From 0eabede44b064fb3da5026d4dc5f01fa4c1fd3cf Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sat, 1 Jul 2023 22:37:14 +0200 Subject: [PATCH 1/7] nixos/apparmor: make abstractions/ssl_certs more go friendly By default golang's crypto/x509 implementation wants to read /etc/pki/tls/certs/ when loading system certificates. This patch adds the path to reduce audit log noise. Relevant code: - https://github.com/golang/go/blob/go1.20.5/src/crypto/x509/root_unix.go#L32-L82 - https://github.com/golang/go/blob/go1.20.5/src/crypto/x509/root_linux.go#L17-L22 --- nixos/modules/security/apparmor/includes.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix index adfca04426ca..7711f1fdb7e7 100644 --- a/nixos/modules/security/apparmor/includes.nix +++ b/nixos/modules/security/apparmor/includes.nix @@ -279,6 +279,8 @@ config.security.apparmor.includes = { r /var/lib/acme/*/chain.pem, r /var/lib/acme/*/fullchain.pem, + r /etc/pki/tls/certs/, + '' + lib.concatMapStringsSep "\n" etcRule [ "ssl/certs/ca-certificates.crt" "ssl/certs/ca-bundle.crt" From 9145e6df84b171a96ff3b3e2ba5d6d5083b25834 Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sun, 2 Jul 2023 02:35:27 +0200 Subject: [PATCH 2/7] nixos/apparmor: add missing abstraction/nss-systemd The abstraction/nameservice profile from apparmor-profiles package includes abstractions/nss-systemd. Without "reexporting" it, the include fails and we get some errors. --- nixos/modules/security/apparmor/includes.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix index 7711f1fdb7e7..8e9706eef973 100644 --- a/nixos/modules/security/apparmor/includes.nix +++ b/nixos/modules/security/apparmor/includes.nix @@ -211,6 +211,9 @@ config.security.apparmor.includes = { "abstractions/nis" = '' include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nis" ''; + "abstractions/nss-systemd" = '' + include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nss-systemd" + ''; "abstractions/nvidia" = '' include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nvidia" ${etcRule "vdpau_wrapper.cfg"} From ad7ffe3a7c270a82e06caea439963278bbc70348 Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sun, 2 Jul 2023 14:23:59 +0200 Subject: [PATCH 3/7] nixos/apparmor: fix syntax in abstractions/bash --- nixos/modules/security/apparmor/includes.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix index 8e9706eef973..d05a1d1b0d1d 100644 --- a/nixos/modules/security/apparmor/includes.nix +++ b/nixos/modules/security/apparmor/includes.nix @@ -72,7 +72,7 @@ config.security.apparmor.includes = { # bash inspects filesystems at startup # and /etc/mtab is linked to /proc/mounts - @{PROC}/mounts + r @{PROC}/mounts, # system-wide bash configuration '' + lib.concatMapStringsSep "\n" etcRule [ From 0f474b4c6cd6202d346bc7b7220b88f3c281e478 Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sun, 9 Jul 2023 15:48:59 +0200 Subject: [PATCH 4/7] nixos/apparmor: support custom i18n glibc locales The i18n nixos module creates a customized glibcLocales package. Use the system specific glibcLocale instead of the vanilla one. --- nixos/modules/security/apparmor/includes.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix index d05a1d1b0d1d..88051de484c5 100644 --- a/nixos/modules/security/apparmor/includes.nix +++ b/nixos/modules/security/apparmor/includes.nix @@ -62,7 +62,7 @@ config.security.apparmor.includes = { include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base" r ${pkgs.stdenv.cc.libc}/share/locale/**, r ${pkgs.stdenv.cc.libc}/share/locale.alias, - ${lib.optionalString (pkgs.glibcLocales != null) "r ${pkgs.glibcLocales}/lib/locale/locale-archive,"} + r ${config.i18n.glibcLocales}/lib/locale/locale-archive, ${etcRule "localtime"} r ${pkgs.tzdata}/share/zoneinfo/**, r ${pkgs.stdenv.cc.libc}/share/i18n/**, From 125617826334fbf6be4f4f0e312f40b137bcb932 Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sat, 1 Jul 2023 16:45:18 +0200 Subject: [PATCH 5/7] apparmor: fix python import issues With buildPythonApplication the PYTHONPATH is now populated properly, which should address the ModuleNotFoundError issue. I also moved some of the substitutions from postInstall to prePatch, so they don't conflict with the wrapped executables. Because upstream does not seem to hardcode binary paths in the utils anymore, some of the old substituteInPlace rules could be removed. Partial fix for nixpkgs#169056 --- pkgs/os-specific/linux/apparmor/default.nix | 31 +++++++++++---------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix index f579c00eb5c9..7c3503d16a65 100644 --- a/pkgs/os-specific/linux/apparmor/default.nix +++ b/pkgs/os-specific/linux/apparmor/default.nix @@ -128,9 +128,10 @@ let meta = apparmor-meta "library"; }; - apparmor-utils = stdenv.mkDerivation { + apparmor-utils = python.pkgs.buildPythonApplication { pname = "apparmor-utils"; version = apparmor-version; + format = "other"; src = apparmor-sources; @@ -146,14 +147,25 @@ let libapparmor.python ]; + propagatedBuildInputs = [ + libapparmor.python + + # Used by aa-notify + python.pkgs.notify2 + python.pkgs.psutil + ]; + prePatch = prePatchCommon + # Do not build vim file lib.optionalString stdenv.hostPlatform.isMusl '' sed -i ./utils/Makefile -e "/\/d" '' + '' - for file in utils/apparmor/easyprof.py utils/apparmor/aa.py utils/logprof.conf; do - substituteInPlace $file --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser" - done + sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' ./utils/Makefile + + sed -i utils/aa-unconfined -e "/my_env\['PATH'\]/d" + + substituteInPlace utils/aa-remove-unknown \ + --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions" ''; inherit patches; postPatch = "cd ./utils"; @@ -161,17 +173,6 @@ let installFlags = [ "DESTDIR=$(out)" "BINDIR=$(out)/bin" "VIM_INSTALL_PATH=$(out)/share" "PYPREFIX=" ]; postInstall = '' - sed -i $out/bin/aa-unconfined -e "/my_env\['PATH'\]/d" - for prog in aa-audit aa-autodep aa-cleanprof aa-complain aa-disable aa-enforce aa-genprof aa-logprof aa-mergeprof aa-unconfined ; do - wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.sitePackages}:$PYTHONPATH" - done - - substituteInPlace $out/bin/aa-notify \ - --replace /usr/bin/notify-send ${libnotify}/bin/notify-send \ - --replace /usr/bin/perl "${perl}/bin/perl -I ${libapparmor}/${perl.libPrefix}" - - substituteInPlace $out/bin/aa-remove-unknown \ - --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions" wrapProgram $out/bin/aa-remove-unknown \ --prefix PATH : ${lib.makeBinPath [ gawk ]} From ced170c030a409f8e21a7c1e20bced6a9397c1d2 Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sat, 8 Jul 2023 02:18:34 +0200 Subject: [PATCH 6/7] nixos/miniflux: add apparmor policy This change also extends the test to ensure that normal operations aren't denied. --- nixos/modules/services/web-apps/miniflux.nix | 12 ++++++++++++ nixos/tests/miniflux.nix | 6 ++++++ 2 files changed, 18 insertions(+) diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix index 7cc8ce10ffe0..3374c746ad3d 100644 --- a/nixos/modules/services/web-apps/miniflux.nix +++ b/nixos/modules/services/web-apps/miniflux.nix @@ -130,5 +130,17 @@ in environment = cfg.config; }; environment.systemPackages = [ cfg.package ]; + + security.apparmor.policies."bin.miniflux".profile = '' + include + ${cfg.package}/bin/miniflux { + include + include + include + include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}" + r ${cfg.package}/bin/miniflux, + r @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size, + } + ''; }; } diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix index be3e7abb6abd..a3af53db0e7a 100644 --- a/nixos/tests/miniflux.nix +++ b/nixos/tests/miniflux.nix @@ -25,6 +25,7 @@ in default = { ... }: { + security.apparmor.enable = true; services.miniflux = { enable = true; inherit adminCredentialsFile; @@ -34,6 +35,7 @@ in withoutSudo = { ... }: { + security.apparmor.enable = true; services.miniflux = { enable = true; inherit adminCredentialsFile; @@ -44,6 +46,7 @@ in customized = { ... }: { + security.apparmor.enable = true; services.miniflux = { enable = true; config = { @@ -63,6 +66,7 @@ in default.succeed( "curl 'http://localhost:${toString defaultPort}/v1/me' -u '${defaultUsername}:${defaultPassword}' -H Content-Type:application/json | grep '\"is_admin\":true'" ) + default.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""') withoutSudo.wait_for_unit("miniflux.service") withoutSudo.wait_for_open_port(${toString defaultPort}) @@ -70,6 +74,7 @@ in withoutSudo.succeed( "curl 'http://localhost:${toString defaultPort}/v1/me' -u '${defaultUsername}:${defaultPassword}' -H Content-Type:application/json | grep '\"is_admin\":true'" ) + withoutSudo.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""') customized.wait_for_unit("miniflux.service") customized.wait_for_open_port(${toString port}) @@ -77,5 +82,6 @@ in customized.succeed( "curl 'http://localhost:${toString port}/v1/me' -u '${username}:${password}' -H Content-Type:application/json | grep '\"is_admin\":true'" ) + customized.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""') ''; }) From 30ad9053abddb3128e90c023faf64e0bdd4fce1a Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sun, 9 Jul 2023 01:01:03 +0200 Subject: [PATCH 7/7] nixos/murmur: add apparmor policy --- nixos/modules/services/networking/murmur.nix | 32 ++++++++++++++++++++ nixos/tests/mumble.nix | 4 +++ 2 files changed, 36 insertions(+) diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix index ebade7aa8e40..fe3eb3787e91 100644 --- a/nixos/modules/services/networking/murmur.nix +++ b/nixos/modules/services/networking/murmur.nix @@ -355,5 +355,37 @@ in ''; destination = "/share/dbus-1/system.d/murmur.conf"; })]; + + security.apparmor.policies."bin.mumble-server".profile = '' + include + + ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} { + include + include + include + include "${pkgs.apparmorRulesFromClosure { name = "mumble-server"; } cfg.package}" + pix ${cfg.package}/bin/.mumble-server-wrapped, + + r ${config.environment.etc."os-release".source}, + r ${config.environment.etc."lsb-release".source}, + owner rwk /var/lib/murmur/murmur.sqlite, + owner rw /var/lib/murmur/murmur.sqlite-journal, + owner r /var/lib/murmur/, + r /run/murmur/murmurd.pid, + r /run/murmur/murmurd.ini, + r ${configFile}, + '' + optionalString (cfg.logFile != null) '' + rw ${cfg.logFile}, + '' + optionalString (cfg.sslCert != "") '' + r ${cfg.sslCert}, + '' + optionalString (cfg.sslKey != "") '' + r ${cfg.sslKey}, + '' + optionalString (cfg.sslCa != "") '' + r ${cfg.sslCa}, + '' + optionalString (cfg.dbus != null) '' + dbus bus=${cfg.dbus} + '' + '' + } + ''; }; } diff --git a/nixos/tests/mumble.nix b/nixos/tests/mumble.nix index 2b5cc20163bc..8eee454721a1 100644 --- a/nixos/tests/mumble.nix +++ b/nixos/tests/mumble.nix @@ -20,6 +20,7 @@ in nodes = { server = { config, ... }: { + security.apparmor.enable = true; services.murmur.enable = true; services.murmur.registerName = "NixOS tests"; services.murmur.password = "$MURMURD_PASSWORD"; @@ -81,5 +82,8 @@ in server.sleep(5) # wait to get screenshot client1.screenshot("screen1") client2.screenshot("screen2") + + # check if apparmor denied anything + server.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""') ''; })