diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix index 1c8e65a352f2..dc1900f52c1e 100644 --- a/nixos/modules/services/home-automation/home-assistant.nix +++ b/nixos/modules/services/home-automation/home-assistant.nix @@ -868,6 +868,10 @@ in "amshan" "benqprojector" ]; + componentsUsingInputDevices = [ + # Components that require access to input devices (/dev/input/*) + "keyboard_remote" + ]; in { ExecStart = escapeSystemdExecArgs ( @@ -898,13 +902,15 @@ in # Hardening AmbientCapabilities = capabilities; CapabilityBoundingSet = capabilities; - DeviceAllow = ( + DeviceAllow = optionals (any useComponent componentsUsingSerialDevices) [ "char-ttyACM rw" "char-ttyAMA rw" "char-ttyUSB rw" ] - ); + ++ optionals (any useComponent componentsUsingInputDevices) [ + "char-input rw" + ]; DevicePolicy = "closed"; LockPersonality = true; MemoryDenyWriteExecute = true; @@ -946,9 +952,13 @@ in RestrictNamespaces = true; RestrictRealtime = true; RestrictSUIDSGID = true; - SupplementaryGroups = optionals (any useComponent componentsUsingSerialDevices) [ - "dialout" - ]; + SupplementaryGroups = + optionals (any useComponent componentsUsingSerialDevices) [ + "dialout" + ] + ++ optionals (any useComponent componentsUsingInputDevices) [ + "input" + ]; SystemCallArchitectures = "native"; SystemCallFilter = [ "@system-service"