starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-30 14:57:12 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(apparmor): use inherit exec modifier in sudo complain profile

Browse Source 
The broad 'file /** rwlkUx' rule conflicts with rix exec rules pulled in
via nested abstractions (xdg-open): AppArmor 5.0 rejects merged rules
with differing exec modifiers, failing apparmor.service on first load.
This commit is contained in:
Ryan Yin
2026-08-30 12:57:09 +08:00
parent 2cd3a1cee4
commit a7f7cb68f0
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hardening/apparmor/default.nix
+6 -1
View File
@@ -39,9 +39,14 @@
abi <abi/4.0>, abi <abi/4.0>,
include <tunables/global> include <tunables/global>
# NOTE: exec must use the `ix` (inherit) modifier here: abstractions/base
# pulls in nested rules like `rix` on specific binaries (via xdg-open etc.),
# and AppArmor 5.0's parser rejects merged rules with conflicting exec
# modifiers ("profile has merged rule with conflicting x modifiers") when a
# broad rule uses Ux over those paths.
profile ${pkgs.sudo}/bin/sudo { profile ${pkgs.sudo}/bin/sudo {
include <abstractions/base> include <abstractions/base>
file /** rwlkUx, file /** rwlkix,
} }
''; '';
}; };