etc: Add AppArmor profile for the daemon.

* .gitignore: Add etc/apparmor.d/tunables/guix.
* Makefile.am (nodist_apparmor_profile_DATA)
(nodist_apparmor_profile_tunables_DATA): Define it.
* configure.ac: Generate etc/apparmor.d/tunables/guix. Add
--with-apparmor-profile-dir option.
* etc/apparmor.d/guix-daemon: New file.
* etc/apparmor.d/tunables/guix.in: New file.
* doc/guix.texi: Document AppArmor profiles.
* gnu/packages/package-management.scm (guix): Add future changes commented.

Change-Id: Iac7df9d642383cc46a2d450c3badef31199ab041
Signed-off-by: Rutherther <rutherther@ditigal.xyz>

1 files changed, 10 insertions, 0 deletions

diff --git a/configure.ac b/configure.ac
index 82f12507745..6ad8e427736 100644
--- a/configure.ac
+++ b/configure.ac
@@ -81,6 +81,15 @@ AC_ARG_WITH([selinux-policy-dir],
   [selinux_policydir='${datadir}/selinux/'])
 AC_SUBST([selinux_policydir])
 
+AC_ARG_WITH([apparmor-profile-dir],
+  AS_HELP_STRING([--with-apparmor-profile-dir=DIR],
+    [name of the AppArmor profile directory]),
+  [apparmor_profiledir="$withval"],
+  [apparmor_profiledir='${sysconfdir}/apparmor.d'])
+AC_SUBST([apparmor_profiledir])
+apparmor_profile_tunablesdir='${apparmor_profiledir}/tunables'
+AC_SUBST([apparmor_profile_tunablesdir])
+
 dnl Better be verbose.
 AC_MSG_CHECKING([for the store directory])
 AC_MSG_RESULT([$storedir])
@@ -308,6 +317,7 @@ AC_CONFIG_FILES([Makefile
                  po/guix/Makefile.in
                  po/packages/Makefile.in
                  etc/guix-daemon.cil
+                 etc/apparmor.d/tunables/guix
                  guix/config.scm])
 
 AC_CONFIG_FILES([etc/committer.scm], [chmod +x etc/committer.scm])