diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix index 3a9d911b8048..dcfd211470d6 100644 --- a/nixos/modules/services/networking/ntp/chrony.nix +++ b/nixos/modules/services/networking/ntp/chrony.nix @@ -237,7 +237,7 @@ in unitConfig.ConditionCapability = "CAP_SYS_TIME"; serviceConfig = { - Type = "simple"; + Type = "notify"; ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}"; # Proc filesystem @@ -318,6 +318,13 @@ in Alternatively, disable this behaviour by `services.chrony.enableRTCTrimming = false;` ''; } + { + assertion = !(cfg.enable && config.environment.memoryAllocator.provider == "graphene-hardened"); + message = '' + Chrony doesn't work with the graphene-hardened memory allocator set by + `environment.memoryAllocator.provider`. + ''; + } ]; }; } diff --git a/nixos/tests/chrony.nix b/nixos/tests/chrony.nix index e3999596fd22..88c75d5648d0 100644 --- a/nixos/tests/chrony.nix +++ b/nixos/tests/chrony.nix @@ -13,7 +13,6 @@ import ./make-test-python.nix ( specialisation.hardened.configuration = { services.chrony.enableMemoryLocking = true; - environment.memoryAllocator.provider = "graphene-hardened"; }; }; };