sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: allow platformio to use @privileged syscalls since linking fails

Browse source 
otherwise (error -31) (it's not root anyway)
This commit is contained in:
oddlama 2023-03-18 02:15:51 +01:00
parent 20e539020c
commit 3b6503f2e2
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/zackbiene/esphome.nix
View file

@ -48,7 +48,6 @@ in {
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"@mount" # Required by platformio for chroot
];
UMask = "0077";
@ -64,6 +63,7 @@ in {
users.groups.esphome.gid = 316;
# TODO esphome.sock permissions pls nginx currently world writable
services.nginx.upstreams = {
"esphome" = {
servers = {"unix:/run/esphome/esphome.sock" = {};};

4
hosts/zackbiene/hostapd.nix
View file

@ -79,13 +79,13 @@
serviceConfig = {
ExecReload = "/bin/kill -HUP $MAINPID";
RuntimeDirectory = "hostapd";
DeviceAllow = "/dev/rfkill rw";
# Hardening
LockPersonality = true;
MemoryDenyWriteExecute = true;
DevicePolicy = "closed";
DeviceAllow = "/dev/rfkill rw";
NoNewPrivileges = true;
PrivateDevices = true;
PrivateUsers = false; # hostapd requires real system root access.
PrivateTmp = true;
ProtectClock = true;