From 4cee2f4e9c565d0cf01d5355b119f911df34777a Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Fri, 19 Sep 2025 19:34:21 +0200
Subject: [PATCH 1/3] nixos/apparmor: add abstraction for golang

Since "Container-aware GOMAXPROCS" was introduced in golang version
1.25.0, there are new paths accessed on every go runtime startup.

Release notes: https://tip.golang.org/doc/go1.25#container-aware-gomaxprocs

> At startup (defaultGOMAXPROCSInit), we read /proc/self/cgroup and
> /proc/self/mountinfo to find our current CPU cgroup and open its
> limit file(s), which remain open for the entire process lifetime. We
> periodically read the current limit by  rereading the limit file(s)
> from the beginning.
>
> https://github.com/golang/go/blob/go1.25.0/src/runtime/cgroup_linux.go#L13
---
 nixos/modules/security/apparmor/includes.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix
index 03f8f5df9d5f..4b759e1d94f9 100644
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@@ -431,6 +431,13 @@ in
     "abstractions/python" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/python"
     '';
+    "abstractions/golang" = ''
+      # Container-aware GOMAXPROCS
+      owner @{PROC}/@{pid}/mountinfo r,
+      owner @{PROC}/@{pid}/cgroup r,
+      @{sys}/fs/cgroup/**/{cpu.cfs_quota_us,cpu.cfs_period_us} r, # V1
+      @{sys}/fs/cgroup/**/cpu.max r, # V2
+    '';
     "abstractions/qt5" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/qt5"
     ''

From 00a6cc5bc104fbda703aa402101eb39d88da8e14 Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Fri, 19 Sep 2025 21:54:28 +0200
Subject: [PATCH 2/3] nixos/miniflux: use golang apparmor abstraction

This patch fixes "DENIED" audit log entries of `nixosTests.miniflux`.
---
 nixos/modules/services/web-apps/miniflux.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 8b89c03b24bc..db51ee10e263 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -186,6 +186,7 @@ in
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
+        include <abstractions/golang>
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
         r ${cfg.package}/bin/miniflux,
         r @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size,

From 2bda2d98a5284e66dae006ebc0e7ddbcc823934f Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Fri, 19 Sep 2025 21:55:14 +0200
Subject: [PATCH 3/3] nixos/miniflux: cleanup apparmor profile

Since apparmor 4.0 support for transparent hugepage is included via the
base abstraction.

https://gitlab.com/apparmor/apparmor/-/commit/3844e4522086897fa0ff2f5f049c61cffb845d80
---
 nixos/modules/services/web-apps/miniflux.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index db51ee10e263..a2ed4c5f6f46 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -189,7 +189,6 @@ in
         include <abstractions/golang>
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
         r ${cfg.package}/bin/miniflux,
-        r @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size,
         rw /run/miniflux/**,
       }
     '';