From 9d5a303cfbebf5931d29d75de01bbfecccf68a0e Mon Sep 17 00:00:00 2001
From: Majiir Paktu <majiir@nabaal.net>
Date: Sun, 19 Apr 2026 11:51:20 -0400
Subject: [PATCH] nixos/pam: filter include/substack paths from apparmor mr
 rules

---
 nixos/modules/security/pam.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 46b9d71ac2ed..41ba7df94be1 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -2636,6 +2636,13 @@ in
           (lib.concatMap lib.attrValues)
           (lib.concatMap lib.attrValues)
           (lib.filter (rule: rule.enable))
+          (lib.filter (
+            rule:
+            !builtins.elem rule.control [
+              "include"
+              "substack"
+            ]
+          ))
           (lib.catAttrs "modulePath")
           (map (
             modulePath: