From 532337d67324c13c0231f5d39b0d0ae099902df1 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Tue, 17 Mar 2015 11:04:31 +0100 Subject: [PATCH 1/4] Cleanup AppArmor module Remove excessive whitespace & comment sections --- nixos/modules/security/apparmor.nix | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix index 92f020edce5..4fef62cbffd 100644 --- a/nixos/modules/security/apparmor.nix +++ b/nixos/modules/security/apparmor.nix @@ -6,37 +6,26 @@ let in { - #### interface options = { - security.apparmor = { - enable = mkOption { type = types.bool; default = false; description = "Enable the AppArmor Mandatory Access Control system."; }; - profiles = mkOption { type = types.listOf types.path; default = []; description = "List of files containing AppArmor profiles."; }; - }; - }; - #### implementation config = mkIf cfg.enable { - - environment.systemPackages = [ - pkgs.apparmor-utils - ]; + environment.systemPackages = [ pkgs.apparmor-utils ]; systemd.services.apparmor = { wantedBy = [ "local-fs.target" ]; - serviceConfig = { Type = "oneshot"; RemainAfterExit = "yes"; @@ -50,12 +39,11 @@ in }; security.pam.services.apparmor.text = '' - ## The AppArmor service changes hats according to order: first try - ## user, then group, and finally fall back to a hat called "DEFAULT" + ## AppArmor changes hats according to `order`: first try user, then + ## group, and finally fall back to a hat called "DEFAULT" ## ## For now, enable debugging as this is an experimental feature. session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug ''; - }; } From a470b2748bb5ec3957138ec812c27739b5c950e1 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Tue, 17 Mar 2015 11:05:00 +0100 Subject: [PATCH 2/4] Cleanup apparmor expression Remove excessive whitespace & comments. --- pkgs/os-specific/linux/apparmor/2.9/default.nix | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/pkgs/os-specific/linux/apparmor/2.9/default.nix b/pkgs/os-specific/linux/apparmor/2.9/default.nix index a8d8b2a9e1c..2d7400ad2fa 100644 --- a/pkgs/os-specific/linux/apparmor/2.9/default.nix +++ b/pkgs/os-specific/linux/apparmor/2.9/default.nix @@ -40,18 +40,15 @@ let ]; prePatch = '' - ### common substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man" substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html" substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" - ### libapparmor substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h" substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h" ''; buildPhase = '' - ### libapparmor cd ./libraries/libapparmor ./autogen.sh ./configure --prefix="$out" --with-python @@ -76,7 +73,6 @@ let ]; prePatch = '' - ### common substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man" substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html" substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" @@ -106,12 +102,10 @@ let ]; prePatch = '' - ### common substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man" substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html" substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" - ### apparmor-parser substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison" substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex" substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" @@ -158,9 +152,7 @@ let name = "apparmor-profiles-${apparmor-version}"; src = apparmor-sources; - buildInputs = [ - which - ]; + buildInputs = [ which ]; buildPhase = '' cd ./profiles From dc71d5b60218533ee658278bc35cad666bc17c5a Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Tue, 17 Mar 2015 11:11:26 +0100 Subject: [PATCH 3/4] apparmor: factor out common prePatch --- .../linux/apparmor/2.9/default.nix | 24 +++++++------------ 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/pkgs/os-specific/linux/apparmor/2.9/default.nix b/pkgs/os-specific/linux/apparmor/2.9/default.nix index 2d7400ad2fa..b1f424fdf1f 100644 --- a/pkgs/os-specific/linux/apparmor/2.9/default.nix +++ b/pkgs/os-specific/linux/apparmor/2.9/default.nix @@ -20,6 +20,12 @@ let sha256 = "a63b8724c36c29ed438c9e3ca403bfeeb6c998a45990e300aa1b10faa23a0a22"; }; + prePatchCommon = '' + substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man" + substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html" + substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" + ''; + libapparmor = stdenv.mkDerivation { name = "libapparmor-${apparmor-version}"; src = apparmor-sources; @@ -39,11 +45,7 @@ let which ]; - prePatch = '' - substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man" - substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html" - substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" - + prePatch = prePatchCommon + '' substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h" substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h" ''; @@ -72,11 +74,7 @@ let which ]; - prePatch = '' - substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man" - substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html" - substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" - ''; + prePatch = prePatchCommon; buildPhase = '' cd ./utils @@ -101,11 +99,7 @@ let which ]; - prePatch = '' - substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man" - substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html" - substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" - + prePatch = prePatchCommon + '' substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison" substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex" substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" From b0698d4342a0057c019becebc8482ad5ff893f7d Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Tue, 17 Mar 2015 11:28:20 +0100 Subject: [PATCH 4/4] apparmor: fixup install locations This patch fixes install locations for man pages, python modules and vim scripts. This patch improves but does not fix the user-land AppArmor utilities (i.e., they can now import the modules they need but are broken in other ways still). --- pkgs/os-specific/linux/apparmor/2.9/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/apparmor/2.9/default.nix b/pkgs/os-specific/linux/apparmor/2.9/default.nix index b1f424fdf1f..788297ba339 100644 --- a/pkgs/os-specific/linux/apparmor/2.9/default.nix +++ b/pkgs/os-specific/linux/apparmor/2.9/default.nix @@ -24,6 +24,7 @@ let substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man" substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html" substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h" + substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man" ''; libapparmor = stdenv.mkDerivation { @@ -82,7 +83,7 @@ let ''; installPhase = '' - make install LANGS="" DESTDIR="$out" BINDIR="$out/bin" + make install LANGS="" DESTDIR="$out" BINDIR="$out/bin" VIM_INSTALL_PATH="$out/share" PYPREFIX="" ''; meta = apparmor-meta "user-land utilities"; @@ -154,7 +155,7 @@ let ''; installPhase = '' - make install DESTDIR="$out" + make install DESTDIR="$out" EXTRAS_DEST="$out/share/apparmor/extra-profiles" ''; meta = apparmor-meta "profiles";