From 9309fd750800b5c8e4d6cb90fbed7fc53885adb1 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Thu, 11 Sep 2025 09:02:26 +0200
Subject: [PATCH] nixos/murmur: Reverse order of allowed address families

Instead of specifying what shouldn't be allowed, rather list allowed
address families.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/networking/murmur.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index 98387d5acdf8..4410c413412b 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -350,7 +350,10 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectSystem = "full";
-        RestrictAddressFamilies = "~AF_PACKET AF_NETLINK";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
         RestrictNamespaces = true;
         RestrictSUIDSGID = true;
         RestrictRealtime = true;