diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix index 12e634c5e2d9..341c343adb44 100644 --- a/nixos/modules/security/apparmor.nix +++ b/nixos/modules/security/apparmor.nix @@ -241,7 +241,7 @@ in { Type = "oneshot"; RemainAfterExit = "yes"; - ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown"; + ExecStartPre = lib.getExe' pkgs.apparmor-init "aa-teardown"; ExecStart = lib.mapAttrsToList ( n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts n p}" ) enabledPolicies; @@ -262,7 +262,7 @@ in # Optionally kill the processes which are unconfined but now have a profile loaded # (because AppArmor can only start to confine new processes). lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables; - ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown"; + ExecStop = lib.getExe' pkgs.apparmor-init "aa-teardown"; CacheDirectory = [ "apparmor" "apparmor/logprof" diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix index 52f34ccd8378..ce414b8896f7 100644 --- a/nixos/modules/virtualisation/incus.nix +++ b/nixos/modules/virtualisation/incus.nix @@ -396,7 +396,7 @@ in abi , include - include "/var/lib/incus/security/apparmor/profiles" + include if exists "/var/lib/incus/security/apparmor/profiles" ''; }; includes."abstractions/base" = '' diff --git a/pkgs/by-name/ap/apparmor-init/fix-rc-apparmor-functions-FHS.patch b/pkgs/by-name/ap/apparmor-init/fix-rc-apparmor-functions-FHS.patch new file mode 100644 index 000000000000..0e43f12bcecb --- /dev/null +++ b/pkgs/by-name/ap/apparmor-init/fix-rc-apparmor-functions-FHS.patch @@ -0,0 +1,34 @@ +diff --git a/rc.apparmor.functions b/rc.apparmor.functions +index 96cb23d33..4401fc420 100644 +--- a/rc.apparmor.functions ++++ b/rc.apparmor.functions +@@ -31,7 +31,10 @@ + + # Some nice defines that we use + +-PARSER=/sbin/apparmor_parser ++PATH="@PATH@${PATH:+:$PATH}" ++export PATH ++ ++PARSER=$(command -v apparmor_parser) + PARSER_OPTS= + # Suppress warnings when booting in quiet mode + if [ "${QUIET:-no}" = yes ] || [ "${quiet:-n}" = y ]; then +@@ -50,7 +53,7 @@ ADDITIONAL_PROFILE_DIR= + if [ -n "$ADDITIONAL_PROFILE_DIR" ] && [ -d "$ADDITIONAL_PROFILE_DIR" ]; then + PROFILE_DIRS="$PROFILE_DIRS $ADDITIONAL_PROFILE_DIR" + fi +-AA_STATUS=/usr/sbin/aa-status ++AA_STATUS=$(command -v aa-status) + SECURITYFS=/sys/kernel/security + SFS_MOUNTPOINT="${SECURITYFS}/apparmor" + +@@ -91,7 +94,7 @@ is_container_with_internal_policy() { + local ns_name + + # WSL needs to be detected explicitly +- if [ -x /usr/bin/systemd-detect-virt ] && \ ++ if command -v systemd-detect-virt >/dev/null 2>&1 && \ + [ "$(systemd-detect-virt --container)" = "wsl" ]; then + return 0 + fi diff --git a/pkgs/by-name/ap/apparmor-init/package.nix b/pkgs/by-name/ap/apparmor-init/package.nix new file mode 100644 index 000000000000..0e95a3f13b47 --- /dev/null +++ b/pkgs/by-name/ap/apparmor-init/package.nix @@ -0,0 +1,94 @@ +{ + lib, + stdenv, + which, + replaceVars, + perl, + buildPackages, + runtimeShellPackage, + + # apparmor deps + libapparmor, + apparmor-bin-utils, + apparmor-parser, + + # runtime deps + gnused, + gnugrep, + systemd, + coreutils, +}: +stdenv.mkDerivation (finalAttrs: { + pname = "apparmor-init"; + inherit (libapparmor) version src; + + sourceRoot = "${finalAttrs.src.name}/init"; + + patches = [ + (replaceVars ./fix-rc-apparmor-functions-FHS.patch { + PATH = lib.makeBinPath [ + # bash script needs a bunch of binaries, but we can't wrapProgram because it is more a library that will be used with `source` + apparmor-bin-utils + apparmor-parser + coreutils + gnused + gnugrep + systemd + ]; + }) + ]; + + postPatch = '' + patchShebangs . + + substituteInPlace apparmor.service \ + --replace-fail "/bin/true" "${lib.getExe' coreutils "true"}" + + # the various provided scripts hardcode /lib/apparmor + for FILE in aa-teardown apparmor.service apparmor.systemd profile-load + do + substituteInPlace "$FILE" \ + --replace-fail "/lib/apparmor" "$out/lib/apparmor" + done + ''; + + nativeBuildInputs = [ + which + perl + ]; + + buildInputs = [ + runtimeShellPackage + ]; + + makeFlags = [ + "POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}" + "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}" + "MANDIR=share/man" + ]; + + installFlags = [ + "DESTDIR=${placeholder "out"}" + "DISTRO=unknown" + "USR_SBINDIR=${placeholder "out"}/bin" + "SBINDIR=${placeholder "out"}/bin" + "LOCALEDIR=${placeholder "out"}/share/locale" + "SYSTEMD_UNIT_DIR=${placeholder "out"}/lib/systemd/system" + ]; + + doCheck = true; + + installTargets = [ + "install" + # Likely not very useful for NixOS, as this is missing some NixOS awareness such as loading declarative profiles from the store + # However, the cost is low, it may be useful in the future or on non-NixOS systems, so install the systemd service too. + "install-systemd" + ]; + + strictDeps = true; + __structuredAttrs = true; + + meta = libapparmor.meta // { + description = "Mandatory access control system - init files"; + }; +}) diff --git a/pkgs/by-name/ap/apparmor-parser/fix-rc.apparmor.functions.sh b/pkgs/by-name/ap/apparmor-parser/fix-rc.apparmor.functions.sh deleted file mode 100644 index ebc1baaa92d4..000000000000 --- a/pkgs/by-name/ap/apparmor-parser/fix-rc.apparmor.functions.sh +++ /dev/null @@ -1,32 +0,0 @@ -aa_action() { - STRING=$1 - shift - $* - rc=$? - if [ $rc -eq 0 ] ; then - aa_log_success_msg $"$STRING " - else - aa_log_failure_msg $"$STRING " - fi - return $rc -} - -aa_log_success_msg() { - [ -n "$1" ] && echo -n $1 - echo ": done." -} - -aa_log_warning_msg() { - [ -n "$1" ] && echo -n $1 - echo ": Warning." -} - -aa_log_failure_msg() { - [ -n "$1" ] && echo -n $1 - echo ": Failed." -} - -aa_log_skipped_msg() { - [ -n "$1" ] && echo -n $1 - echo ": Skipped." -} diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix index de39713f0c10..8844ca83b316 100644 --- a/pkgs/by-name/ap/apparmor-parser/package.nix +++ b/pkgs/by-name/ap/apparmor-parser/package.nix @@ -11,7 +11,6 @@ # apparmor deps libapparmor, - apparmor-bin-utils, runtimeShellPackage, # testing @@ -25,12 +24,6 @@ stdenv.mkDerivation (finalAttrs: { postPatch = '' patchShebangs . - - substituteInPlace init/rc.apparmor.functions \ - --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" \ - --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}" - sed -i init/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}' - cd parser substituteInPlace Makefile \ diff --git a/pkgs/by-name/ap/apparmor-teardown/package.nix b/pkgs/by-name/ap/apparmor-teardown/package.nix deleted file mode 100644 index f5c299b24d76..000000000000 --- a/pkgs/by-name/ap/apparmor-teardown/package.nix +++ /dev/null @@ -1,33 +0,0 @@ -{ - writeShellApplication, - coreutils, - gnused, - gnugrep, - which, - - # apparmor deps - apparmor-parser, - apparmor-bin-utils, - libapparmor, -}: -writeShellApplication { - name = "apparmor-teardown"; - runtimeInputs = [ - apparmor-parser - apparmor-bin-utils - coreutils - gnused - gnugrep - which - ]; - - text = '' - set +e # the imported script tries to `read` an empty line - # shellcheck source=/dev/null - . ${apparmor-parser}/lib/apparmor/rc.apparmor.functions - remove_profiles - exit 0 - ''; - - inherit (libapparmor) meta; -} diff --git a/pkgs/by-name/ap/apparmor-utils/package.nix b/pkgs/by-name/ap/apparmor-utils/package.nix index ea1c275bdeb3..ac360b87646a 100644 --- a/pkgs/by-name/ap/apparmor-utils/package.nix +++ b/pkgs/by-name/ap/apparmor-utils/package.nix @@ -12,7 +12,6 @@ # apparmor deps apparmor-parser, - apparmor-teardown, }: let inherit (python3Packages) libapparmor; @@ -75,8 +74,6 @@ python3Packages.buildPythonApplication { postInstall = '' wrapProgram $out/bin/aa-remove-unknown \ --prefix PATH : ${lib.makeBinPath [ gawk ]} - - ln -s ${lib.getExe apparmor-teardown} $out/bin/aa-teardown ''; meta = libapparmor.meta // { diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 1e5e6c0a8660..dd04ac39ad95 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -313,6 +313,7 @@ mapAliases { apacheKafka_3_9 = throw "apacheKafka_2_8 through _4_0 have been removed from nixpkgs as outdated"; # Added 2026-07-07 apacheKafka_4_0 = throw "apacheKafka_2_8 through _4_0 have been removed from nixpkgs as outdated"; # Added 2026-07-07 apmplanner2 = throw "'apmplanner2' has been removed as it depends on insecure&unmaintained qtwebkit"; # Added 2026-04-26 + apparmor-teardown = warnAlias "'apparmor-teardown' has been replaced by 'apparmor-init', which more closely follows intended teardown procedures." apparmor-init; # Added 2026-07-14 apple-sdk_11 = throw "apple-sdk_11 was removed as Nixpkgs no longer supports macOS 11; see the 25.11 release notes"; # Added 2025-05-10 apple-sdk_12 = throw "apple-sdk_12 was removed as Nixpkgs no longer supports macOS 12; see the 25.11 release notes"; # Added 2025-05-10 apple-sdk_13 = throw "apple-sdk_13 was removed as Nixpkgs no longer supports macOS 13; see the 25.11 release notes"; # Added 2025-05-10