From a7f7cb68f00719f3008f5586203ad41ef494f557 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Sun, 30 Aug 2026 12:57:09 +0800
Subject: [PATCH] fix(apparmor): use inherit exec modifier in sudo complain
 profile

The broad 'file /** rwlkUx' rule conflicts with rix exec rules pulled in
via nested abstractions (xdg-open): AppArmor 5.0 rejects merged rules
with differing exec modifiers, failing apparmor.service on first load.
---
 hardening/apparmor/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hardening/apparmor/default.nix b/hardening/apparmor/default.nix
index 580d7e76..afd13808 100644
--- a/hardening/apparmor/default.nix
+++ b/hardening/apparmor/default.nix
@@ -39,9 +39,14 @@
           abi <abi/4.0>,
           include <tunables/global>
 
+          # NOTE: exec must use the `ix` (inherit) modifier here: abstractions/base
+          # pulls in nested rules like `rix` on specific binaries (via xdg-open etc.),
+          # and AppArmor 5.0's parser rejects merged rules with conflicting exec
+          # modifiers ("profile has merged rule with conflicting x modifiers") when a
+          # broad rule uses Ux over those paths.
           profile ${pkgs.sudo}/bin/sudo {
             include <abstractions/base>
-            file /** rwlkUx,
+            file /** rwlkix,
           }
         '';
       };