Projects/roowho2
1
2
Fork 0
Code Issues 35 Pull Requests Actions Releases Activity

module.nix: grant CAP_DAC_READ_SEARCH to daemon

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit
2026-04-29 05:05:21 +09:00
parent b9b5fa5735
commit a0d5034e85
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nix/module.nix
+4 -2
View File
@@ -73,8 +73,10 @@ in {
# PrivateUsers = true; # PrivateUsers = true;
# ProtectHome = true; # ProtectHome = true;
AmbientCapabilities = ""; # NOTE: We need this capability to be able to read inside the home directories of users without
CapabilityBoundingSet = ""; # them needing to open their homedirs to the rest of the system.
AmbientCapabilities = [ "CAP_DAC_READ_SEARCH" ];
CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" ];
DeviceAllow = ""; DeviceAllow = "";
DevicePolicy = "closed"; DevicePolicy = "closed";
LockPersonality = true; LockPersonality = true;