nix/module: reuse systemd units

2026-07-30 19:24:50 +09:00
parent 2271aedfd3
commit 3e8928ef46
2 changed files with 18 additions and 100 deletions
@@ -13,20 +13,21 @@ ExecStart=/usr/bin/roowhod

 ConfigurationDirectory=roowho2

-Environment=DBUS_SYSTEM_BUS_ADDRESS=unix:path=/run/dbus/system_bus_socket
-
+# Finger needs CAP_DAC_READ_SEARCH to look for various files in user's home directories.
 AmbientCapabilities=CAP_DAC_READ_SEARCH
 CapabilityBoundingSet=CAP_DAC_READ_SEARCH
+PrivateUsers=false
+ProtectHome=false

 # walld needs access to tty/pts devices.
 DeviceAllow=char-tty rw
 DeviceAllow=char-pts rw
 PrivateDevices=false
+DevicePolicy=closed

 # Might use /proc/<pid>/stat to determine the caller's PID + UID
 ProtectProc=default

-DevicePolicy=closed
 LockPersonality=true
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
@@ -44,6 +45,7 @@ RemoveIPC=true
 RestrictAddressFamilies=AF_INET
 RestrictAddressFamilies=AF_INET6
 RestrictAddressFamilies=AF_UNIX
+# Needed for auditd socket
 RestrictAddressFamilies=AF_NETLINK
 RestrictNamespaces=true
 RestrictRealtime=true