From 9be81d0acfd8a5ac8c6a2222255ea9665f66d511 Mon Sep 17 00:00:00 2001
From: D Anzorge <d.anzorge@gmail.com>
Date: Tue, 13 Dec 2022 02:47:50 +0100
Subject: nixos/grafana: allow @chown syscalls when using unix sockets

Grafana will unconditionally call chown on the socket after creating it,
even if the configuration does not ask for a different socket gid.
---
 nixos/modules/services/monitoring/grafana.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index 9b3068796d8..5061666f57c 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -1291,7 +1291,10 @@ in {
         SystemCallArchitectures = "native";
         # Upstream grafana is not setting SystemCallFilter for compatibility
         # reasons, see https://github.com/grafana/grafana/pull/40176
-        SystemCallFilter = [ "@system-service" "~@privileged" ];
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ] ++ lib.optional (cfg.settings.server.protocol == "socket") [ "@chown" ];
         UMask = "0027";
       };
       preStart = ''
-- 
cgit 1.4.1