]> Git — Sourcephile - sourcephile-nix.git/blob - nixos/modules/security/apparmor/profiles.nix
nix: use nixpkgs/patches/wip.diff instead of nixpkgs/overlays.nix and nixos/modules.nix
[sourcephile-nix.git] / nixos / modules / security / apparmor / profiles.nix
1 { config, lib, pkgs, ... }:
2
3 let
4 inherit (builtins) attrNames hasAttr isAttrs;
5 inherit (lib) getLib;
6 inherit (config.environment) etc;
7 etcRule = arg:
8 let go = {path ? null, mode ? "r", trail ? ""}:
9 lib.optionalString (hasAttr path etc)
10 ("${mode} ${config.environment.etc."${path}".source}${trail},");
11 in if isAttrs arg
12 then go arg
13 else go {path=arg;};
14 in
15
16 {
17 config.security.apparmor.packages = [ pkgs.apparmor-profiles ];
18 # FIXME: most of the etcRule calls below have been
19 # written systematically by converting from apparmor-profiles's profiles
20 # without testing nor deep understanding of their uses,
21 # and thus may need more rules or can have less rules;
22 # this remains to me determined case by case,
23 # some may even be completely useless.
24 config.security.apparmor.includes = {
25 # This one is included by <tunables/global>
26 # which is usualy included before any profile.
27 "abstractions/tunables/alias" = ''
28 alias /bin -> /run/current-system/sw/bin,
29 # Unfortunately /etc is mainly built using symlinks,
30 # thus aliasing does not work.
31 #alias /etc -> /run/current-system/etc,
32 alias /lib/modules -> /run/current-system/kernel/lib/modules,
33 alias /sbin -> /run/current-system/sw/sbin,
34 alias /usr -> /run/current-system/sw,
35 '';
36 "abstractions/audio" = ''
37 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/audio
38 ${etcRule "asound.conf"}
39 ${etcRule "esound/esd.conf"}
40 ${etcRule "libao.conf"}
41 ${etcRule {path="pulse"; trail="/";}}
42 ${etcRule {path="pulse"; trail="/**";}}
43 ${etcRule {path="sound"; trail="/";}}
44 ${etcRule {path="sound"; trail="/**";}}
45 ${etcRule {path="alsa/conf.d"; trail="/";}}
46 ${etcRule {path="alsa/conf.d"; trail="/*";}}
47 ${etcRule "openal/alsoft.conf"}
48 ${etcRule "wildmidi/wildmidi.conf"}
49 '';
50 # FIXME: security.pam configures more .so than allowed here,
51 # but has many tests to decide what .so to use,
52 # so it would be simpler to let security.pam add those .so
53 # to the present security.apparmor.includes."abstractions/authentication"
54 "abstractions/authentication" = ''
55 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/authentication
56 ${etcRule "nologin"}
57 ${lib.concatMapStringsSep "\n"
58 (name: "r ${etc."pam.d/${name}".source} ,".source)
59 (attrNames config.security.pam.services)}
60 mr ${getLib pkgs.pam}/lib/security/pam_filter/*,
61 mr ${getLib pkgs.pam}/lib/security/pam_*.so,
62 r ${getLib pkgs.pam}/lib/security/,
63 ${etcRule "securetty"}
64 ${etcRule {path="security"; trail="/*";}}
65 ${etcRule "shadow"}
66 ${etcRule "gshadow"}
67 ${etcRule "pwdb.conf"}
68 ${etcRule "default/passwd"}
69 ${etcRule "login.defs"}
70 '';
71 "abstractions/base" = ''
72 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base
73 r ${pkgs.stdenv.cc.libc}/share/locale/**,
74 r ${pkgs.stdenv.cc.libc}/share/locale.alias,
75 ${etcRule "localtime"}
76 r /etc/ld-nix.so.preload,
77 ${etcRule "ld-nix.so.preload"}
78 ${lib.concatMapStrings (p: lib.optionalString (p != "") "mr ${p},\n")
79 (lib.splitString "\n" etc."ld-nix.so.preload".text)
80 # TODO: avoid this line splitting by nixifying ld-nix.so.preload as a list or attrset,
81 # and make services.config.malloc use it.
82 }
83 r ${pkgs.tzdata}/share/zoneinfo/**,
84 r ${pkgs.stdenv.cc.libc}/share/i18n/**,
85 '';
86 "abstractions/bash" = ''
87 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash
88 # system-wide bash configuration
89 ${etcRule "profile.dos"}
90 ${etcRule "profile"}
91 ${etcRule "profile.d"}
92 ${etcRule {path="profile.d"; trail="/*";}}
93 ${etcRule "bashrc"}
94 ${etcRule "bash.bashrc"}
95 ${etcRule "bash.bashrc.local"}
96 ${etcRule "bash_completion"}
97 ${etcRule "bash_completion.d"}
98 ${etcRule {path="bash_completion.d"; trail="/*";}}
99 # bash relies on system-wide readline configuration
100 ${etcRule "inputrc"}
101 # bash inspects filesystems at startup
102 # and /etc/mtab is linked to /proc/mounts
103 @{PROC}/mounts
104
105 # run out of /etc/bash.bashrc
106 ${etcRule "DIR_COLORS"}
107 '';
108 "abstractions/cups-client" = ''
109 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/cpus-client
110 ${etcRule "cups/cups-client.conf"}
111 '';
112 "abstractions/consoles" = ''
113 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/consoles
114 '';
115 "abstractions/dbus-session-strict" = ''
116 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dbus-session-strict
117 ${etcRule "machine-id"}
118 '';
119 "abstractions/dconf" = ''
120 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dconf
121 ${etcRule {path="dconf"; trail="/**";}}
122 '';
123 "abstractions/dri-common" = ''
124 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/dri-common
125 ${etcRule "drirc"}
126 '';
127 # The config.fonts.fontconfig NixOS module adds many files to /etc/fonts/
128 # by symlinking them but without exporting them outside of its NixOS module,
129 # those are therefore added there to this "abstractions/fonts".
130 "abstractions/fonts" = ''
131 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/fonts
132 ${etcRule {path="fonts"; trail="/**";}}
133 '';
134 "abstractions/gnome" = ''
135 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/gnome
136 ${etcRule {path="gnome"; trail="/gtkrc*";}}
137 ${etcRule {path="gtk"; trail="/*";}}
138 ${etcRule {path="gtk-2.0"; trail="/*";}}
139 ${etcRule {path="gtk-3.0"; trail="/*";}}
140 ${etcRule "orbitrc"}
141 #include <abstractions/fonts>
142 ${etcRule {path="pango"; trail="/*";}}
143 ${etcRule {path="/etc/gnome-vfs-2.0"; trail="/modules/";}}
144 ${etcRule {path="/etc/gnome-vfs-2.0"; trail="/modules/*";}}
145 ${etcRule "papersize"}
146 ${etcRule {path="cups"; trail="/lpoptions";}}
147 ${etcRule {path="gnome"; trail="/defaults.list";}}
148 ${etcRule {path="xdg"; trail="/{,*-}mimeapps.list";}}
149 ${etcRule "xdg/mimeapps.list"}
150 '';
151 "abstractions/kde" = ''
152 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kde
153 ${etcRule {path="qt3"; trail="/kstylerc";}}
154 ${etcRule {path="qt3"; trail="/qt_plugins_3.3rc";}}
155 ${etcRule {path="qt3"; trail="/qtrc";}}
156 ${etcRule "kderc"}
157 ${etcRule {path="kde3"; trail="/*";}}
158 ${etcRule "kde4rc"}
159 ${etcRule {path="xdg"; trail="/kdeglobals";}}
160 ${etcRule {path="xdg"; trail="/Trolltech.conf";}}
161 '';
162 "abstractions/kerberosclient" = ''
163 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kerberosclient
164 ${etcRule {path="krb5.keytab"; mode="rk";}}
165 ${etcRule "krb5.conf"}
166 ${etcRule "krb5.conf.d"}
167 ${etcRule {path="krb5.conf.d"; trail="/*";}}
168
169 # config files found via strings on libs
170 ${etcRule "krb.conf"}
171 ${etcRule "krb.realms"}
172 ${etcRule "srvtab"}
173 '';
174 "abstractions/ldapclient" = ''
175 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ldapclient
176 ${etcRule "ldap.conf"}
177 ${etcRule "ldap.secret"}
178 ${etcRule {path="openldap"; trail="/*";}}
179 ${etcRule {path="openldap"; trail="/cacerts/*";}}
180 ${etcRule {path="sasl2"; trail="/*";}}
181 '';
182 "abstractions/likewise" = ''
183 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/likewise
184 '';
185 "abstractions/mdns" = ''
186 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/mdns
187 ${etcRule "nss_mdns.conf"}
188 '';
189 "abstractions/nameservice" = ''
190 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nameservice
191
192 # Many programs wish to perform nameservice-like operations, such as
193 # looking up users by name or id, groups by name or id, hosts by name
194 # or IP, etc. These operations may be performed through files, dns,
195 # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
196 ${etcRule "group"}
197 ${etcRule "host.conf"}
198 ${etcRule "hosts"}
199 ${etcRule "nsswitch.conf"}
200 ${etcRule "gai.conf"}
201 ${etcRule "passwd"}
202 ${etcRule "protocols"}
203
204 # libtirpc (used for NIS/YP login) needs this
205 ${etcRule "netconfig"}
206
207 ${etcRule "resolv.conf"}
208
209 ${etcRule {path="samba"; trail="/lmhosts";}}
210 ${etcRule "services"}
211
212 ${etcRule "default/nss"}
213
214 # libnl-3-200 via libnss-gw-name
215 ${etcRule {path="libnl"; trail="/classid";}}
216 ${etcRule {path="libnl-3"; trail="/classid";}}
217
218 mr ${getLib pkgs.nss}/lib/libnss_*.so*,
219 mr ${getLib pkgs.nss}/lib64/libnss_*.so*,
220 '';
221 "abstractions/nis" = ''
222 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nis
223 '';
224 "abstractions/nvidia" = ''
225 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nvidia
226 ${etcRule "vdpau_wrapper.cfg"}
227 '';
228 "abstractions/opencl-common" = ''
229 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/opencl-common
230 ${etcRule {path="OpenCL"; trail="/**";}}
231 '';
232 "abstractions/opencl-mesa" = ''
233 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/opencl-mesa
234 ${etcRule "default/drirc"}
235 '';
236 "abstractions/openssl" = ''
237 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/openssl
238 ${etcRule {path="ssl"; trail="/openssl.cnf";}}
239 '';
240 "abstractions/p11-kit" = ''
241 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/p11-kit
242 ${etcRule {path="pkcs11"; trail="/";}}
243 ${etcRule {path="pkcs11"; trail="/pkcs11.conf";}}
244 ${etcRule {path="pkcs11"; trail="/modules/";}}
245 ${etcRule {path="pkcs11"; trail="/modules/*";}}
246 '';
247 "abstractions/perl" = ''
248 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/perl
249 ${etcRule {path="perl"; trail="/**";}}
250 '';
251 "abstractions/php" = ''
252 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/php
253 ${etcRule {path="php"; trail="/**/";}}
254 ${etcRule {path="php5"; trail="/**/";}}
255 ${etcRule {path="php7"; trail="/**/";}}
256 ${etcRule {path="php"; trail="/**.ini";}}
257 ${etcRule {path="php5"; trail="/**.ini";}}
258 ${etcRule {path="php7"; trail="/**.ini";}}
259 '';
260 "abstractions/postfix-common" = ''
261 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/postfix-common
262 ${etcRule "mailname"}
263 ${etcRule {path="postfix"; trail="/*.cf";}}
264 ${etcRule "postfix/main.cf"}
265 ${etcRule "postfix/master.cf"}
266 '';
267 "abstractions/python" = ''
268 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/python
269 ${etcRule {path="python2.4"; trail="/**";}}
270 ${etcRule {path="python2.5"; trail="/**";}}
271 ${etcRule {path="python2.6"; trail="/**";}}
272 ${etcRule {path="python2.7"; trail="/**";}}
273 ${etcRule {path="python3.0"; trail="/**";}}
274 ${etcRule {path="python3.1"; trail="/**";}}
275 ${etcRule {path="python3.2"; trail="/**";}}
276 ${etcRule {path="python3.3"; trail="/**";}}
277 ${etcRule {path="python3.4"; trail="/**";}}
278 ${etcRule {path="python3.5"; trail="/**";}}
279 ${etcRule {path="python3.6"; trail="/**";}}
280 ${etcRule {path="python3.7"; trail="/**";}}
281 ${etcRule {path="python3.8"; trail="/**";}}
282 ${etcRule {path="python3.9"; trail="/**";}}
283 '';
284 "abstractions/qt5" = ''
285 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/qt5
286 ${etcRule {path="xdg"; trail="/QtProject/qtlogging.ini";}}
287 ${etcRule {path="xdg/QtProject"; trail="/qtlogging.ini";}}
288 ${etcRule "xdg/QtProject/qtlogging.ini"}
289 '';
290 "abstractions/samba" = ''
291 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/samba
292 ${etcRule {path="samba"; trail="/*";}}
293 '';
294 "abstractions/ssl_certs" = ''
295 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs
296 ${etcRule "ssl/certs/ca-certificates.crt"}
297 ${etcRule "ssl/certs/ca-bundle.crt"}
298 ${etcRule "pki/tls/certs/ca-bundle.crt"}
299
300 ${etcRule {path="ssl/trust"; trail="/";}}
301 ${etcRule {path="ssl/trust"; trail="/*";}}
302 ${etcRule {path="ssl/trust/anchors"; trail="/";}}
303 ${etcRule {path="ssl/trust/anchors"; trail="/**";}}
304 ${etcRule {path="pki/trust"; trail="/";}}
305 ${etcRule {path="pki/trust"; trail="/*";}}
306 ${etcRule {path="pki/trust/anchors"; trail="/";}}
307 ${etcRule {path="pki/trust/anchors"; trail="/**";}}
308
309 # security.acme NixOS module
310 /var/lib/acme/*/cert.pem r,
311 /var/lib/acme/*/chain.pem r,
312 /var/lib/acme/*/fullchain.pem r,
313 '';
314 "abstractions/ssl_keys" = ''
315 # security.acme NixOS module
316 /var/lib/acme/*/full.pem r,
317 /var/lib/acme/*/key.pem r,
318 '';
319 "abstractions/vulkan" = ''
320 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/vulkan
321 ${etcRule {path="vulkan/icd.d"; trail="/";}}
322 ${etcRule {path="vulkan/icd.d"; trail="/*.json";}}
323 '';
324 "abstractions/winbind" = ''
325 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/winbind
326 ${etcRule {path="samba"; trail="/smb.conf";}}
327 ${etcRule {path="samba"; trail="/dhcp.conf";}}
328 '';
329 "abstractions/X" = ''
330 #include ${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/X
331 ${etcRule {path="X11/cursors"; trail="/";}}
332 ${etcRule {path="X11/cursors"; trail="/**";}}
333 '';
334 };
335 }