From e81b4fb88ae2c73d09cffc07ae113eeefcd8a2c3 Mon Sep 17 00:00:00 2001
From: royce-c <114127058+royce-c@users.noreply.github.com>
Date: Thu, 12 Feb 2026 17:14:57 -0800
Subject: [PATCH] nixos/chrony: change chrony.keys owner to prevent chronyd
 user write access

---
 nixos/modules/services/networking/ntp/chrony.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index a79599076502..dd6734f21955 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -276,7 +276,7 @@ in
     systemd.tmpfiles.rules = [
       "d ${stateDir} 0750 chrony chrony - -"
       "f ${driftFile} 0640 chrony chrony - -"
-      "f ${keyFile} 0640 chrony chrony - -"
+      "f ${keyFile} 0640 root chrony - -"
     ]
     ++ lib.optionals cfg.enableRTCTrimming [
       "f ${rtcFile} 0640 chrony chrony - -"