nichts/modules/system/os/security/security.mod.nix

{pkgs, ...}: {
  security = {
    # Enable Soteria, a GTK-based Polkit authentication agent.
    soteria.enable = true;
    apparmor = {
      enable = true;
      killUnconfinedConfinables = true;
      packages = [pkgs.apparmor-profiles];
    };
  };
}