nixos/nixseparatedebuginfod2: Relax too strict hardening

All debuginfo downloads were failing because downloading uses "nix
store --restore", which seems to need access to /proc. Blocking this
access via ProcSubset is even noted in systemd's documentation as
"not suitable for most non-trivial programs".
This commit is contained in:
Jakob Wenzel
2026-02-17 17:20:24 +01:00
parent a82ccc39b3
commit 6e634ecb41
@@ -87,7 +87,6 @@ in
ProtectKernelLogs = true; # Prevent access to kernel logs
ProtectClock = true; # Prevent setting the RTC
ProtectProc = "noaccess";
ProcSubset = "pid";
# Networking
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";