diff options
| author | Michael Raskin <7c6f434c@mail.ru> | 2020-09-27 13:07:38 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-09-27 13:07:38 +0000 |
| commit | 31a4e2e28bf29fc5ab1f70d28b5dbc2205a638a0 (patch) | |
| tree | 5fd228150808cdc3915afe3a58690c0425f8000a /nixos/modules/virtualisation | |
| parent | 862e6fe2c6b3f4f8aff53a9606eaafaaf3490d3d (diff) | |
| parent | fb6d63f3fdd95a5468d43a0693c8ca7c1894363f (diff) | |
Merge pull request #93457 from ju1m/apparmor
apparmor: fix and improve the service
Diffstat (limited to 'nixos/modules/virtualisation')
| -rw-r--r-- | nixos/modules/virtualisation/lxc.nix | 12 | ||||
| -rw-r--r-- | nixos/modules/virtualisation/lxd.nix | 12 |
2 files changed, 16 insertions, 8 deletions
diff --git a/nixos/modules/virtualisation/lxc.nix b/nixos/modules/virtualisation/lxc.nix index f484d5ee59a88..0f8b22a45df0c 100644 --- a/nixos/modules/virtualisation/lxc.nix +++ b/nixos/modules/virtualisation/lxc.nix @@ -74,9 +74,13 @@ in systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ]; security.apparmor.packages = [ pkgs.lxc ]; - security.apparmor.profiles = [ - "${pkgs.lxc}/etc/apparmor.d/lxc-containers" - "${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start" - ]; + security.apparmor.policies = { + "bin.lxc-start".profile = '' + include ${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start + ''; + "lxc-containers".profile = '' + include ${pkgs.lxc}/etc/apparmor.d/lxc-containers + ''; + }; }; } diff --git a/nixos/modules/virtualisation/lxd.nix b/nixos/modules/virtualisation/lxd.nix index 3958fc2c1d7c5..876956f654bb0 100644 --- a/nixos/modules/virtualisation/lxd.nix +++ b/nixos/modules/virtualisation/lxd.nix @@ -93,11 +93,15 @@ in security.apparmor = { enable = true; - profiles = [ - "${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start" - "${cfg.lxcPackage}/etc/apparmor.d/lxc-containers" - ]; packages = [ cfg.lxcPackage ]; + policies = { + "bin.lxc-start".profile = '' + include ${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start + ''; + "lxc-containers".profile = '' + include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers + ''; + }; }; systemd.services.lxd = { |