nixos/apparmor: Format

nixos/modules/security/apparmor.nix

@@ -1,10 +1,24 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-  inherit (builtins) attrNames head map match readFile;
+  inherit (builtins)
+    attrNames
+    head
+    map
+    match
+    readFile
+    ;
   inherit (lib) types;
   inherit (config.environment) etc;
   cfg = config.security.apparmor;
-  mkDisableOption = name: lib.mkEnableOption name // {
+  mkDisableOption =
+    name:
+    lib.mkEnableOption name
+    // {
       default = true;
       example = false;
     };
@@ -13,8 +27,16 @@ in
 
 {
   imports = [
-    (lib.mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
+    (lib.mkRemovedOptionModule [
-    (lib.mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")
+      "security"
+      "apparmor"
+      "confineSUIDApplications"
+    ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
+    (lib.mkRemovedOptionModule [
+      "security"
+      "apparmor"
+      "profiles"
+    ] "Please use the new option: `security.apparmor.policies'.")
     apparmor/includes.nix
     apparmor/profiles.nix
   ];
@@ -42,7 +64,10 @@ in
         description = ''
           AppArmor policies.
         '';
-        type = types.attrsOf (types.submodule ({ name, config, ... }: {
+        type = types.attrsOf (
+          types.submodule (
+            { name, config, ... }:
+            {
               options = {
                 enable = mkDisableOption "loading of the profile into the kernel";
                 enforce = mkDisableOption "enforcing of the policy or only complain in the logs";
@@ -52,12 +77,14 @@ in
                   apply = pkgs.writeText name;
                 };
               };
-        }));
+            }
-        default = {};
+          )
+        );
+        default = { };
       };
       includes = lib.mkOption {
         type = types.attrsOf types.lines;
-        default = {};
+        default = { };
         description = ''
           List of paths to be added to AppArmor's searched paths
           when resolving `include` directives.
@@ -66,7 +93,7 @@ in
       };
       packages = lib.mkOption {
         type = types.listOf types.package;
-        default = [];
+        default = [ ];
         description = "List of packages to be added to AppArmor's include path";
       };
       enableCache = lib.mkEnableOption ''
@@ -90,13 +117,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = map (policy:
+    assertions = map (policy: {
-      { assertion = match ".*/.*" policy == null;
+      assertion = match ".*/.*" policy == null;
       message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";
       # Because, for instance, aa-remove-unknown uses profiles_names_list() in rc.apparmor.functions
       # which does not recurse into sub-directories.
-      }
+    }) (attrNames cfg.policies);
-    ) (attrNames cfg.policies);
 
     environment.systemPackages = [
       pkgs.apparmor-utils
@@ -105,21 +131,26 @@ in
     environment.etc."apparmor.d".source = pkgs.linkFarm "apparmor.d" (
       # It's important to put only enabledPolicies here and not all cfg.policies
       # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*
-      lib.mapAttrsToList (name: p: { inherit name; path = p.profile; }) enabledPolicies ++
+      lib.mapAttrsToList (name: p: {
-      lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
+        inherit name;
+        path = p.profile;
+      }) enabledPolicies
+      ++ lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
     );
-    environment.etc."apparmor/parser.conf".text = ''
+    environment.etc."apparmor/parser.conf".text =
+      ''
         ${if cfg.enableCache then "write-cache" else "skip-cache"}
         cache-loc /var/cache/apparmor
         Include /etc/apparmor.d
-      '' +
+      ''
-      lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
+      + lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
     # For aa-logprof
-    environment.etc."apparmor/apparmor.conf".text = ''
+    environment.etc."apparmor/apparmor.conf".text = '''';
-    '';
     # For aa-logprof
     environment.etc."apparmor/severity.db".source = pkgs.apparmor-utils + "/etc/apparmor/severity.db";
-    environment.etc."apparmor/logprof.conf".source = pkgs.runCommand "logprof.conf" {
+    environment.etc."apparmor/logprof.conf".source =
+      pkgs.runCommand "logprof.conf"
+        {
           header = ''
             [settings]
               # /etc/apparmor.d/ is read-only on NixOS
@@ -139,7 +170,9 @@ in
               # 3 - force all perms on the rule to be user
               default_owner_prompt = 1
 
-          custom_includes = /etc/apparmor.d ${lib.concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}
+              custom_includes = /etc/apparmor.d ${
+                lib.concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages
+              }
 
             [qualifiers]
               ${pkgs.runtimeShell} = icnu
@@ -149,23 +182,30 @@ in
           '';
           footer = "${pkgs.apparmor-utils}/etc/apparmor/logprof.conf";
           passAsFile = [ "header" ];
-    } ''
+        }
+        ''
           cp $headerPath $out
           sed '1,/\[qualifiers\]/d' $footer >> $out
         '';
 
-    boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+    boot.kernelParams = [
+      "apparmor=1"
+      "security=apparmor"
+    ];
 
     systemd.services.apparmor = {
       after = [
         "local-fs.target"
         "systemd-journald-audit.socket"
       ];
-      before = [ "sysinit.target" "shutdown.target" ];
+      before = [
+        "sysinit.target"
+        "shutdown.target"
+      ];
       conflicts = [ "shutdown.target" ];
       wantedBy = [ "multi-user.target" ];
       unitConfig = {
-        Description="Load AppArmor policies";
+        Description = "Load AppArmor policies";
         DefaultDependencies = "no";
         ConditionSecurity = "apparmor";
       };
@@ -176,7 +216,8 @@ in
         etc."apparmor/parser.conf".source
         etc."apparmor.d".source
       ];
-      serviceConfig = let
+      serviceConfig =
+        let
           killUnconfinedConfinables = pkgs.writeShellScript "apparmor-kill" ''
             set -eu
             ${pkgs.apparmor-bin-utils}/bin/aa-status --json |
@@ -184,27 +225,38 @@ in
             xargs --verbose --no-run-if-empty --delimiter='\n' \
             kill
           '';
-        commonOpts = p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";
+          commonOpts =
-        in {
+            p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";
+        in
+        {
           Type = "oneshot";
           RemainAfterExit = "yes";
           ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
-        ExecStart = lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;
+          ExecStart = lib.mapAttrsToList (
+            n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}"
+          ) enabledPolicies;
           ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
           ExecReload =
             # Add or replace into the kernel profiles in enabledPolicies
             # (because AppArmor can do that without stopping the processes already confined).
-          lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++
+            lib.mapAttrsToList (
+              n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}"
+            ) enabledPolicies
+            ++
               # Remove from the kernel any profile whose name is not
               # one of the names within the content of the profiles in enabledPolicies
               # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).
               # Note that this does not remove profiles dynamically generated by libvirt.
-          [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ] ++
+              [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ]
+            ++
               # Optionally kill the processes which are unconfined but now have a profile loaded
               # (because AppArmor can only start to confine new processes).
               lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
           ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
-        CacheDirectory = [ "apparmor" "apparmor/logprof" ];
+          CacheDirectory = [
+            "apparmor"
+            "apparmor/logprof"
+          ];
           CacheDirectoryMode = "0700";
         };
     };