diff options
Diffstat (limited to 'nixos/modules/tasks')
| -rw-r--r-- | nixos/modules/tasks/snapraid.nix | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/nixos/modules/tasks/snapraid.nix b/nixos/modules/tasks/snapraid.nix index 4529009930f..c8dde5b4899 100644 --- a/nixos/modules/tasks/snapraid.nix +++ b/nixos/modules/tasks/snapraid.nix @@ -193,7 +193,6 @@ in LockPersonality = true; MemoryDenyWriteExecute = true; NoNewPrivileges = true; - PrivateDevices = true; PrivateTmp = true; ProtectClock = true; ProtectControlGroups = true; @@ -208,7 +207,8 @@ in SystemCallArchitectures = "native"; SystemCallFilter = "@system-service"; SystemCallErrorNumber = "EPERM"; - CapabilityBoundingSet = "CAP_DAC_OVERRIDE"; + CapabilityBoundingSet = "CAP_DAC_OVERRIDE" + + lib.optionalString cfg.touchBeforeSync " CAP_FOWNER"; ProtectSystem = "strict"; ProtectHome = "read-only"; |