mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-31 20:54:56 +00:00
49 lines
1.3 KiB
Nix
49 lines
1.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.security;
|
|
in
|
|
{
|
|
options = {
|
|
security.lsm = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
description = ''
|
|
A list of the LSMs to initialize in order.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = lib.mkMerge [
|
|
{
|
|
# We set the default LSM's here due to them not being present if set when enabling AppArmor.
|
|
security.lsm = lib.mkMerge [
|
|
[
|
|
"landlock"
|
|
"yama"
|
|
]
|
|
# Load BPF last unconditionally. See: https://github.com/NixOS/nixpkgs/pull/533428.
|
|
# Apparmor (and potentially other modules) will load incorrectly if they are not before BPF.
|
|
# It is believed that there was a regression between kernel 6.12 and 6.18 which caused the
|
|
# passthrough stub or LSM stacking of the BPF module to interact with other modules incorrectly.
|
|
(lib.mkAfter [ "bpf" ])
|
|
];
|
|
}
|
|
(lib.mkIf (lib.lists.length cfg.lsm > 0) {
|
|
assertions = [
|
|
{
|
|
assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0;
|
|
message = "security parameter in boot.kernelParams cannot be used when security.lsm is used";
|
|
}
|
|
];
|
|
|
|
boot.kernelParams = [
|
|
"lsm=${lib.concatStringsSep "," cfg.lsm}"
|
|
];
|
|
})
|
|
];
|
|
}
|