nixos/{tmpfiles, wrappers}: explicitly set RestrictSUIDSGID false (#426882)

2025-07-30 04:31:21 -04:00
parent 832f5d974d 248c463f69
commit 0a53886700
2 changed files with 2 additions and 0 deletions
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -318,6 +318,7 @@ in
        "/nix/store"
        "/run/wrappers"
      ];
+      serviceConfig.RestrictSUIDSGID = false;
      serviceConfig.Type = "oneshot";
      script = ''
        chmod 755 "${parentWrapperDir}"
--- a/nixos/modules/system/boot/systemd/tmpfiles.nix
+++ b/nixos/modules/system/boot/systemd/tmpfiles.nix
@@ -280,6 +280,7 @@ in
          "network.hosts"
          "ssh.authorized_keys.root"
        ];
+        RestrictSUIDSGID = false;
      };
    };