movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos: transmission improvements

Browse source 
This mostly upgrades transmission, and does some very minor touchups on
AppArmor support.

In particular, there is now no need to ever specify the umask as part of
the settings, as it will be mixed in by default (which is essentially
always what you want). Also, the default configuration is now more
sensible: Downloads are put in /var/lib/transmission/Downloads, and
incomplete files are put in /var/lib/transmission/.incomplete - this
also allows easy use of file syncing probrams, like BitTorrent Sync.

Finally, this unconditionally enables the AppArmor profiles for the
daemon, if AppArmor is enabled - rather than letting the user specify
profile support, it's best to default to supporting profiles for daemons
transparently in all places.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
This commit is contained in:
Austin Seipp 2014-04-15 06:50:39 -05:00
parent 253f83ea2d
commit da6bc44dd7
2 changed files with 38 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

43
nixos/modules/security/apparmor.nix
View file

@ -1,55 +1,39 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.security.apparmor;
in
with lib;
{
###### interface
options = {
security.apparmor = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Enable AppArmor application security system. Enable only if
you want to further improve AppArmor.
'';
description = "Enable the AppArmor Mandatory Access Control system.";
};
profiles = mkOption {
type = types.listOf types.path;
default = [];
description = ''
List of file names of AppArmor profiles.
'';
description = "List of files containing AppArmor profiles.";
};
};
};
###### implementation
config = mkIf (cfg.enable) {
assertions = [ { assertion = config.boot.kernelPackages.kernel.features ? apparmor
&& config.boot.kernelPackages.kernel.features.apparmor;
message = "AppArmor is enabled, but the kernel doesn't have AppArmor support"; }
];
config = mkIf cfg.enable {
assertions =
[ { assertion = config.boot.kernelPackages.kernel.features ? apparmor
&& config.boot.kernelPackages.kernel.features.apparmor;
message = "Your selected kernel does not have AppArmor support";
}
];
environment.systemPackages = [ pkgs.apparmor ];
systemd.services.apparmor = {
#wantedBy = [ "basic.target" ];
wantedBy = [ "local-fs.target" ];
path = [ pkgs.apparmor ];
path = [ pkgs.apparmor ];
serviceConfig = {
Type = "oneshot";
@ -61,9 +45,6 @@ with lib;
''${pkgs.apparmor}/sbin/apparmor_parser -Rv -I ${pkgs.apparmor}/etc/apparmor.d/ "${profile}" ; ''
) cfg.profiles;
};
};
};
}