29027fd1e1
Using pkgs.lib on the spine of module evaluation is problematic because the pkgs argument depends on the result of module evaluation. To prevent an infinite recursion, pkgs and some of the modules are evaluated twice, which is inefficient. Using ‘with lib’ prevents this problem.
47 lines
1.1 KiB
Nix
47 lines
1.1 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
cfg = config.security.apparmor;
|
|
in
|
|
with lib;
|
|
{
|
|
|
|
options.security.apparmor.confineSUIDApplications = mkOption {
|
|
default = true;
|
|
description = ''
|
|
Install AppArmor profiles for commonly-used SUID application
|
|
to mitigate potential privilege escalation attacks due to bugs
|
|
in such applications.
|
|
|
|
Currently available profiles: ping
|
|
'';
|
|
};
|
|
|
|
config = mkIf (cfg.confineSUIDApplications) {
|
|
security.apparmor.profiles = [ (pkgs.writeText "ping" ''
|
|
#include <tunables/global>
|
|
/var/setuid-wrappers/ping {
|
|
#include <abstractions/base>
|
|
#include <abstractions/consoles>
|
|
#include <abstractions/nameservice>
|
|
|
|
capability net_raw,
|
|
capability setuid,
|
|
network inet raw,
|
|
|
|
${pkgs.glibc}/lib/*.so mr,
|
|
${pkgs.libcap}/lib/libcap.so* mr,
|
|
${pkgs.attr}/lib/libattr.so* mr,
|
|
|
|
${pkgs.iputils}/bin/ping mixr,
|
|
/var/setuid-wrappers/ping.real r,
|
|
|
|
#/etc/modules.conf r,
|
|
|
|
## Site-specific additions and overrides. See local/README for details.
|
|
##include <local/bin.ping>
|
|
}
|
|
'') ];
|
|
};
|
|
|
|
}
|