diff options
| author | Julien Moutinho <julm+nixpkgs@sourcephile.fr> | 2020-10-18 15:36:24 +0200 |
|---|---|---|
| committer | Julien Moutinho <julm+nixpkgs@sourcephile.fr> | 2021-04-23 07:17:55 +0200 |
| commit | 05d334cfe265f021b16c41375e3e5a4c4a07fc74 (patch) | |
| tree | 0d00c946f6f9ed0492ec74725261a44d59bfd067 /nixos/modules/tasks/network-interfaces.nix | |
| parent | d239bc36439f4f1457c5c70ad59f8a737989d79a (diff) | |
| download | nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.gz nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.bz2 nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.lz nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.xz nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.zst nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.zip | |
Revert "Revert "apparmor: fix and improve the service""
This reverts commit 420f89ceb267b461eed5d025b6c3c0e57703cc5c.
Diffstat (limited to 'nixos/modules/tasks/network-interfaces.nix')
| -rw-r--r-- | nixos/modules/tasks/network-interfaces.nix | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix index f501f85b2a9..448ff842f18 100644 --- a/nixos/modules/tasks/network-interfaces.nix +++ b/nixos/modules/tasks/network-interfaces.nix @@ -1111,6 +1111,21 @@ in } else { ping.source = "${pkgs.iputils.out}/bin/ping"; }; + security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter '' + /run/wrappers/bin/ping { + include <abstractions/base> + include <nixos/security.wrappers> + rpx /run/wrappers/wrappers.*/ping, + } + /run/wrappers/wrappers.*/ping { + include <abstractions/base> + include <nixos/security.wrappers> + r /run/wrappers/wrappers.*/ping.real, + mrpx ${config.security.wrappers.ping.source}, + capability net_raw, + capability setpcap, + } + ''); # Set the host and domain names in the activation script. Don't # clear it if it's not configured in the NixOS configuration, |