dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

nixos/keyd: Allow service to call nice syscall

Browse Source 
Otherwise it'll be killed by systemd with
Main process exited, code=killed, status=31/SYS

Signed-off-by: Daniel Schaefer <git@danielschaefer.me>
This commit is contained in:
Daniel Schaefer 2023-07-26 17:19:49 +08:00
parent 1718e247eb
commit 6591d332f9
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
nixos/modules/services/hardware/keyd.nix
View File

@ -133,7 +133,7 @@ in
RuntimeDirectory = "keyd";
# Hardening
CapabilityBoundingSet = "";
CapabilityBoundingSet = [ "CAP_SYS_NICE" ];
DeviceAllow = [
"char-input rw"
"/dev/uinput rw"
@ -142,7 +142,7 @@ in
PrivateNetwork = true;
ProtectHome = true;
ProtectHostname = true;
PrivateUsers = true;
PrivateUsers = false;
PrivateMounts = true;
PrivateTmp = true;
RestrictNamespaces = true;
@ -155,9 +155,9 @@ in
LockPersonality = true;
ProtectProc = "invisible";
SystemCallFilter = [
"nice"
"@system-service"
"~@privileged"
"~@resources"
];
RestrictAddressFamilies = [ "AF_UNIX" ];
RestrictSUIDSGID = true;