From d6f4f4584ae5f04c4f5caf7574106025b34ab883 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 12 Dec 2022 15:36:58 +0100
Subject: [PATCH] nixos/botamusique: allow syscalls in the @resources group

Calls to ffmpeg from botamusique require the `set_mempolicy` syscall.

Fixes: #205702
---
 nixos/modules/services/audio/botamusique.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/nixos/modules/services/audio/botamusique.nix b/nixos/modules/services/audio/botamusique.nix
index 4cd900f945c8..5d3f7db12bc9 100644
--- a/nixos/modules/services/audio/botamusique.nix
+++ b/nixos/modules/services/audio/botamusique.nix
@@ -103,9 +103,8 @@ in
         StateDirectory = "botamusique";
         SystemCallArchitectures = "native";
         SystemCallFilter = [
-          "@system-service"
+          "@system-service @resources"
           "~@privileged"
-          "~@resources"
         ];
         UMask = "0077";
         WorkingDirectory = "/var/lib/botamusique";