swendel/nixpkgs
1
0
Fork 0
mirror of https://github.com/SebastianWendel/nixpkgs.git synced 2024-09-21 04:49:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

esphome: remove ProcSubset from serviceConfig

Browse source 
Remove ProcSubset from esphome serviceConfig because esphome/bwrap needs to
access it.
According to
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProcSubset=
ProcSubset isn't even recommended for most programs.
Fixes #262674
This commit is contained in:
Meghea Iulian 2023-10-22 09:13:56 +03:00
parent 6b4e45787b
commit bff068e514
No known key found for this signature in database
GPG key ID: 9FA665644E968CF6
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/services/home-automation/esphome.nix
View file

@ -112,7 +112,7 @@ in
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProcSubset = "pid";
ProcSubset = "all"; # Using "pid" breaks bwrap
ProtectSystem = "strict";
#RemoveIPC = true; # Implied by DynamicUser
RestrictAddressFamilies = [