commit ea00ad5f70172782d5841e8dc57ad542ea2d1950
author Skyler Grey <skyler3665@gmail.com> Mon Feb 13 06:49:48 2023 +0000
committer Skyler Grey <skyler3665@gmail.com> Sun Feb 26 13:09:38 2023 +0000
tree 994e91fd329e8d7b637e70e8f8279e09f1056546
parent 303dce42efab9339d4a4dad27d8bf26fa497139c

Add some security modules

modules/apparmor.nix

diff --git a/modules/apparmor.nix b/modules/apparmor.nix
index fddd363..64ebd34 100644
--- a/modules/apparmor.nix
+++ b/modules/apparmor.nix
@@ -18,19 +18,31 @@
           profile default_deny /** { }
           '';
           enforce = false;
-          enable = true;
+          enable = false;
         };
 
         sudo = {
           profile = ''
-          ${config.security.wrapperDir}/sudo {
-            file rwlkUx,
+          ${pkgs.sudo}/bin/sudo {
+            file /** rwlkUx,
           }
           '';
+          enforce = false;
+          enable = false;
+        };
+
+        nix = {
+          profile = ''
+          ${pkgs.nix}/bin/nix {
+            unconfined,
+          }
+          '';
+          enforce = false;
+          enable = false;
         };
       };
     };
 
-    services.dbus.apparmor = "required";
+    services.dbus.apparmor = "disabled";
   };
 }

modules/firewall.nix

diff --git a/modules/firewall.nix b/modules/firewall.nix
index 09045f4..54943a9 100644
--- a/modules/firewall.nix
+++ b/modules/firewall.nix
@@ -1,3 +1,3 @@
 {
-  networking.firewall.enable = true;
+  config.networking.firewall.enable = true;
 }

modules/security.nix

diff --git a/modules/security.nix b/modules/security.nix
index fe3b333..889e44d 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -11,6 +11,12 @@
     services.fprintd.enable = true;
     environment.persistence."/nix/persist".directories = [ "/var/lib/fprint" ];
 
+    security.auditd.enable = true;
+    services.syslogd.enable = true;
+    services.syslogd.extraConfig = ''
+      *.*  -/var/log/syslog
+    '';
+    services.journald.forwardToSyslog = true;
     security.apparmor = {
       enable = true;
       killUnconfinedConfinables = true;