Hey! Quick question - what’s the best MAC approach for NixOS? I’ve found that AppArmor doesn’t really work well, and SELinux is even worse. Are there any alternatives specifically designed for NixOS? I’ve heard about TOMOYO or Landlock LSM, but also that people just use systemd hardening instead. Would really appreciate your thoughts!
If you’re an immutable distros fan, honestly I’d say just convert to SecureBlue. It’s not a perfect 1.. 1, but it has some overlap. Honestly I haven’t utilized NixOS outside of server environments.
Not all LSMs are full MAC frameworks like SELinux and AppArmor are. TOMOYO is but I doubt you’ll have an easier time with it than AppArmor, especially considering the default NixOS kernel is compiled without support for it.
It appears that NixOS just doesn’t really support any MAC at the moment, so there is no easy answer here, unfortunately. Adding support for MAC in general was a NixOS GSoC idea for 2026.