has been replaced by 'apparmor-init', which more closely follows intended teardown procedures." apparmor-init; # Added 2026-07-14
apple-sdk_11 = throw "apple-sdk_11 was removed as Nixpkgs no longer supports macOS 11; see the 25.11 release notes"; # Added 2025-05-10
apple-sdk_12 = throw "apple-sdk_12 was removed as Nixpkgs no longer supports macOS 12; see the 25.11 release notes"; # Added 2025-05-10
apple-sdk_13 = throw "apple-sdk_13 was removed as Nixpkgs no longer supports macOS 13; see the 25.11 release notes"; # Added 2025-05-10