Mirrors/home-manager
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

lorri: unbreak due to too tight sandboxing

Browse source 
lorri needs to be able to write to /run/user/uid for the socket, to its
own cache directory ~/.cache/lorri and to the directory for gc roots.
This commit is contained in:
Guillaume Girol 2024-01-01 09:56:03 +01:00 committed by GitHub
parent b7ef79bcf4
commit f06edaf18b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
modules/services/lorri.nix
View file

@ -52,6 +52,12 @@ in {
PrivateTmp = true; PrivateTmp = true;
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectHome = "read-only"; ProtectHome = "read-only";
ReadWritePaths = [
# /run/user/1000 for the socket
"%t"
"/nix/var/nix/gcroots/per-user/%u"
];
CacheDirectory = [ "lorri" ];
Restart = "on-failure"; Restart = "on-failure";
Environment = let Environment = let
path = with pkgs; path = with pkgs;