From bd022e3c5a54b5f05eeb92cd02a82d2fc76a65f2 Mon Sep 17 00:00:00 2001
From: Samuel Cobb <sjcobb2003@gmail.com>
Date: Fri, 19 Jun 2026 20:46:31 +0100
Subject: [PATCH] nixos/apparmor: load bpf last unconditionally

---
 nixos/modules/security/default.nix | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/security/default.nix b/nixos/modules/security/default.nix
index 5170383d6f5e..c1a4f7cf34a1 100644
--- a/nixos/modules/security/default.nix
+++ b/nixos/modules/security/default.nix
@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   cfg = config.security;
 in
@@ -16,10 +20,16 @@ in
   config = lib.mkMerge [
     {
       # We set the default LSM's here due to them not being present if set when enabling AppArmor.
-      security.lsm = [
-        "landlock"
-        "yama"
-        "bpf"
+      security.lsm = lib.mkMerge [
+        [
+          "landlock"
+          "yama"
+        ]
+        # Load BPF last unconditionally. See: https://github.com/NixOS/nixpkgs/pull/533428.
+        # Apparmor (and potentially other modules) will load incorrectly if they are not before BPF.
+        # It is believed that there was a regression between kernel 6.12 and 6.18 which caused the
+        # passthrough stub or LSM stacking of the BPF module to interact with other modules incorrectly.
+        (lib.mkAfter [ "bpf" ])
       ];
     }
     (lib.mkIf (lib.lists.length cfg.lsm > 0) {