From 1718e247eb5d1dcbe9dd9caf0399a4f3e0c03d1f Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <git@danielschaefer.me>
Date: Tue, 25 Jul 2023 12:59:36 +0800
Subject: [PATCH 1/2] keyd: 2.4.2 -> 2.4.3

Signed-off-by: Daniel Schaefer <git@danielschaefer.me>
---
 pkgs/tools/inputmethods/keyd/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/inputmethods/keyd/default.nix b/pkgs/tools/inputmethods/keyd/default.nix
index ba0c05164435..8a847ff65102 100644
--- a/pkgs/tools/inputmethods/keyd/default.nix
+++ b/pkgs/tools/inputmethods/keyd/default.nix
@@ -10,13 +10,13 @@
 }:
 
 let
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "rvaiya";
     repo = "keyd";
     rev = "v" + version;
-    hash = "sha256-QWr+xog16MmybhQlEWbskYa/dypb9Ld54MOdobTbyMo=";
+    hash = "sha256-NhZnFIdK0yHgFR+rJm4cW+uEhuQkOpCSLwlXNQy6jas=";
   };
 
   pypkgs = python3.pkgs;
@@ -49,13 +49,14 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace Makefile \
-      --replace DESTDIR= DESTDIR=${placeholder "out"} \
       --replace /usr ""
 
     substituteInPlace keyd.service \
       --replace /usr/bin $out/bin
   '';
 
+  installFlags = [ "DESTDIR=${placeholder "out"}" ];
+
   buildInputs = [ systemd ];
 
   enableParallelBuilding = true;

From 6591d332f93422e388ef6337f6b362b4ff8d0724 Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <git@danielschaefer.me>
Date: Wed, 26 Jul 2023 17:19:49 +0800
Subject: [PATCH 2/2] nixos/keyd: Allow service to call nice syscall

Otherwise it'll be killed by systemd with
Main process exited, code=killed, status=31/SYS

Signed-off-by: Daniel Schaefer <git@danielschaefer.me>
---
 nixos/modules/services/hardware/keyd.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/hardware/keyd.nix b/nixos/modules/services/hardware/keyd.nix
index 969383fd4dc7..59562f83cbfc 100644
--- a/nixos/modules/services/hardware/keyd.nix
+++ b/nixos/modules/services/hardware/keyd.nix
@@ -133,7 +133,7 @@ in
         RuntimeDirectory = "keyd";
 
         # Hardening
-        CapabilityBoundingSet = "";
+        CapabilityBoundingSet = [ "CAP_SYS_NICE" ];
         DeviceAllow = [
           "char-input rw"
           "/dev/uinput rw"
@@ -142,7 +142,7 @@ in
         PrivateNetwork = true;
         ProtectHome = true;
         ProtectHostname = true;
-        PrivateUsers = true;
+        PrivateUsers = false;
         PrivateMounts = true;
         PrivateTmp = true;
         RestrictNamespaces = true;
@@ -155,9 +155,9 @@ in
         LockPersonality = true;
         ProtectProc = "invisible";
         SystemCallFilter = [
+          "nice"
           "@system-service"
           "~@privileged"
-          "~@resources"
         ];
         RestrictAddressFamilies = [ "AF_UNIX" ];
         RestrictSUIDSGID = true;