nichts/modules/system/os/security/module.nix

{pkgs, ...}: {
  imports = [
    ./sudo.nix
  ];

  security = {
    polkit = {
      enable = true;
      package = pkgs.polkit;
    };

    apparmor = {
      enable = true;
      killUnconfinedConfinables = true;
      packages = [pkgs.apparmor-profiles];
    };
  };
}