Apparmor breaks SDDM

Help
1

I am setting up my system and have made a security.nix config file, with a bunch of stuff.

When enabling Apparmor there, SDDM does not launch anymore, instead I get into TTY.

### AppArmor
security.apparmor.enable = true;
# kill processes not confined with Apparmor, when a profile exists
# security.apparmor.killUnconfinedConfinables = true;
# mediation with dbus when not found
services.dbus.apparmor = "required";

Is SDDM ran as a sddm user or as root? This might be an issue and the former would be the recommended way. Not sure if this works as there is no sddm user declared in my config?

I will get logs and more tomorrow.

It might be the “kill unconfined confinables”? But this should be set I think.

NixOS 24.11

2

Should be sddm, see nixpkgs/nixos/modules/services/display-managers/sddm.nix at 05c5bdcc7864347c0b4cdb1fa0cdaefe2d143c43 · NixOS/nixpkgs · GitHub

1 Like
3

That was a long module, I didnt yet find the user. Does this mean the option enables the user on its own, and I dont need to change anything?

Also, are there other SDDM users with Apparmor enabled? Not having MAC is a pretty big issue

4

The user is created here nixpkgs/nixos/modules/services/display-managers/sddm.nix at 05c5bdcc7864347c0b4cdb1fa0cdaefe2d143c43 · NixOS/nixpkgs · GitHub

The user is already enabled and used per default.

I don’t have it enabled because there are barely any rules for it which makes it not very useful.

Not having MAC is a pretty big issue

MAC?

1 Like
5

MAC = Apparmor.
I wouldn’t say MAC is well-supported on NixOS atm, but Apparmor is more viable than SELinux.

1 Like
6

Depending on how big of an issue this (mandatory access control of some flavour) is you might want to run a different distro until support is further along. You can follow work on apparmor over in this thread: AppArmor on NixOS Roadmap

2 Likes
7

Asked myself same thing: Mandatory Access Control

8

Thanks! This is pretty crazy, as all major distros have SELinux or AppArmor setup.

I know that Fedoras rules for SELinux for example are not really strong, and all the user processes are completely unconfined. So the use of that MAC for a typical desktop system is pretty small.

Current sandboxing techniques like Flatpak (bubblewrap), bubblejail (not on nixpkgs yet) and others (fortify, minijail, go-judge, …) can be good as well.

9

I run apparmor and sddm together just fine. However, i only set services.dbus.apparmor = "enabled"; and run services.dbus.implementation = "broker";, not sure if this changes things.

My config:

1 Like
10

NixOS is mostly systemd services. As such it makes sense to use the systemd hardening for system components, as opposed to a more traditional MAC.

See also:

1 Like