polkit: fix polkit-agent-helper@ sandbox for pam_zfs_key (#507200)

2026-04-06 15:39:20 +00:00
parent 859a247399 c96dbd9d92
commit 322675f578
1 changed files with 6 additions and 0 deletions
@@ -100,6 +100,12 @@ in
        # ~/.config/Yubico/u2f_keys (the default key file location)
        ProtectHome = "read-only";
      })
+      (lib.mkIf config.security.pam.zfs.enable {
+        PrivateDevices = false;
+        DeviceAllow = [
+          "/dev/zfs rw"
+        ];
+      })
    ];

    # The polkit daemon reads action/rule files