From c96dbd9d92e526597d1bef4b964135a73e261c7a Mon Sep 17 00:00:00 2001
From: ChaosAttractor <lostattractor@gmail.com>
Date: Sun, 5 Apr 2026 23:38:25 +0800
Subject: [PATCH] polkit: fix polkit-agent-helper@ sandbox for pam_zfs_key

---
 nixos/modules/security/polkit.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index d4a99ba8a7b6..c2bbe706529f 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -100,6 +100,12 @@ in
         # ~/.config/Yubico/u2f_keys (the default key file location)
         ProtectHome = "read-only";
       })
+      (lib.mkIf config.security.pam.zfs.enable {
+        PrivateDevices = false;
+        DeviceAllow = [
+          "/dev/zfs rw"
+        ];
+      })
     ];
 
     # The polkit daemon reads action/rule files