From b1732ebd4e638b52cdbae6af1f30cc9a325a4951 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 4 May 2026 03:54:54 +0200
Subject: [PATCH] nixos/tetrd: remove CAP_DAC_OVERRIDE

That's just a bonkers capability to hand out because a program uses
stupid paths that it does not have permissions on.
---
 nixos/modules/services/networking/tetrd.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/tetrd.nix b/nixos/modules/services/networking/tetrd.nix
index 7b7b050bb0d7..77cf6722e404 100644
--- a/nixos/modules/services/networking/tetrd.nix
+++ b/nixos/modules/services/networking/tetrd.nix
@@ -89,17 +89,14 @@
 
           BindPaths = [
             "/etc/tetrd/resolv.conf:/etc/resolv.conf"
-            "/run"
-            "/var/log"
+            "/run/tetrd:/run"
           ];
 
           CapabilityBoundingSet = [
-            "CAP_DAC_OVERRIDE"
             "CAP_NET_ADMIN"
           ];
 
           AmbientCapabilities = [
-            "CAP_DAC_OVERRIDE"
             "CAP_NET_ADMIN"
           ];
         };