diff options
| author | Julien Moutinho <julm+nixpkgs@sourcephile.fr> | 2020-10-18 15:36:24 +0200 |
|---|---|---|
| committer | Julien Moutinho <julm+nixpkgs@sourcephile.fr> | 2021-04-23 07:17:55 +0200 |
| commit | 05d334cfe265f021b16c41375e3e5a4c4a07fc74 (patch) | |
| tree | 0d00c946f6f9ed0492ec74725261a44d59bfd067 /nixos/modules/virtualisation/lxd.nix | |
| parent | d239bc36439f4f1457c5c70ad59f8a737989d79a (diff) | |
| download | nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.gz nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.bz2 nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.lz nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.xz nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.tar.zst nixpkgs-05d334cfe265f021b16c41375e3e5a4c4a07fc74.zip | |
Revert "Revert "apparmor: fix and improve the service""
This reverts commit 420f89ceb267b461eed5d025b6c3c0e57703cc5c.
Diffstat (limited to 'nixos/modules/virtualisation/lxd.nix')
| -rw-r--r-- | nixos/modules/virtualisation/lxd.nix | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/nixos/modules/virtualisation/lxd.nix b/nixos/modules/virtualisation/lxd.nix index 96e8d68ae50..6b6f4b6e652 100644 --- a/nixos/modules/virtualisation/lxd.nix +++ b/nixos/modules/virtualisation/lxd.nix @@ -97,11 +97,17 @@ in { # does a bunch of unrelated things. systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ]; - security.apparmor.packages = [ cfg.lxcPackage ]; - security.apparmor.profiles = [ - "${cfg.lxcPackage}/etc/apparmor.d/lxc-containers" - "${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start" - ]; + security.apparmor = { + packages = [ cfg.lxcPackage ]; + policies = { + "bin.lxc-start".profile = '' + include ${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start + ''; + "lxc-containers".profile = '' + include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers + ''; + }; + }; # TODO: remove once LXD gets proper support for cgroupsv2 # (currently most of the e.g. CPU accounting stuff doesn't work) |