From 6e634ecb41ee2ede4dc9cb1096ec0b32e6fec91c Mon Sep 17 00:00:00 2001
From: Jakob Wenzel <git@jakobwenzel.de>
Date: Tue, 17 Feb 2026 17:11:31 +0100
Subject: [PATCH] nixos/nixseparatedebuginfod2: Relax too strict hardening

All debuginfo downloads were failing because downloading uses "nix
store --restore", which seems to need access to /proc. Blocking this
access via ProcSubset is even noted in systemd's documentation as
"not suitable for most non-trivial programs".
---
 nixos/modules/services/development/nixseparatedebuginfod2.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/development/nixseparatedebuginfod2.nix b/nixos/modules/services/development/nixseparatedebuginfod2.nix
index c9174f61b1be..b91af7bf3c3d 100644
--- a/nixos/modules/services/development/nixseparatedebuginfod2.nix
+++ b/nixos/modules/services/development/nixseparatedebuginfod2.nix
@@ -87,7 +87,6 @@ in
         ProtectKernelLogs = true; # Prevent access to kernel logs
         ProtectClock = true; # Prevent setting the RTC
         ProtectProc = "noaccess";
-        ProcSubset = "pid";
 
         # Networking
         RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";