From 5ea329958a4c987003c8d738ea1d8b9ea4e70255 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Wed, 28 Apr 2021 05:32:50 +0200
Subject: [PATCH] virtualisation.lxc: add the overrides from distrobuilder

---
 nixos/modules/virtualisation/lxc-container.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix
index 9cc5c829e122..d69ce4cf0bc2 100644
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@@ -105,6 +105,14 @@ in
       extraCommands = "mkdir -p proc sys dev";
     });
 
+    # Add the overrides from lxd distrobuilder
+    systemd.extraConfig = ''
+      [Service]
+      ProtectProc=default
+      ProtectControlGroups=no
+      ProtectKernelTunables=no
+    '';
+
     # Allow the user to login as root without password.
     users.users.root.initialHashedPassword = mkOverride 150 "";