fix all apparmor profiles just being complain mode

common/tooling/apparmor/apparmor-d-module.nix

@@ -5,65 +5,30 @@
   ...
 }:
 let
-  inherit (lib) mkIf mergeAttrsList last path;
+  inherit (lib) mkIf mapAttrs;
 
   cfg = config.security.apparmor_d;
   apparmor-d = pkgs.callPackage ./apparmor-d-package.nix {};
   in
 {
-  options.security.apparmor_d = with lib; let 
+  options.security.apparmor_d = with lib; {
-    profile = types.submodule ({ config, ... }: {
-      options = {
-      enable = mkOption {
-        type = types.bool;
-        default = true;
-        description = "whether to enable this profile";
-      };
-
-      enforce = mkOption {
-        type = types.bool;
-        default = true;
-        description = "whether to enforce this profile";
-      };
-
-      name = mkOption {
-        type = types.nonEmptyStr;
-        description = "name of the apparmor profile within apparmor.d";
-        example = "vesktop";
-      };
-      };
-    });
-  in {
     enable = mkEnableOption "enable apparmor.d support";
 
     profiles = mkOption {
-      type = types.listOf (types.either types.nonEmptyStr profile);
+      type = types.attrsOf (types.enum [ "disable" "complain" "enforce" ]);
-      default = [];
+      default = {};
       description = "set of apparmor profiles to include from apparmor.d";
     };
   };
 
-  options.test = lib.mkOption { default = null; };
-  
   config = mkIf (cfg.enable) {
     security.apparmor.packages = [ apparmor-d ];
-    security.apparmor.policies = mergeAttrsList (map (p: if (builtins.isString p) then {
+    security.apparmor.policies = mapAttrs (name: value: {
-      "${p}" = {
+      enable = value != "disable";
-        enable = true;
+      enforce = value == "enforce";
-        enforce = true;
+      profile = ''include "${apparmor-d}/etc/apparmor.d/${name}"'';
-        profile = ''
+    }) cfg.profiles;
-          include "${apparmor-d}/etc/apparmor.d/${p}"
+    
-        '';
-      };
-    } else {
-      ${p.name} = {
-        inherit (p) enable enforce;
-        profile = ''
-          include "${apparmor-d}/etc/apparmor.d/${p.name}"
-        '';
-      };
-    }) cfg.profiles );
-
     environment.systemPackages = [ apparmor-d ];
   };
 }

common/tooling/apparmor/apparmor-d-package.nix

@@ -29,7 +29,7 @@ buildGoModule {
   postInstall = ''
     mkdir -p $out/etc
     
-    DISTRIBUTION=arch $out/bin/prebuild --complain --abi 4 # fixme: replace with nixos support once available
+    DISTRIBUTION=arch $out/bin/prebuild --abi 4 # fixme: replace with nixos support once available
     
     mv .build/apparmor.d $out/etc
     rm $out/bin/prebuild

common/tooling/apparmor/default.nix

@@ -20,42 +20,23 @@ in
 
     security.apparmor_d = {
       enable = true;
-      profiles = [
+      profiles = {
-        "vesktop"
+        vesktop = "enforce";
-        "speech-dispatcher"
+        speech-dispatcher = "enforce";
-        "thunderbird-glxtest"
+        thunderbird-glxtest = "enforce";
-        # "firefox"
+        "firefox.apparmor.d" = "enforce";
-        "firefox.apparmor.d"
+        pass = "enforce";
-        "pass"
+        spotify = "enforce";
-        "spotify"
+        "thunderbird.apparmor.d" = "enforce";
-        # "thunderbird"
+        xdg-open = "enforce";
-        "thunderbird.apparmor.d"
+        child-open-any = "enforce";
-        "xdg-open"
+        child-open = "enforce";
-        "child-open-any"
+        firefox-glxtest = "enforce";
-        "child-open"
+        gamemoded = "disable";
-        "firefox-glxtest"
+        pkexec = "disable";
-#      {
+        xdg-mime = "complain";
-#        enable = true;
+        mimetype = "complain";    
-#        enforce = true;
+      };
-#        name = "gamemoded";
-#      };
-        {
-          enable = false;
-          enforce = false;
-          # somehow this has conflicting imports and i have no clue how to fix it
-          name = "pkexec";
-        }
-        {
-          enable = true;
-          enforce = false;
-          name = "xdg-mime";
-        }
-        {
-          enable = true;
-          enforce = false;
-          name = "mimetype";
-        }      
-      ];
     };
     
 
@@ -168,6 +149,7 @@ in
             ${getExe pkgs.bubblewrap} rix,
             /nix/store/*-osu-lazer-bin-*-bwrap ix,
             /nix/store/*-osu-lazer-bin-*-init ix,
+            /nix/store/*-container-init ix,
             /nix/store/*-osu-lazer-bin-*-extracted/** rk,
             /nix/store/*-osu-lazer-bin-*-extracted/AppRun ix,
             /nix/store/*-osu-lazer-bin-*-extracted/usr/bin/** ix,