security: enable AppArmor (complain) on all Linux hosts

hardening/apparmor/default.nix

@@ -4,56 +4,50 @@
   ...
 }:
 {
+  # AppArmor: activate the LSM + load policies. Roll out in complain mode first
+  # (log violations, never block) so nothing can break; promote profiles to
+  # "enforce" individually once stable.
   services.dbus.apparmor = "enabled";
+
   security.apparmor = {
     enable = true;
 
-    # kill process that are not confined but have apparmor profiles enabled
-    killUnconfinedConfinables = true;
-    packages = with pkgs; [
-      apparmor-utils
-      apparmor-profiles
-    ];
+    # Do not SIGTERM running unconfined-but-confinable processes yet.
+    # Safe to flip to true later now that no global default-deny profile is active.
+    killUnconfinedConfinables = false;
+
+    # Packages contributing to AppArmor's include path (abstractions).
+    # NOTE: these are FHS-oriented; nixpkgs adds FHS->NixOS aliases so they mostly work,
+    # but treat resulting profiles as complain-only until verified.
+    packages = [ pkgs.apparmor-profiles ];
 
-    # apparmor policies
     policies = {
+      # Global default-deny scaffold. DANGEROUS to enable: `/**` matches every binary and
+      # the empty block allows nothing. Keep disabled until per-app profiles exist.
       "default_deny" = {
-        enforce = false;
-        enable = false;
-        profile = ''
-          profile default_deny /** { }
-        '';
+        state = "disable";
+        profile = "profile default_deny /** { }";
       };
 
+      # Confine sudo; complain mode so a missing rule logs instead of blocking.
       "sudo" = {
-        enforce = false;
-        enable = false;
+        state = "complain";
         profile = ''
-          ${pkgs.sudo}/bin/sudo {
+          abi <abi/4.0>,
+          include <tunables/global>
+
+          profile ${pkgs.sudo}/bin/sudo {
+            include <abstractions/base>
             file /** rwlkUx,
           }
         '';
       };
 
+      # nix runs unconfined (no restriction); inert, kept disabled.
       "nix" = {
-        enforce = false;
-        enable = false;
-        profile = ''
-          ${config.nix.package}/bin/nix {
-            unconfined,
-          }
-        '';
+        state = "disable";
+        profile = "profile ${config.nix.package}/bin/nix { unconfined, }";
       };
     };
   };
-
-  environment.systemPackages = with pkgs; [
-    apparmor-bin-utils
-    apparmor-profiles
-    apparmor-parser
-    libapparmor
-    apparmor-kernel-patches
-    apparmor-pam
-    apparmor-utils
-  ];
 }

modules/nixos/base/default.nix

@@ -1,4 +1,4 @@
 { mylib, ... }:
 {
-  imports = mylib.scanPaths ./.;
+  imports = mylib.scanPaths ./. ++ [ (mylib.relativeToRoot "hardening/apparmor") ];
 }

modules/nixos/server/server-aarch64.nix

@@ -1,6 +1,7 @@
 {
   lib,
   pkgs,
+  mylib,
   ...
 }:
 {
@@ -15,6 +16,9 @@
     ../base/user-group.nix
 
     ../../base
+    # AppArmor is wired via modules/nixos/base/default.nix for other hosts; this
+    # aarch64 server imports base files individually, so add it explicitly.
+    (mylib.relativeToRoot "hardening/apparmor")
   ];
 
   # Servers run on the trusted internal LAN (NAT'd; WAN protected at the router).

outputs/aarch64-linux/tests/security-apparmor/expected.nix

@@ -0,0 +1,5 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: true)

outputs/aarch64-linux/tests/security-apparmor/expr.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: outputs.nixosConfigurations.${name}.config.security.apparmor.enable
+)

outputs/x86_64-linux/tests/security-apparmor/expected.nix

@@ -0,0 +1,5 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: true)

outputs/x86_64-linux/tests/security-apparmor/expr.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name: outputs.nixosConfigurations.${name}.config.security.apparmor.enable
+)