From 2dabc4fce1f92a94f4791be129e4f61ab0128614 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 30 Sep 2024 13:24:08 +0200
Subject: [PATCH] nixos/logrotate: reorder setuid syscall group

Relevant parts of @setuid are in @privileged, so we need to flip the
order around, to grant @setuid in spite of denying @privileged.
---
 nixos/modules/services/logging/logrotate.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/logging/logrotate.nix b/nixos/modules/services/logging/logrotate.nix
index 8584563d881d..412a19eadd11 100644
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@@ -285,9 +285,9 @@ in
         RestrictSUIDSGID = false; # can create sgid directories
         SystemCallArchitectures = "native";
         SystemCallFilter = [
-          "@system-service @setuid"
+          "@system-service"
           "~@privileged @resources"
-          "@chown"
+          "@chown @setuid"
         ];
         UMask = "0027";
       } // lib.optionalAttrs (!cfg.allowNetworking) {