suzanne.soy/nixpkgs
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

nixos/apparmor: allow reloading profiles without losing confinement

Browse Source 
Define ExecReload, otherwise reload implies stop followed by start, which
leaves existing processes in unconfined state [1].

[1]: https://gitlab.com/apparmor/apparmor/wikis/AppArmorInSystemd
This commit is contained in:
Joachim Fasting 2019-04-28 15:12:37 +02:00
parent f824dad19a
commit aa24c4e95b
No known key found for this signature in database
GPG Key ID: 5C204DF675C90294
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/modules/security/apparmor.nix
View File

@ -48,6 +48,9 @@ in
ExecStop = map (p: ExecStop = map (p:
''${pkgs.apparmor-parser}/bin/apparmor_parser -Rv "${p}"'' ''${pkgs.apparmor-parser}/bin/apparmor_parser -Rv "${p}"''
) cfg.profiles; ) cfg.profiles;
ExecReload = map (p:
''${pkgs.apparmor-parser}/bin/apparmor_parser --reload ${paths} "${p}"''
) cfg.profiles;
}; };
}; };
}; };