SELinux on NixOS

What does that even gain? Almost nothing uses /run/current-system. Except for maybe the interactive shell and optional dependencies on binaries.

Everywhere in nixos we prefer to refer to store paths directly instead. E.g. for shell scripts we rewrite shebangs automatically to refer to nix store paths. Same for basically everything everywhere. Same for execstart lines for systemd units. Most things work without being in environment.systemPackages and id like to keep it that way.

I think we should focus on AppArmor on NixOS Roadmap - #12 by Atemu instead as the solution for MAC on nixos. I dont think the SELinux route is going to end anywhere.

5 Likes