nixos/murmur: Reverse order of allowed address families

Instead of specifying what shouldn't be allowed, rather list allowed address families. Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-09-11 09:14:00 +02:00
parent ecb4f79d82
commit 9309fd7508
1 changed files with 4 additions and 1 deletions
@@ -350,7 +350,10 @@ in
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
        ProtectSystem = "full";
-        RestrictAddressFamilies = "~AF_PACKET AF_NETLINK";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
        RestrictNamespaces = true;
        RestrictSUIDSGID = true;
        RestrictRealtime = true;