nixos/tetrd: remove CAP_DAC_OVERRIDE

That's just a bonkers capability to hand out because a program uses stupid paths that it does not have permissions on.
2026-05-04 03:54:54 +02:00
parent 788368c327
commit b1732ebd4e
1 changed files with 1 additions and 4 deletions
@@ -89,17 +89,14 @@

          BindPaths = [
            "/etc/tetrd/resolv.conf:/etc/resolv.conf"
-            "/run"
-            "/var/log"
+            "/run/tetrd:/run"
          ];

          CapabilityBoundingSet = [
-            "CAP_DAC_OVERRIDE"
            "CAP_NET_ADMIN"
          ];

          AmbientCapabilities = [
-            "CAP_DAC_OVERRIDE"
            "CAP_NET_ADMIN"
          ];
        };