nixos/confinement: Remove handling for StartOnly

Noted by @Infinisil on IRC:

   infinisil: Question regarding the confinement PR
   infinisil: On line 136 you do different things depending on
              RootDirectoryStartOnly
   infinisil: But on line 157 you have an assertion that disallows that
              option being true
   infinisil: Is there a reason behind this or am I missing something

I originally left this in so that once systemd supports that, we can
just flip a switch and remove the assertion and thus support
RootDirectoryStartOnly for our confinement module.

However, this doesn't seem to be on the roadmap for systemd in the
foreseeable future, so I'll just remove this, especially because it's
very easy to add it again, once it is supported.

Signed-off-by: aszlig <aszlig@nix.build>

1 files changed, 2 insertions, 7 deletions

diff --git a/nixos/modules/security/systemd-confinement.nix b/nixos/modules/security/systemd-confinement.nix
index 49fde2dcc6d..31b07b1b03d 100644
--- a/nixos/modules/security/systemd-confinement.nix
+++ b/nixos/modules/security/systemd-confinement.nix
@@ -52,11 +52,7 @@ in {
           dependencies of this systemd unit, you can use
           <option>confinement.fullUnit</option>.
 
-          <note><para><emphasis role="strong">Only</emphasis> the latter
-          (${mkScOption "ExecStart"}) will be used if
-          ${mkScOption "RootDirectoryStartOnly"} is enabled.</para></note>
-
-          <note><para>Also, the store paths listed in <option>path</option> are
+          <note><para>The store paths listed in <option>path</option> are
           <emphasis role="strong">not</emphasis> included in the closure as
           well as paths from other options except those listed
           above.</para></note>
@@ -133,8 +129,7 @@ in {
           ProtectKernelTunables = wantsAPIVFS;
         };
         confinement.packages = let
-          startOnly = config.serviceConfig.RootDirectoryStartOnly or false;
-          execOpts = if startOnly then [ "ExecStart" ] else [
+          execOpts = [
             "ExecReload" "ExecStart" "ExecStartPost" "ExecStartPre" "ExecStop"
             "ExecStopPost"
           ];