From 5724c3197a99bc1df434ef5b11eb8c4f1adc6d68 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Wed, 14 Jan 2026 14:17:05 +0800
Subject: [PATCH] nixos/tayga: always set virtualOwner to null

Previously, due to the limitation of
networking.interfaces.*.virtualOwner, it is only set to null when
using systemd-networkd backend.  With this patch, virtualOwner is
always set to null.
---
 nixos/modules/services/networking/tayga.nix | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/services/networking/tayga.nix b/nixos/modules/services/networking/tayga.nix
index f7221bdaf8c7..b6ed216d1992 100644
--- a/nixos/modules/services/networking/tayga.nix
+++ b/nixos/modules/services/networking/tayga.nix
@@ -167,7 +167,7 @@ in
     networking.interfaces."${cfg.tunDevice}" = {
       virtual = true;
       virtualType = "tun";
-      virtualOwner = mkIf config.networking.useNetworkd "";
+      virtualOwner = null;
       ipv4 = {
         addresses = [
           {
@@ -205,9 +205,7 @@ in
         ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
         Restart = "always";
 
-        # Hardening Score:
-        #  - nixos-scripts: 2.1
-        #  - systemd-networkd: 1.6
+        # Hardening Score: 1.5
         ProtectHome = true;
         SystemCallFilter = [
           "@network-io"
@@ -216,9 +214,6 @@ in
           "~@resources"
         ];
         ProtectKernelLogs = true;
-        AmbientCapabilities = [
-          "CAP_NET_ADMIN"
-        ];
         CapabilityBoundingSet = "";
         RestrictAddressFamilies = [
           "AF_INET"
@@ -226,7 +221,7 @@ in
           "AF_NETLINK"
         ];
         StateDirectory = "tayga";
-        DynamicUser = mkIf config.networking.useNetworkd true;
+        DynamicUser = true;
         MemoryDenyWriteExecute = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;