Skip to content

Commit 0c1feac

Browse files
committed
nixos/ebusd: fix device access
1 parent 79a7ad1 commit 0c1feac

File tree

1 file changed

+9
-3
lines changed
  • nixos/modules/services/home-automation

1 file changed

+9
-3
lines changed

nixos/modules/services/home-automation/ebusd.nix

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,11 @@ in
155155

156156
config =
157157
let
158-
usesDev = lib.hasPrefix "/" cfg.device;
158+
usesDev = lib.any (prefix: lib.hasPrefix prefix cfg.device) [
159+
"/"
160+
"ens:/"
161+
"enh:/"
162+
];
159163
in
160164
lib.mkIf cfg.enable {
161165
systemd.services.ebusd = {
@@ -200,12 +204,14 @@ in
200204

201205
# Hardening
202206
CapabilityBoundingSet = "";
203-
DeviceAllow = lib.optionals usesDev [ cfg.device ];
207+
DeviceAllow = lib.optionals usesDev [
208+
(lib.removePrefix "ens:" (lib.removePrefix "enh:" cfg.device))
209+
];
204210
DevicePolicy = "closed";
205211
LockPersonality = true;
206212
MemoryDenyWriteExecute = false;
207213
NoNewPrivileges = true;
208-
PrivateDevices = usesDev;
214+
PrivateDevices = !usesDev;
209215
PrivateUsers = true;
210216
PrivateTmp = true;
211217
ProtectClock = true;

0 commit comments

Comments
 (0)