AppArmor on NixOS Roadmap

Grimmauld · April 21, 2025, 1:05pm

I have opened a PR updating apparmor to the recently released 4.1.0.

github.com/NixOS/nixpkgs

apparmor: 4.0.3 -> 4.1.0, rewrite

NixOS:staging ← LordGrimmauld:apparmor-update

opened 01:03AM - 21 Apr 25 UTC

LordGrimmauld

+519 -475

Upstream release: https://gitlab.com/apparmor/apparmor/-/releases/v4.1.0 Nota…ble changes made to the packaging: - apparmor-kernel-patches: drop. This was outdated and unused, and wouldn't even apply to any kernel anymore. - aa-teardown: migrate to writeShellAPplication - apparmor-*: migrate to by-name - apparmor-*: enable checks and actually run checks - libapparmor: test python module imports correctly - libapparmor: no seperate $python output (makes no sense) This *should* be basically compatible with any preexisting setup using apparmor. I tried my best to keep ABI. ## Tested build types - [x] pkgsCross.gnu64.libapparmor (aarch64-linux builder) - [x] pkgsCross.gnu64.apparmor-* (aarch64-linux builder) - [x] pkgsCross.aarch64-multiplatform.libapparmor (x86_64-linux builder) - [x] pkgsMusl.libapparmor (x86_64-linux builder) - [x] pkgsMusl.apparmor-* (x86_64-linux builder) - [x] pkgsLLVM.libapparmor (x86_64-linux builder) This does unbreak a couple cross builds that were previously broken.  ## Things done - Built on platform(s) - [x] x86_64-linux - [x] aarch64-linux - [ ] x86_64-darwin - [ ] aarch64-darwin - For non-Linux: Is sandboxing enabled in `nix.conf`? (See [Nix manual](https://nixos.org/manual/nix/stable/command-ref/conf-file.html)) - [ ] `sandbox = relaxed` - [ ] `sandbox = true` - [x] Tested, as applicable: - [NixOS test(s)](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests)) - and/or [package tests](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests) - or, for functions and "core" functionality, tests in [lib/tests](https://github.com/NixOS/nixpkgs/blob/master/lib/tests) or [pkgs/test](https://github.com/NixOS/nixpkgs/blob/master/pkgs/test) - made sure NixOS tests are [linked](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#linking-nixos-module-tests-to-a-package) to the relevant packages - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage) - [x] Tested basic functionality of all binary files (usually in `./result/bin/`) - [25.05 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2505.section.md) (or backporting [24.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2411.section.md) and [25.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2505.section.md) Release notes) - [ ] (Package updates) Added a release notes entry if the change is major or breaking - [ ] (Module updates) Added a release notes entry if the change is significant - [ ] (Module addition) Added a release notes entry if adding a new NixOS module - [x] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).  --- Add a :+1: [reaction] to [pull requests you find important]. [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/ [pull requests you find important]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc

This includes a complete rewrite of the packaging, as well as making all apparmor packages work with pkgsLLVM, pkgsMusl, and pkgsCross. Reviews are appreciated.