mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-03-23 01:49:56 +01:00
df9ca7aefa
* feat: hardening nixos desktops * refactor: move hardening to the root folder * feat: add nixpaks into nixpkgs via overlays * feat: nixpak - add netease music * docs: hardening * fix: nvidia * fix: disable apparmor & hardening profile to avoid neovim being killed * fix: firefox cursor & fonts
59 lines
1.1 KiB
Nix
59 lines
1.1 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
services.dbus.apparmor = "enabled";
|
|
security.apparmor = {
|
|
enable = true;
|
|
|
|
# kill process that are not confined but have apparmor profiles enabled
|
|
killUnconfinedConfinables = true;
|
|
packages = with pkgs; [
|
|
apparmor-utils
|
|
apparmor-profiles
|
|
];
|
|
|
|
# apparmor policies
|
|
policies = {
|
|
"default_deny" = {
|
|
enforce = false;
|
|
enable = false;
|
|
profile = ''
|
|
profile default_deny /** { }
|
|
'';
|
|
};
|
|
|
|
"sudo" = {
|
|
enforce = false;
|
|
enable = false;
|
|
profile = ''
|
|
${pkgs.sudo}/bin/sudo {
|
|
file /** rwlkUx,
|
|
}
|
|
'';
|
|
};
|
|
|
|
"nix" = {
|
|
enforce = false;
|
|
enable = false;
|
|
profile = ''
|
|
${config.nix.package}/bin/nix {
|
|
unconfined,
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
apparmor-bin-utils
|
|
apparmor-profiles
|
|
apparmor-parser
|
|
libapparmor
|
|
apparmor-kernel-patches
|
|
apparmor-pam
|
|
apparmor-utils
|
|
];
|
|
}
|