tribes/guix
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/guix.git synced 2026-04-06 21:20:33 +02:00
Code Activity

etc: Add AppArmor profile for the guix command.

Browse Source 
* etc/apparmor.d/guix: New file.
* Makefile.am (nodist_apparmor_profile_DATA): Add it.

Change-Id: I3d61238203d7663ce582717f8e4eac4c6f679928
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
This commit is contained in:
Noé Lopez
2025-12-15 01:03:36 +01:00
committed by Rutherther
parent 587fd2dad4
commit 60782c20d4
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
etc/apparmor.d/guix Normal file
View File

@@ -0,0 +1,12 @@
abi <abi/4.0>,
include <tunables/global>
include <tunables/guix>
# There’s no point in confining the guix executable, since it can run
# any user code and so everything is expected. We just need to
# explicitely enable userns for systems with the
# kernel.apparmor_restrict_unprivileged_userns sysctl.
profile guix @{guix_storedir}/{*-guix-command,*-guix-*/bin/guix} flags=(unconfined) {
userns,
}