Can nix and guix be supported?

[amano-kenji]

I don't know the details, but the directory layout of nix and guix seems difficult for apparmor profiles.

[roddhjav]

AppArmor is supported in nix (https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/apparmor.nix). Therefore I would say yes. The directory layout should only be a matter of setting some variable to nix structure.

Therefore, in theory, yes. However, I have not tested it.

[amano-kenji]

I don't really know how nixos works, but it seems nixos has its own apparmor profiles. Guix system doesn't have its own apparmor profiles.

The exec paths in this repository cannot work on guix system.

So, guix system is supposed to provide apparmor profiles on its own?

[roddhjav]

it seems nixos has its own apparmor profiles.

They don't. They simply provide some definition to make the profiles works in they own file hierarchy:

https://github.com/NixOS/nixpkgs/blob/01bb58e3dede98f0b0c28645a97f14aca695ce56/nixos/modules/security/apparmor/includes.nix#L27

That should be all you have to do to make this project work with nix/guix.

[amano-kenji]

/run/current-system seems to be the equivalent to guix profile. Guix profile contains installed packages and propagated dependencies. If an apparmor profile needs paths to other dependencies, those dependencies are in /gnu/store/xxxxxx-package-name-ver/{etc,bin}/...

Perhaps, guix may have to calculate multiple aliases for /bin, /sbin/, etc, ... for each application?

[roddhjav]

Thanks to @LordGrimmauld NixOs will have support for apparmor.d and a better support for apparmor in general.

See the development blog posts:

1. AppArmor and apparmor.d on NixOS
2. The Glob is dead, long live the alias! - AppArmor on NixOS Part 2

[LordGrimmauld]

Some pointers/specifications to where i am stuck right now:
I am currently indeed working on better integration in nixos for apparmor rules.

To alias a bunch of store paths, i wrote an alias manager: https://github.com/LordGrimmauld/aa-alias-manager
A similar idea can work on guix. However, be advised apparmor itself currently faces significant performance issues with mass aliasing. To get this issue fixed, i opened a report upstream, feel free to bump: https://gitlab.com/apparmor/apparmor/-/issues/460

As to nix, i just started (slowly) preparing to upstream my work in NixOS/nixpkgs#356796, to allow symlinking profiles rather than using the slow include directive of apparmor (or slow import from derivation via nix readFile). This one is however purely on the nix side, i am not familiar with guix.