nixos/postgresql/citus: fix syscall filter and add test

2025-02-06 01:40:10 -05:00
parent 9a9ab6b924
commit 37372eb227
3 changed files with 84 additions and 4 deletions
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -727,10 +727,16 @@ in
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          SystemCallArchitectures = "native";
-          SystemCallFilter = [
-            "@system-service"
-            "~@privileged @resources"
-          ] ++ lib.optionals (any extensionInstalled [ "plv8" ]) [ "@pkey" ];
+          SystemCallFilter =
+            [
+              "@system-service"
+              "~@privileged @resources"
+            ]
+            ++ lib.optionals (any extensionInstalled [ "plv8" ]) [ "@pkey" ]
+            ++ lib.optionals (any extensionInstalled [ "citus" ]) [
+              "getpriority"
+              "setpriority"
+            ];
          UMask = if groupAccessAvailable then "0027" else "0077";
        }
        (mkIf (cfg.dataDir != "/var/lib/postgresql/${cfg.package.psqlSchema}") {