From 65664d6ba2909eb5a6d3ee260d659b89cccf73e6 Mon Sep 17 00:00:00 2001
From: Enno Richter <enno@nerdworks.de>
Date: Sat, 5 Oct 2024 11:50:55 +0200
Subject: [PATCH] nixos/gotenberg: fix service config for chromium

---
 nixos/modules/services/misc/gotenberg.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/nixos/modules/services/misc/gotenberg.nix b/nixos/modules/services/misc/gotenberg.nix
index ed8629a7fa46..e92e11b50c71 100644
--- a/nixos/modules/services/misc/gotenberg.nix
+++ b/nixos/modules/services/misc/gotenberg.nix
@@ -228,7 +228,6 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        ProcSubset = "pid";
 
         RestrictAddressFamilies = [
           "AF_UNIX"
@@ -240,11 +239,10 @@ in
         RestrictRealtime = true;
 
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
 
         SystemCallFilter = [
+          "@sandbox"
           "@system-service"
-          "~@privileged"
         ];
         SystemCallArchitectures = "native";