nichts/modules/system/os/security/security.mod.nix

{pkgs, ...}: {
  security = {
    polkit = {
      enable = true;
      package = pkgs.polkit;
    };

    apparmor = {
      enable = true;
      killUnconfinedConfinables = true;
      packages = [pkgs.apparmor-profiles];
    };
  };
}