robin/palantir
1
0
Fork 0
mirror of https://codeberg.org/icewind/palantir.git synced 2026-06-03 10:14:09 +02:00
Code Issues Projects Releases Wiki Activity

fix zfs in flake

Browse source
This commit is contained in:
Robin Appelman 2022-08-20 21:45:27 +02:00
commit 4e0095e7f4
2 changed files with 11 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

20
flake.lock generated
View file

@ -5,11 +5,11 @@
"nixpkgs": "nixpkgs" "nixpkgs": "nixpkgs"
}, },
"locked": { "locked": {
"lastModified": 1655042882, "lastModified": 1659610603,
"narHash": "sha256-9BX8Fuez5YJlN7cdPO63InoyBy7dm3VlJkkmTt6fS1A=", "narHash": "sha256-LYgASYSPYo7O71WfeUOaEUzYfzuXm8c8eavJcel+pfI=",
"owner": "nix-community", "owner": "nix-community",
"repo": "naersk", "repo": "naersk",
"rev": "cddffb5aa211f50c4b8750adbec0bbbdfb26bb9f", "rev": "c6a45e4277fa58abd524681466d3450f896dc094",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -21,8 +21,8 @@
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 0, "lastModified": 0,
"narHash": "sha256-mERIpkwa0Or48F0R+oAi+8+EXM2BiQLR/qo8dTKejEQ=", "narHash": "sha256-ogcrJszrCg23/mIcLEOUCMKgdWlqMJ4QqezvX0V2ZQk=",
"path": "/nix/store/6x7nic6n0r70ilqw6qgi1jnr0acy9cwa-source", "path": "/nix/store/f6y01zll9swq7rvf82ya4r3hjs9j93py-source",
"type": "path" "type": "path"
}, },
"original": { "original": {
@ -33,8 +33,8 @@
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 0, "lastModified": 0,
"narHash": "sha256-mERIpkwa0Or48F0R+oAi+8+EXM2BiQLR/qo8dTKejEQ=", "narHash": "sha256-ogcrJszrCg23/mIcLEOUCMKgdWlqMJ4QqezvX0V2ZQk=",
"path": "/nix/store/6x7nic6n0r70ilqw6qgi1jnr0acy9cwa-source", "path": "/nix/store/f6y01zll9swq7rvf82ya4r3hjs9j93py-source",
"type": "path" "type": "path"
}, },
"original": { "original": {
@ -51,11 +51,11 @@
}, },
"utils": { "utils": {
"locked": { "locked": {
"lastModified": 1656065134, "lastModified": 1659877975,
"narHash": "sha256-oc6E6ByIw3oJaIyc67maaFcnjYOz1mMcOtHxbEf9NwQ=", "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
"owner": "numtide", "owner": "numtide",
"repo": "flake-utils", "repo": "flake-utils",
"rev": "bee6a7250dd1b01844a2de7e02e4df7d8a0a206c", "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
"type": "github" "type": "github"
}, },
"original": { "original": {

3
flake.nix
View file

@ -121,7 +121,7 @@
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectHome = true; ProtectHome = true;
NoNewPrivileges = true; NoNewPrivileges = true;
ProtectClock = true; ProtectClock = !cfg.zfs; # Enabling this breaks libzfs
CapabilityBoundingSet = true; CapabilityBoundingSet = true;
ProtectKernelLogs = true; ProtectKernelLogs = true;
ProtectControlGroups = true; ProtectControlGroups = true;
@ -132,7 +132,6 @@
ProtectHostname = true; ProtectHostname = true;
LockPersonality = true; LockPersonality = true;
ProtectKernelTunables = true; ProtectKernelTunables = true;
DevicePolicy = "closed";
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_NETLINK"] ++ lib.optional cfg.docker "AF_UNIX"; # netlink is required to make `getifaddrs` not err RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_NETLINK"] ++ lib.optional cfg.docker "AF_UNIX"; # netlink is required to make `getifaddrs` not err
RestrictRealtime = true; RestrictRealtime = true;
SystemCallFilter = ["@system-service" "~@resources" "~@privileged"]; SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];