Grimmauld/grimm-nixos-laptop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix cyclic dependencies in sysd

Browse Source
This commit is contained in:
Grimmauld 2024-10-27 13:57:57 +01:00
parent ec80dc24fb
commit 48df7d2533
Signed by: Grimmauld
GPG Key ID: C2946668769F91FB
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
common/tooling/apparmor/aa-alias-module.nix
View File

@ -5,21 +5,29 @@
... ...
}: }:
let let
inherit (lib) getExe; inherit (lib) getExe mkIf;
aa-alias-manager = pkgs.callPackage ./aa-alias-manager-package.nix { }; aa-alias-manager = pkgs.callPackage ./aa-alias-manager-package.nix { };
alias_dir = "/run/aliases.d"; alias_dir = "/run/aliases.d";
in in
{ {
config = { config = mkIf config.security.apparmor.enable {
security.apparmor.includes."tunables/alias.d/store" = '' security.apparmor.includes."tunables/alias.d/store" = ''
include if exists "${alias_dir}" include if exists "${alias_dir}"
''; '';
systemd.services.aa-alias-setup = { systemd.services.aa-alias-setup = {
after = [ "local-fs.target" ];
before = [ "apparmor.service" ]; before = [ "apparmor.service" ];
requiredBy = [ "apparmor.service" ]; requiredBy = [ "apparmor.service" ];
path = [ config.nix.package ]; # respect the users choice to use alternative nix implementations path = [ config.nix.package ]; # respect the users choice to use alternative nix implementations
unitConfig = {
Description = "Initialize alias rules required for AppArmor policies";
DefaultDependencies = "no";
ConditionSecurity = "apparmor";
};
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
ExecStart = "${getExe aa-alias-manager} -o ${alias_dir} -p ${./aa-alias-patterns.json}"; ExecStart = "${getExe aa-alias-manager} -o ${alias_dir} -p ${./aa-alias-patterns.json}";