nixos/zwave-js-ui: Add chown to allowed syscalls (#380999)

FliegendeWurst · web-flow · commit 9b62d5e280d8 · 2025-03-10T08:47:46.000+01:00
diff --git a/nixos/modules/services/home-automation/zwave-js-ui.nix b/nixos/modules/services/home-automation/zwave-js-ui.nix
@@ -111,6 +111,7 @@ in
         SystemCallFilter = [
           "@system-service @pkey"
           "~@privileged @resources"
+          "@chown"
         ];
         UMask = "0077";
       };
diff --git a/nixos/tests/zwave-js-ui.nix b/nixos/tests/zwave-js-ui.nix
@@ -25,7 +25,7 @@ import ./make-test-python.nix (
       machine.wait_for_unit("zwave-js-ui.service")
       machine.wait_for_open_port(9999)
       machine.wait_until_succeeds("journalctl --since -1m --unit zwave-js-ui --grep 'Listening on port 9999host :: protocol HTTP'")
-      machine.wait_for_file("/var/lib/zwave-js-ui/nodes.json")
+      machine.wait_for_file("/var/lib/zwave-js-ui/users.json")
     '';
   }
 )

Original file line number	Diff line number	Diff line change
`@@ -25,7 +25,7 @@ import ./make-test-python.nix (`
`25`	`25`	`machine.wait_for_unit("zwave-js-ui.service")`
`26`	`26`	`machine.wait_for_open_port(9999)`
`27`	`27`	`machine.wait_until_succeeds("journalctl --since -1m --unit zwave-js-ui --grep 'Listening on port 9999host :: protocol HTTP'")`
`28`		`- machine.wait_for_file("/var/lib/zwave-js-ui/nodes.json")`
	`28`	`+ machine.wait_for_file("/var/lib/zwave-js-ui/users.json")`
`29`	`29`	`'';`
`30`	`30`	`}`
`31`	`31`	`)`