ferrosonic

kernel/default.nix

@@ -15,7 +15,6 @@ let
         "$@"
   '';
   nsWrapper = pkgs.writeShellScriptBin "ns" ''
-
     exec /run/wrappers/bin/doas ${nsExec}/bin/ns-raw "$@"
   '';
 in
@@ -24,17 +23,16 @@ in
     ./hardened.nix
     ./vfio.nix
     ./standard.nix
-    # ./apparmor.nix
   ];
 
   custom.kernel.hardened.enable = true;
   custom.kernel.vfio.enable = false;
   custom.kernel.standard.enable = true;
-  # security.apparmor.enable = false;
+  security.apparmor.enable = false;
 
   specialisation.unhardened.configuration = {
     custom.kernel.hardened.enable = lib.mkForce false;
-    # security.apparmor.enable = lib.mkForce false;
+    security.apparmor.enable = lib.mkForce false;
   };
 
   specialisation.vfio.configuration = {
@@ -68,23 +66,6 @@ in
         noPass = true;
         keepEnv = false;
       }
-      {
-        users = [ "user" ];
-        runAs = "agent";
-        noPass = true;
-        keepEnv = true;
-      }
-      {
-        users = [
-          "user"
-          "agent"
-          "work"
-        ];
-        runAs = "root";
-        noPass = true;
-        keepEnv = true;
-        cmd = "${nsExec}/bin/ns-raw";
-      }
     ];
   };