nixos/grafana: loosen systemd syscall sandboxing

Allow @resources syscalls in the grafana.service unit. While Grafana itself does not need them, some plugins (incl. first party) crash if they fail to setrlimit. This was first seen with the official grafana Clickhouse datasource plugin. The @resources syscalls set is fairly harmess anyway.
2022-09-06 02:10:47 +02:00
parent 76daf3b9da
commit bfe73f9543
1 changed files with 1 additions and 1 deletions
@@ -792,7 +792,7 @@ in {
        SystemCallArchitectures = "native";
        # Upstream grafana is not setting SystemCallFilter for compatibility
        # reasons, see https://github.com/grafana/grafana/pull/40176
-        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
        UMask = "0027";
      };
      preStart = ''