From 4d07e306ade6e3f29b0f6a8b47208312d6786d21 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sun, 17 Nov 2024 18:03:04 +0100
Subject: [PATCH 1/5] nixos/apparmor: Format

---
 nixos/modules/security/apparmor.nix | 262 +++++++++++++++++-----------
 1 file changed, 157 insertions(+), 105 deletions(-)

diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix
index e463e48f675e9..87dde1ad50a9d 100644
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@@ -1,20 +1,42 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-  inherit (builtins) attrNames head map match readFile;
+  inherit (builtins)
+    attrNames
+    head
+    map
+    match
+    readFile
+    ;
   inherit (lib) types;
   inherit (config.environment) etc;
   cfg = config.security.apparmor;
-  mkDisableOption = name: lib.mkEnableOption name // {
-    default = true;
-    example = false;
-  };
+  mkDisableOption =
+    name:
+    lib.mkEnableOption name
+    // {
+      default = true;
+      example = false;
+    };
   enabledPolicies = lib.filterAttrs (n: p: p.enable) cfg.policies;
 in
 
 {
   imports = [
-    (lib.mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
-    (lib.mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")
+    (lib.mkRemovedOptionModule [
+      "security"
+      "apparmor"
+      "confineSUIDApplications"
+    ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
+    (lib.mkRemovedOptionModule [
+      "security"
+      "apparmor"
+      "profiles"
+    ] "Please use the new option: `security.apparmor.policies'.")
     apparmor/includes.nix
     apparmor/profiles.nix
   ];
@@ -42,22 +64,27 @@ in
         description = ''
           AppArmor policies.
         '';
-        type = types.attrsOf (types.submodule ({ name, config, ... }: {
-          options = {
-            enable = mkDisableOption "loading of the profile into the kernel";
-            enforce = mkDisableOption "enforcing of the policy or only complain in the logs";
-            profile = lib.mkOption {
-              description = "The policy of the profile.";
-              type = types.lines;
-              apply = pkgs.writeText name;
-            };
-          };
-        }));
-        default = {};
+        type = types.attrsOf (
+          types.submodule (
+            { name, config, ... }:
+            {
+              options = {
+                enable = mkDisableOption "loading of the profile into the kernel";
+                enforce = mkDisableOption "enforcing of the policy or only complain in the logs";
+                profile = lib.mkOption {
+                  description = "The policy of the profile.";
+                  type = types.lines;
+                  apply = pkgs.writeText name;
+                };
+              };
+            }
+          )
+        );
+        default = { };
       };
       includes = lib.mkOption {
         type = types.attrsOf types.lines;
-        default = {};
+        default = { };
         description = ''
           List of paths to be added to AppArmor's searched paths
           when resolving `include` directives.
@@ -66,7 +93,7 @@ in
       };
       packages = lib.mkOption {
         type = types.listOf types.package;
-        default = [];
+        default = [ ];
         description = "List of packages to be added to AppArmor's include path";
       };
       enableCache = lib.mkEnableOption ''
@@ -90,13 +117,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = map (policy:
-      { assertion = match ".*/.*" policy == null;
-        message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";
-        # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
-        # which does not recurse into sub-directories.
-      }
-    ) (attrNames cfg.policies);
+    assertions = map (policy: {
+      assertion = match ".*/.*" policy == null;
+      message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";
+      # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
+      # which does not recurse into sub-directories.
+    }) (attrNames cfg.policies);
 
     environment.systemPackages = [
       pkgs.apparmor-utils
@@ -105,67 +131,81 @@ in
     environment.etc."apparmor.d".source = pkgs.linkFarm "apparmor.d" (
       # It's important to put only enabledPolicies here and not all cfg.policies
       # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*
-      lib.mapAttrsToList (name: p: { inherit name; path = p.profile; }) enabledPolicies ++
-      lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
+      lib.mapAttrsToList (name: p: {
+        inherit name;
+        path = p.profile;
+      }) enabledPolicies
+      ++ lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
     );
-    environment.etc."apparmor/parser.conf".text = ''
+    environment.etc."apparmor/parser.conf".text =
+      ''
         ${if cfg.enableCache then "write-cache" else "skip-cache"}
         cache-loc /var/cache/apparmor
         Include /etc/apparmor.d
-      '' +
-      lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
+      ''
+      + lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
     # For aa-logprof
-    environment.etc."apparmor/apparmor.conf".text = ''
-    '';
+    environment.etc."apparmor/apparmor.conf".text = '''';
     # For aa-logprof
     environment.etc."apparmor/severity.db".source = pkgs.apparmor-utils + "/etc/apparmor/severity.db";
-    environment.etc."apparmor/logprof.conf".source = pkgs.runCommand "logprof.conf" {
-      header = ''
-        [settings]
-          # /etc/apparmor.d/ is read-only on NixOS
-          profiledir = /var/cache/apparmor/logprof
-          inactive_profiledir = /etc/apparmor.d/disable
-          # Use: journalctl -b --since today --grep audit: | aa-logprof
-          logfiles = /dev/stdin
-
-          parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
-          ldd = ${pkgs.glibc.bin}/bin/ldd
-          logger = ${pkgs.util-linux}/bin/logger
-
-          # customize how file ownership permissions are presented
-          # 0 - off
-          # 1 - default of what ever mode the log reported
-          # 2 - force the new permissions to be user
-          # 3 - force all perms on the rule to be user
-          default_owner_prompt = 1
-
-          custom_includes = /etc/apparmor.d ${lib.concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}
-
-        [qualifiers]
-          ${pkgs.runtimeShell} = icnu
-          ${pkgs.bashInteractive}/bin/sh = icnu
-          ${pkgs.bashInteractive}/bin/bash = icnu
-          ${config.users.defaultUserShell} = icnu
-      '';
-      footer = "${pkgs.apparmor-utils}/etc/apparmor/logprof.conf";
-      passAsFile = [ "header" ];
-    } ''
-      cp $headerPath $out
-      sed '1,/\[qualifiers\]/d' $footer >> $out
-    '';
-
-    boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+    environment.etc."apparmor/logprof.conf".source =
+      pkgs.runCommand "logprof.conf"
+        {
+          header = ''
+            [settings]
+              # /etc/apparmor.d/ is read-only on NixOS
+              profiledir = /var/cache/apparmor/logprof
+              inactive_profiledir = /etc/apparmor.d/disable
+              # Use: journalctl -b --since today --grep audit: | aa-logprof
+              logfiles = /dev/stdin
+
+              parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
+              ldd = ${pkgs.glibc.bin}/bin/ldd
+              logger = ${pkgs.util-linux}/bin/logger
+
+              # customize how file ownership permissions are presented
+              # 0 - off
+              # 1 - default of what ever mode the log reported
+              # 2 - force the new permissions to be user
+              # 3 - force all perms on the rule to be user
+              default_owner_prompt = 1
+
+              custom_includes = /etc/apparmor.d ${
+                lib.concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages
+              }
+
+            [qualifiers]
+              ${pkgs.runtimeShell} = icnu
+              ${pkgs.bashInteractive}/bin/sh = icnu
+              ${pkgs.bashInteractive}/bin/bash = icnu
+              ${config.users.defaultUserShell} = icnu
+          '';
+          footer = "${pkgs.apparmor-utils}/etc/apparmor/logprof.conf";
+          passAsFile = [ "header" ];
+        }
+        ''
+          cp $headerPath $out
+          sed '1,/\[qualifiers\]/d' $footer >> $out
+        '';
+
+    boot.kernelParams = [
+      "apparmor=1"
+      "security=apparmor"
+    ];
 
     systemd.services.apparmor = {
       after = [
         "local-fs.target"
         "systemd-journald-audit.socket"
       ];
-      before = [ "sysinit.target" "shutdown.target" ];
+      before = [
+        "sysinit.target"
+        "shutdown.target"
+      ];
       conflicts = [ "shutdown.target" ];
       wantedBy = [ "multi-user.target" ];
       unitConfig = {
-        Description="Load AppArmor policies";
+        Description = "Load AppArmor policies";
         DefaultDependencies = "no";
         ConditionSecurity = "apparmor";
       };
@@ -176,37 +216,49 @@ in
         etc."apparmor/parser.conf".source
         etc."apparmor.d".source
       ];
-      serviceConfig = let
-        killUnconfinedConfinables = pkgs.writeShellScript "apparmor-kill" ''
-          set -eu
-          ${pkgs.apparmor-bin-utils}/bin/aa-status --json |
-          ${pkgs.jq}/bin/jq --raw-output '.processes | .[] | .[] | select (.status == "unconfined") | .pid' |
-          xargs --verbose --no-run-if-empty --delimiter='\n' \
-          kill
-        '';
-        commonOpts = p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";
-        in {
-        Type = "oneshot";
-        RemainAfterExit = "yes";
-        ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
-        ExecStart = lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;
-        ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
-        ExecReload =
-          # Add or replace into the kernel profiles in enabledPolicies
-          # (because AppArmor can do that without stopping the processes already confined).
-          lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++
-          # Remove from the kernel any profile whose name is not
-          # one of the names within the content of the profiles in enabledPolicies
-          # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).
-          # Note that this does not remove profiles dynamically generated by libvirt.
-          [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ] ++
-          # Optionally kill the processes which are unconfined but now have a profile loaded
-          # (because AppArmor can only start to confine new processes).
-          lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
-        ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
-        CacheDirectory = [ "apparmor" "apparmor/logprof" ];
-        CacheDirectoryMode = "0700";
-      };
+      serviceConfig =
+        let
+          killUnconfinedConfinables = pkgs.writeShellScript "apparmor-kill" ''
+            set -eu
+            ${pkgs.apparmor-bin-utils}/bin/aa-status --json |
+            ${pkgs.jq}/bin/jq --raw-output '.processes | .[] | .[] | select (.status == "unconfined") | .pid' |
+            xargs --verbose --no-run-if-empty --delimiter='\n' \
+            kill
+          '';
+          commonOpts =
+            p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";
+        in
+        {
+          Type = "oneshot";
+          RemainAfterExit = "yes";
+          ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
+          ExecStart = lib.mapAttrsToList (
+            n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}"
+          ) enabledPolicies;
+          ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+          ExecReload =
+            # Add or replace into the kernel profiles in enabledPolicies
+            # (because AppArmor can do that without stopping the processes already confined).
+            lib.mapAttrsToList (
+              n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}"
+            ) enabledPolicies
+            ++
+              # Remove from the kernel any profile whose name is not
+              # one of the names within the content of the profiles in enabledPolicies
+              # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).
+              # Note that this does not remove profiles dynamically generated by libvirt.
+              [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ]
+            ++
+              # Optionally kill the processes which are unconfined but now have a profile loaded
+              # (because AppArmor can only start to confine new processes).
+              lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+          ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
+          CacheDirectory = [
+            "apparmor"
+            "apparmor/logprof"
+          ];
+          CacheDirectoryMode = "0700";
+        };
     };
   };
 

From db05ce5ef75ef1c5496ccfafbb80cd8fa2c3e818 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 3 Dec 2024 20:14:36 +0100
Subject: [PATCH 2/5] nixos/tests/apparmor.nix: Format

---
 nixos/tests/apparmor.nix | 130 +++++++++++++++++++++------------------
 1 file changed, 71 insertions(+), 59 deletions(-)

diff --git a/nixos/tests/apparmor.nix b/nixos/tests/apparmor.nix
index f75c0c72718d1..e0b29b3be819d 100644
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@@ -1,15 +1,24 @@
-import ./make-test-python.nix ({ pkgs, lib, ... } : {
-  name = "apparmor";
-  meta.maintainers = with lib.maintainers; [ julm grimmauld ];
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  {
+    name = "apparmor";
+    meta.maintainers = with lib.maintainers; [
+      julm
+      grimmauld
+    ];
 
-  nodes.machine =
-    { lib, pkgs, config, ... }:
-    {
-      security.apparmor.enable = lib.mkDefault true;
-    };
+    nodes.machine =
+      {
+        lib,
+        pkgs,
+        config,
+        ...
+      }:
+      {
+        security.apparmor.enable = lib.mkDefault true;
+      };
 
-  testScript =
-    ''
+    testScript = ''
       machine.wait_for_unit("multi-user.target")
 
       with subtest("AppArmor profiles are loaded"):
@@ -28,58 +37,61 @@ import ./make-test-python.nix ({ pkgs, lib, ... } : {
       with subtest("apparmorRulesFromClosure"):
           machine.succeed(
               "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''
-                  mr ${pkgs.bash}/lib/**.so*,
-                  r ${pkgs.bash},
-                  r ${pkgs.bash}/etc/**,
-                  r ${pkgs.bash}/lib/**,
-                  r ${pkgs.bash}/share/**,
-                  x ${pkgs.bash}/foo/**,
-                  mr ${pkgs.glibc}/lib/**.so*,
-                  r ${pkgs.glibc},
-                  r ${pkgs.glibc}/etc/**,
-                  r ${pkgs.glibc}/lib/**,
-                  r ${pkgs.glibc}/share/**,
-                  x ${pkgs.glibc}/foo/**,
-                  mr ${pkgs.libcap}/lib/**.so*,
-                  r ${pkgs.libcap},
-                  r ${pkgs.libcap}/etc/**,
-                  r ${pkgs.libcap}/lib/**,
-                  r ${pkgs.libcap}/share/**,
-                  x ${pkgs.libcap}/foo/**,
-                  mr ${pkgs.libcap.lib}/lib/**.so*,
-                  r ${pkgs.libcap.lib},
-                  r ${pkgs.libcap.lib}/etc/**,
-                  r ${pkgs.libcap.lib}/lib/**,
-                  r ${pkgs.libcap.lib}/share/**,
-                  x ${pkgs.libcap.lib}/foo/**,
-                  mr ${pkgs.libidn2.out}/lib/**.so*,
-                  r ${pkgs.libidn2.out},
-                  r ${pkgs.libidn2.out}/etc/**,
-                  r ${pkgs.libidn2.out}/lib/**,
-                  r ${pkgs.libidn2.out}/share/**,
-                  x ${pkgs.libidn2.out}/foo/**,
-                  mr ${pkgs.libunistring}/lib/**.so*,
-                  r ${pkgs.libunistring},
-                  r ${pkgs.libunistring}/etc/**,
-                  r ${pkgs.libunistring}/lib/**,
-                  r ${pkgs.libunistring}/share/**,
-                  x ${pkgs.libunistring}/foo/**,
-                  mr ${pkgs.glibc.libgcc}/lib/**.so*,
-                  r ${pkgs.glibc.libgcc},
-                  r ${pkgs.glibc.libgcc}/etc/**,
-                  r ${pkgs.glibc.libgcc}/lib/**,
-                  r ${pkgs.glibc.libgcc}/share/**,
-                  x ${pkgs.glibc.libgcc}/foo/**,
-              ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
+                mr ${pkgs.bash}/lib/**.so*,
+                r ${pkgs.bash},
+                r ${pkgs.bash}/etc/**,
+                r ${pkgs.bash}/lib/**,
+                r ${pkgs.bash}/share/**,
+                x ${pkgs.bash}/foo/**,
+                mr ${pkgs.glibc}/lib/**.so*,
+                r ${pkgs.glibc},
+                r ${pkgs.glibc}/etc/**,
+                r ${pkgs.glibc}/lib/**,
+                r ${pkgs.glibc}/share/**,
+                x ${pkgs.glibc}/foo/**,
+                mr ${pkgs.libcap}/lib/**.so*,
+                r ${pkgs.libcap},
+                r ${pkgs.libcap}/etc/**,
+                r ${pkgs.libcap}/lib/**,
+                r ${pkgs.libcap}/share/**,
+                x ${pkgs.libcap}/foo/**,
+                mr ${pkgs.libcap.lib}/lib/**.so*,
+                r ${pkgs.libcap.lib},
+                r ${pkgs.libcap.lib}/etc/**,
+                r ${pkgs.libcap.lib}/lib/**,
+                r ${pkgs.libcap.lib}/share/**,
+                x ${pkgs.libcap.lib}/foo/**,
+                mr ${pkgs.libidn2.out}/lib/**.so*,
+                r ${pkgs.libidn2.out},
+                r ${pkgs.libidn2.out}/etc/**,
+                r ${pkgs.libidn2.out}/lib/**,
+                r ${pkgs.libidn2.out}/share/**,
+                x ${pkgs.libidn2.out}/foo/**,
+                mr ${pkgs.libunistring}/lib/**.so*,
+                r ${pkgs.libunistring},
+                r ${pkgs.libunistring}/etc/**,
+                r ${pkgs.libunistring}/lib/**,
+                r ${pkgs.libunistring}/share/**,
+                x ${pkgs.libunistring}/foo/**,
+                mr ${pkgs.glibc.libgcc}/lib/**.so*,
+                r ${pkgs.glibc.libgcc},
+                r ${pkgs.glibc.libgcc}/etc/**,
+                r ${pkgs.glibc.libgcc}/lib/**,
+                r ${pkgs.glibc.libgcc}/share/**,
+                x ${pkgs.glibc.libgcc}/foo/**,
+              ''} ${
+                pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
                   ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
-                      pkgs.apparmorRulesFromClosure {
-                        name = "ping";
-                        additionalRules = ["x $path/foo/**"];
-                      } [ pkgs.libcap ]
+                    pkgs.apparmorRulesFromClosure {
+                      name = "ping";
+                      additionalRules = [ "x $path/foo/**" ];
+                    } [ pkgs.libcap ]
                   } |
                   ${pkgs.coreutils}/bin/sort -n -k1 |
                   ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ::' >$out
-              ''}"
+                ''
+              }"
           )
     '';
-})
+  }
+)

From 1f750cfa3de8eb47e6d6281cd1c940a7be41540b Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 3 Dec 2024 20:17:47 +0100
Subject: [PATCH 3/5] nixos/tests/apparmor.nix: fix expected.rules

---
 nixos/tests/apparmor.nix | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/nixos/tests/apparmor.nix b/nixos/tests/apparmor.nix
index e0b29b3be819d..fad0e31bfffd1 100644
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@@ -37,47 +37,68 @@ import ./make-test-python.nix (
       with subtest("apparmorRulesFromClosure"):
           machine.succeed(
               "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''
+                ixr ${pkgs.bash}/libexec/**,
                 mr ${pkgs.bash}/lib/**.so*,
+                mr ${pkgs.bash}/lib64/**.so*,
+                mr ${pkgs.bash}/share/**,
                 r ${pkgs.bash},
                 r ${pkgs.bash}/etc/**,
                 r ${pkgs.bash}/lib/**,
-                r ${pkgs.bash}/share/**,
+                r ${pkgs.bash}/lib64/**,
                 x ${pkgs.bash}/foo/**,
+                ixr ${pkgs.glibc}/libexec/**,
                 mr ${pkgs.glibc}/lib/**.so*,
+                mr ${pkgs.glibc}/lib64/**.so*,
+                mr ${pkgs.glibc}/share/**,
                 r ${pkgs.glibc},
                 r ${pkgs.glibc}/etc/**,
                 r ${pkgs.glibc}/lib/**,
-                r ${pkgs.glibc}/share/**,
+                r ${pkgs.glibc}/lib64/**,
                 x ${pkgs.glibc}/foo/**,
+                ixr ${pkgs.libcap}/libexec/**,
                 mr ${pkgs.libcap}/lib/**.so*,
+                mr ${pkgs.libcap}/lib64/**.so*,
+                mr ${pkgs.libcap}/share/**,
                 r ${pkgs.libcap},
                 r ${pkgs.libcap}/etc/**,
                 r ${pkgs.libcap}/lib/**,
-                r ${pkgs.libcap}/share/**,
+                r ${pkgs.libcap}/lib64/**,
                 x ${pkgs.libcap}/foo/**,
+                ixr ${pkgs.libcap.lib}/libexec/**,
                 mr ${pkgs.libcap.lib}/lib/**.so*,
+                mr ${pkgs.libcap.lib}/lib64/**.so*,
+                mr ${pkgs.libcap.lib}/share/**,
                 r ${pkgs.libcap.lib},
                 r ${pkgs.libcap.lib}/etc/**,
                 r ${pkgs.libcap.lib}/lib/**,
-                r ${pkgs.libcap.lib}/share/**,
+                r ${pkgs.libcap.lib}/lib64/**,
                 x ${pkgs.libcap.lib}/foo/**,
+                ixr ${pkgs.libidn2.out}/libexec/**,
                 mr ${pkgs.libidn2.out}/lib/**.so*,
+                mr ${pkgs.libidn2.out}/lib64/**.so*,
+                mr ${pkgs.libidn2.out}/share/**,
                 r ${pkgs.libidn2.out},
                 r ${pkgs.libidn2.out}/etc/**,
                 r ${pkgs.libidn2.out}/lib/**,
-                r ${pkgs.libidn2.out}/share/**,
+                r ${pkgs.libidn2.out}/lib64/**,
                 x ${pkgs.libidn2.out}/foo/**,
+                ixr ${pkgs.libunistring}/libexec/**,
                 mr ${pkgs.libunistring}/lib/**.so*,
+                mr ${pkgs.libunistring}/lib64/**.so*,
+                mr ${pkgs.libunistring}/share/**,
                 r ${pkgs.libunistring},
                 r ${pkgs.libunistring}/etc/**,
                 r ${pkgs.libunistring}/lib/**,
-                r ${pkgs.libunistring}/share/**,
+                r ${pkgs.libunistring}/lib64/**,
                 x ${pkgs.libunistring}/foo/**,
+                ixr ${pkgs.glibc.libgcc}/libexec/**,
                 mr ${pkgs.glibc.libgcc}/lib/**.so*,
+                mr ${pkgs.glibc.libgcc}/lib64/**.so*,
+                mr ${pkgs.glibc.libgcc}/share/**,
                 r ${pkgs.glibc.libgcc},
                 r ${pkgs.glibc.libgcc}/etc/**,
                 r ${pkgs.glibc.libgcc}/lib/**,
-                r ${pkgs.glibc.libgcc}/share/**,
+                r ${pkgs.glibc.libgcc}/lib64/**,
                 x ${pkgs.glibc.libgcc}/foo/**,
               ''} ${
                 pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''

From e87b9b1f3e4c5d4587fd05f5b1213be74d904a42 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sun, 17 Nov 2024 18:27:49 +0100
Subject: [PATCH 4/5] nixos/apparmor: profile activation tristate and profile
 path support

---
 .../manual/release-notes/rl-2505.section.md   |  3 +
 nixos/modules/security/apparmor.nix           | 98 +++++++++++--------
 2 files changed, 61 insertions(+), 40 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 595b6af0e339d..7d01ab2a4c5c2 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -162,6 +162,9 @@
   | virtualBoxOVA            | virtualbox-vagrant.box                                     | nixos-image-vagrant-virtualbox-25.05pre-git-x86_64-linux.ova    |
   | vmwareImage              | nixos-25.05pre-git-x86_64-linux.vmdk                       | nixos-image-vmware-25.05pre-git-x86_64-linux.vmdk               |
 
+- `security.apparmor.policies.<name>.enforce` and `security.apparmor.policies.<name>.enable` were removed.
+  Configuring the state of apparmor policies must now be done using `security.apparmor.policies.<name>.state` tristate option.
+
 - the notmuch vim plugin now lives in a separate output of the `notmuch`
   package. Installing `notmuch` will not bring the notmuch vim package anymore,
   add `vimPlugins.notmuch-vim` to your (Neo)vim configuration if you want the
diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix
index 87dde1ad50a9d..a4c2f9e29fc34 100644
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@@ -5,24 +5,16 @@
   ...
 }:
 let
-  inherit (builtins)
-    attrNames
-    head
-    map
-    match
-    readFile
-    ;
   inherit (lib) types;
   inherit (config.environment) etc;
   cfg = config.security.apparmor;
-  mkDisableOption =
-    name:
-    lib.mkEnableOption name
-    // {
-      default = true;
-      example = false;
-    };
-  enabledPolicies = lib.filterAttrs (n: p: p.enable) cfg.policies;
+  enabledPolicies = lib.filterAttrs (n: p: p.state != "disable") cfg.policies;
+  buildPolicyPath = n: p: lib.defaultTo (pkgs.writeText n p.profile) p.path;
+
+  # Accessing submodule options when not defined results in an error thunk rather than a regular option object
+  # We can emulate the behavior of `<option>.isDefined` by attempting to evaluate it instead
+  # This is required because getting isDefined on a submodule is not possible in global module asserts.
+  submoduleOptionIsDefined = value: (builtins.tryEval value).success;
 in
 
 {
@@ -31,7 +23,7 @@ in
       "security"
       "apparmor"
       "confineSUIDApplications"
-    ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
+    ] "Please use the new options: `security.apparmor.policies.<policy>.state'.")
     (lib.mkRemovedOptionModule [
       "security"
       "apparmor"
@@ -65,20 +57,32 @@ in
           AppArmor policies.
         '';
         type = types.attrsOf (
-          types.submodule (
-            { name, config, ... }:
-            {
-              options = {
-                enable = mkDisableOption "loading of the profile into the kernel";
-                enforce = mkDisableOption "enforcing of the policy or only complain in the logs";
-                profile = lib.mkOption {
-                  description = "The policy of the profile.";
-                  type = types.lines;
-                  apply = pkgs.writeText name;
-                };
+          types.submodule {
+            options = {
+              state = lib.mkOption {
+                description = "How strictly this policy should be enforced";
+                type = types.enum [
+                  "disable"
+                  "complain"
+                  "enforce"
+                ];
+                # should enforce really be the default?
+                # the docs state that this should only be used once one is REALLY sure nothing's gonna break
+                default = "enforce";
+              };
+
+              profile = lib.mkOption {
+                description = "The profile file contents. Incompatible with path.";
+                type = types.lines;
+              };
+
+              path = lib.mkOption {
+                description = "A path of a profile file to include. Incompatible with profile.";
+                type = types.nullOr types.path;
+                default = null;
               };
-            }
-          )
+            };
+          }
         );
         default = { };
       };
@@ -117,12 +121,20 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = map (policy: {
-      assertion = match ".*/.*" policy == null;
-      message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";
-      # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
-      # which does not recurse into sub-directories.
-    }) (attrNames cfg.policies);
+    assertions = lib.concatLists (
+      lib.mapAttrsToList (policyName: policyCfg: [
+        {
+          assertion = builtins.match ".*/.*" policyName == null;
+          message = "`security.apparmor.policies.\"${policyName}\"' must not contain a slash.";
+          # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
+          # which does not recurse into sub-directories.
+        }
+        {
+          assertion = lib.xor (policyCfg.path != null) (submoduleOptionIsDefined policyCfg.profile);
+          message = "`security.apparmor.policies.\"${policyName}\"` must define exactly one of either path or profile.";
+        }
+      ]) cfg.policies
+    );
 
     environment.systemPackages = [
       pkgs.apparmor-utils
@@ -133,7 +145,7 @@ in
       # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*
       lib.mapAttrsToList (name: p: {
         inherit name;
-        path = p.profile;
+        path = buildPolicyPath name p;
       }) enabledPolicies
       ++ lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
     );
@@ -226,21 +238,24 @@ in
             kill
           '';
           commonOpts =
-            p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";
+            n: p:
+            "--verbose --show-cache ${
+              lib.optionalString (p.state == "complain") "--complain "
+            }${buildPolicyPath n p}";
         in
         {
           Type = "oneshot";
           RemainAfterExit = "yes";
           ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
           ExecStart = lib.mapAttrsToList (
-            n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}"
+            n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts n p}"
           ) enabledPolicies;
           ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
           ExecReload =
             # Add or replace into the kernel profiles in enabledPolicies
             # (because AppArmor can do that without stopping the processes already confined).
             lib.mapAttrsToList (
-              n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}"
+              n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts n p}"
             ) enabledPolicies
             ++
               # Remove from the kernel any profile whose name is not
@@ -262,5 +277,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ julm grimmauld ];
+  meta.maintainers = with lib.maintainers; [
+    julm
+    grimmauld
+  ];
 }

From b27f064b5418e225fde186033bbb0c8616bee7c5 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 3 Dec 2024 22:18:24 +0100
Subject: [PATCH 5/5] nixos/tests/apparmor: move to folder, refactor, improve
 coverage

- nixfmt on apparmor test
- move apparmor test to nixos/tests/apparmor directory
- expected profile contents are now generated in its own file to make the test file less confusing and hard to maintain
- enforce/complain is now being tested via diff of expected against aa-status
- path is now tested against diff+file checking symlink target of /etc/static/apparmor.d/<name>
- profile is now checked by diff of /etc/static/apparmor.d/<name> against original string added in nix config
- test still successfully passes
- added test for confined hello to succeed
- added test for confined hexdump on denied path to fail
---
 nixos/tests/all-tests.nix                     |   2 +-
 nixos/tests/apparmor.nix                      | 118 ----------------
 nixos/tests/apparmor/default.nix              | 130 ++++++++++++++++++
 nixos/tests/apparmor/makeExpectedPolicies.nix |  66 +++++++++
 nixos/tests/apparmor/sl_profile               |   5 +
 5 files changed, 202 insertions(+), 119 deletions(-)
 delete mode 100644 nixos/tests/apparmor.nix
 create mode 100644 nixos/tests/apparmor/default.nix
 create mode 100644 nixos/tests/apparmor/makeExpectedPolicies.nix
 create mode 100644 nixos/tests/apparmor/sl_profile

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 74d98935e54db..2876a783d7d8a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -131,7 +131,7 @@ in {
   apfs = runTest ./apfs.nix;
   appliance-repart-image = runTest ./appliance-repart-image.nix;
   appliance-repart-image-verity-store = runTest ./appliance-repart-image-verity-store.nix;
-  apparmor = handleTest ./apparmor.nix {};
+  apparmor = handleTest ./apparmor {};
   archi = handleTest ./archi.nix {};
   aria2 = handleTest ./aria2.nix {};
   armagetronad = handleTest ./armagetronad.nix {};
diff --git a/nixos/tests/apparmor.nix b/nixos/tests/apparmor.nix
deleted file mode 100644
index fad0e31bfffd1..0000000000000
--- a/nixos/tests/apparmor.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "apparmor";
-    meta.maintainers = with lib.maintainers; [
-      julm
-      grimmauld
-    ];
-
-    nodes.machine =
-      {
-        lib,
-        pkgs,
-        config,
-        ...
-      }:
-      {
-        security.apparmor.enable = lib.mkDefault true;
-      };
-
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-
-      with subtest("AppArmor profiles are loaded"):
-          machine.succeed("systemctl status apparmor.service")
-
-      # AppArmor securityfs
-      with subtest("AppArmor securityfs is mounted"):
-          machine.succeed("mountpoint -q /sys/kernel/security")
-          machine.succeed("cat /sys/kernel/security/apparmor/profiles")
-
-      # Test apparmorRulesFromClosure by:
-      # 1. Prepending a string of the relevant packages' name and version on each line.
-      # 2. Sorting according to those strings.
-      # 3. Removing those prepended strings.
-      # 4. Using `diff` against the expected output.
-      with subtest("apparmorRulesFromClosure"):
-          machine.succeed(
-              "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''
-                ixr ${pkgs.bash}/libexec/**,
-                mr ${pkgs.bash}/lib/**.so*,
-                mr ${pkgs.bash}/lib64/**.so*,
-                mr ${pkgs.bash}/share/**,
-                r ${pkgs.bash},
-                r ${pkgs.bash}/etc/**,
-                r ${pkgs.bash}/lib/**,
-                r ${pkgs.bash}/lib64/**,
-                x ${pkgs.bash}/foo/**,
-                ixr ${pkgs.glibc}/libexec/**,
-                mr ${pkgs.glibc}/lib/**.so*,
-                mr ${pkgs.glibc}/lib64/**.so*,
-                mr ${pkgs.glibc}/share/**,
-                r ${pkgs.glibc},
-                r ${pkgs.glibc}/etc/**,
-                r ${pkgs.glibc}/lib/**,
-                r ${pkgs.glibc}/lib64/**,
-                x ${pkgs.glibc}/foo/**,
-                ixr ${pkgs.libcap}/libexec/**,
-                mr ${pkgs.libcap}/lib/**.so*,
-                mr ${pkgs.libcap}/lib64/**.so*,
-                mr ${pkgs.libcap}/share/**,
-                r ${pkgs.libcap},
-                r ${pkgs.libcap}/etc/**,
-                r ${pkgs.libcap}/lib/**,
-                r ${pkgs.libcap}/lib64/**,
-                x ${pkgs.libcap}/foo/**,
-                ixr ${pkgs.libcap.lib}/libexec/**,
-                mr ${pkgs.libcap.lib}/lib/**.so*,
-                mr ${pkgs.libcap.lib}/lib64/**.so*,
-                mr ${pkgs.libcap.lib}/share/**,
-                r ${pkgs.libcap.lib},
-                r ${pkgs.libcap.lib}/etc/**,
-                r ${pkgs.libcap.lib}/lib/**,
-                r ${pkgs.libcap.lib}/lib64/**,
-                x ${pkgs.libcap.lib}/foo/**,
-                ixr ${pkgs.libidn2.out}/libexec/**,
-                mr ${pkgs.libidn2.out}/lib/**.so*,
-                mr ${pkgs.libidn2.out}/lib64/**.so*,
-                mr ${pkgs.libidn2.out}/share/**,
-                r ${pkgs.libidn2.out},
-                r ${pkgs.libidn2.out}/etc/**,
-                r ${pkgs.libidn2.out}/lib/**,
-                r ${pkgs.libidn2.out}/lib64/**,
-                x ${pkgs.libidn2.out}/foo/**,
-                ixr ${pkgs.libunistring}/libexec/**,
-                mr ${pkgs.libunistring}/lib/**.so*,
-                mr ${pkgs.libunistring}/lib64/**.so*,
-                mr ${pkgs.libunistring}/share/**,
-                r ${pkgs.libunistring},
-                r ${pkgs.libunistring}/etc/**,
-                r ${pkgs.libunistring}/lib/**,
-                r ${pkgs.libunistring}/lib64/**,
-                x ${pkgs.libunistring}/foo/**,
-                ixr ${pkgs.glibc.libgcc}/libexec/**,
-                mr ${pkgs.glibc.libgcc}/lib/**.so*,
-                mr ${pkgs.glibc.libgcc}/lib64/**.so*,
-                mr ${pkgs.glibc.libgcc}/share/**,
-                r ${pkgs.glibc.libgcc},
-                r ${pkgs.glibc.libgcc}/etc/**,
-                r ${pkgs.glibc.libgcc}/lib/**,
-                r ${pkgs.glibc.libgcc}/lib64/**,
-                x ${pkgs.glibc.libgcc}/foo/**,
-              ''} ${
-                pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
-                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
-                    pkgs.apparmorRulesFromClosure {
-                      name = "ping";
-                      additionalRules = [ "x $path/foo/**" ];
-                    } [ pkgs.libcap ]
-                  } |
-                  ${pkgs.coreutils}/bin/sort -n -k1 |
-                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ::' >$out
-                ''
-              }"
-          )
-    '';
-  }
-)
diff --git a/nixos/tests/apparmor/default.nix b/nixos/tests/apparmor/default.nix
new file mode 100644
index 0000000000000..c618cabf5184c
--- /dev/null
+++ b/nixos/tests/apparmor/default.nix
@@ -0,0 +1,130 @@
+import ../make-test-python.nix (
+  { pkgs, lib, ... }:
+  let
+    helloProfileContents = ''
+      abi <abi/4.0>,
+      include <tunables/global>
+      profile hello ${lib.getExe pkgs.hello} {
+        include <abstractions/base>
+      }
+    '';
+  in
+  {
+    name = "apparmor";
+    meta.maintainers = with lib.maintainers; [
+      julm
+      grimmauld
+    ];
+
+    nodes.machine =
+      {
+        lib,
+        pkgs,
+        config,
+        ...
+      }:
+      {
+        security.apparmor = {
+          enable = lib.mkDefault true;
+
+          policies.hello = {
+            # test profile enforce and content definition
+            state = "enforce";
+            profile = helloProfileContents;
+          };
+
+          policies.sl = {
+            # test profile complain and path definition
+            state = "complain";
+            path = ./sl_profile;
+          };
+
+          policies.hexdump = {
+            # test profile complain and path definition
+            state = "enforce";
+            profile = ''
+              abi <abi/4.0>,
+              include <tunables/global>
+              profile hexdump /nix/store/*/bin/hexdump {
+                include <abstractions/base>
+                deny /tmp/** r,
+              }
+            '';
+          };
+
+          includes."abstractions/base" = ''
+            /nix/store/*/bin/** mr,
+            /nix/store/*/lib/** mr,
+            /nix/store/** r,
+          '';
+        };
+      };
+
+    testScript =
+      let
+        inherit (lib) getExe getExe';
+      in
+      ''
+        machine.wait_for_unit("multi-user.target")
+
+        with subtest("AppArmor profiles are loaded"):
+            machine.succeed("systemctl status apparmor.service")
+
+        # AppArmor securityfs
+        with subtest("AppArmor securityfs is mounted"):
+            machine.succeed("mountpoint -q /sys/kernel/security")
+            machine.succeed("cat /sys/kernel/security/apparmor/profiles")
+
+        # Test apparmorRulesFromClosure by:
+        # 1. Prepending a string of the relevant packages' name and version on each line.
+        # 2. Sorting according to those strings.
+        # 3. Removing those prepended strings.
+        # 4. Using `diff` against the expected output.
+        with subtest("apparmorRulesFromClosure"):
+            machine.succeed(
+                "${getExe' pkgs.diffutils "diff"} -u ${
+                  pkgs.writeText "expected.rules" (import ./makeExpectedPolicies.nix { inherit pkgs; })
+                } ${
+                  pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
+                    ${getExe pkgs.gnused} -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
+                      pkgs.apparmorRulesFromClosure {
+                        name = "ping";
+                        additionalRules = [ "x $path/foo/**" ];
+                      } [ pkgs.libcap ]
+                    } |
+                    ${getExe' pkgs.coreutils "sort"} -n -k1 |
+                    ${getExe pkgs.gnused} -e 's:^[^ ]* ::' >$out
+                  ''
+                }"
+            )
+
+        # Test apparmor profile states by using `diff` against `aa-status`
+        with subtest("apparmorProfileStates"):
+            machine.succeed("${getExe' pkgs.diffutils "diff"} -u \
+              <(${getExe' pkgs.apparmor-bin-utils "aa-status"} --json | ${getExe pkgs.jq} --sort-keys . ) \
+              <(${getExe pkgs.jq} --sort-keys . ${
+                pkgs.writers.writeJSON "expectedStates.json" {
+                  version = "2";
+                  processes = { };
+                  profiles = {
+                    hexdump = "enforce";
+                    hello = "enforce";
+                    sl = "complain";
+                  };
+                }
+              })")
+
+        # Test apparmor profile files in /etc/apparmor.d/<name> to be either a correct symlink (sl) or have the right file contents (hello)
+        with subtest("apparmorProfileTargets"):
+            machine.succeed("${getExe' pkgs.diffutils "diff"} -u <(${getExe pkgs.file} /etc/static/apparmor.d/sl) ${pkgs.writeText "expected.link" ''
+              /etc/static/apparmor.d/sl: symbolic link to ${./sl_profile}
+            ''}")
+            machine.succeed("${getExe' pkgs.diffutils "diff"} -u /etc/static/apparmor.d/hello ${pkgs.writeText "expected.content" helloProfileContents}")
+
+
+        with subtest("apparmorProfileEnforce"):
+            machine.succeed("${getExe pkgs.hello} 1> /tmp/test-file")
+            machine.fail("${lib.getExe' pkgs.util-linux "hexdump"} /tmp/test-file") # no access to /tmp/test-file granted by apparmor
+      '';
+  }
+)
diff --git a/nixos/tests/apparmor/makeExpectedPolicies.nix b/nixos/tests/apparmor/makeExpectedPolicies.nix
new file mode 100644
index 0000000000000..0d9238b685306
--- /dev/null
+++ b/nixos/tests/apparmor/makeExpectedPolicies.nix
@@ -0,0 +1,66 @@
+{ pkgs }:
+''
+  ixr ${pkgs.bash}/libexec/**,
+  mr ${pkgs.bash}/lib/**.so*,
+  mr ${pkgs.bash}/lib64/**.so*,
+  mr ${pkgs.bash}/share/**,
+  r ${pkgs.bash},
+  r ${pkgs.bash}/etc/**,
+  r ${pkgs.bash}/lib/**,
+  r ${pkgs.bash}/lib64/**,
+  x ${pkgs.bash}/foo/**,
+  ixr ${pkgs.glibc}/libexec/**,
+  mr ${pkgs.glibc}/lib/**.so*,
+  mr ${pkgs.glibc}/lib64/**.so*,
+  mr ${pkgs.glibc}/share/**,
+  r ${pkgs.glibc},
+  r ${pkgs.glibc}/etc/**,
+  r ${pkgs.glibc}/lib/**,
+  r ${pkgs.glibc}/lib64/**,
+  x ${pkgs.glibc}/foo/**,
+  ixr ${pkgs.libcap}/libexec/**,
+  mr ${pkgs.libcap}/lib/**.so*,
+  mr ${pkgs.libcap}/lib64/**.so*,
+  mr ${pkgs.libcap}/share/**,
+  r ${pkgs.libcap},
+  r ${pkgs.libcap}/etc/**,
+  r ${pkgs.libcap}/lib/**,
+  r ${pkgs.libcap}/lib64/**,
+  x ${pkgs.libcap}/foo/**,
+  ixr ${pkgs.libcap.lib}/libexec/**,
+  mr ${pkgs.libcap.lib}/lib/**.so*,
+  mr ${pkgs.libcap.lib}/lib64/**.so*,
+  mr ${pkgs.libcap.lib}/share/**,
+  r ${pkgs.libcap.lib},
+  r ${pkgs.libcap.lib}/etc/**,
+  r ${pkgs.libcap.lib}/lib/**,
+  r ${pkgs.libcap.lib}/lib64/**,
+  x ${pkgs.libcap.lib}/foo/**,
+  ixr ${pkgs.libidn2.out}/libexec/**,
+  mr ${pkgs.libidn2.out}/lib/**.so*,
+  mr ${pkgs.libidn2.out}/lib64/**.so*,
+  mr ${pkgs.libidn2.out}/share/**,
+  r ${pkgs.libidn2.out},
+  r ${pkgs.libidn2.out}/etc/**,
+  r ${pkgs.libidn2.out}/lib/**,
+  r ${pkgs.libidn2.out}/lib64/**,
+  x ${pkgs.libidn2.out}/foo/**,
+  ixr ${pkgs.libunistring}/libexec/**,
+  mr ${pkgs.libunistring}/lib/**.so*,
+  mr ${pkgs.libunistring}/lib64/**.so*,
+  mr ${pkgs.libunistring}/share/**,
+  r ${pkgs.libunistring},
+  r ${pkgs.libunistring}/etc/**,
+  r ${pkgs.libunistring}/lib/**,
+  r ${pkgs.libunistring}/lib64/**,
+  x ${pkgs.libunistring}/foo/**,
+  ixr ${pkgs.glibc.libgcc}/libexec/**,
+  mr ${pkgs.glibc.libgcc}/lib/**.so*,
+  mr ${pkgs.glibc.libgcc}/lib64/**.so*,
+  mr ${pkgs.glibc.libgcc}/share/**,
+  r ${pkgs.glibc.libgcc},
+  r ${pkgs.glibc.libgcc}/etc/**,
+  r ${pkgs.glibc.libgcc}/lib/**,
+  r ${pkgs.glibc.libgcc}/lib64/**,
+  x ${pkgs.glibc.libgcc}/foo/**,
+''
diff --git a/nixos/tests/apparmor/sl_profile b/nixos/tests/apparmor/sl_profile
new file mode 100644
index 0000000000000..f37c80f8e0134
--- /dev/null
+++ b/nixos/tests/apparmor/sl_profile
@@ -0,0 +1,5 @@
+abi <abi/4.0>,
+include <tunables/global>
+profile sl /bin/sl {
+  include <abstractions/base>
+}