polkit: fix polkit-agent-helper@ sandbox for pam_zfs_key

2026-04-06 01:36:44 +08:00
parent ff2af6f7eb
commit c96dbd9d92
1 changed files with 6 additions and 0 deletions
@@ -100,6 +100,12 @@ in
        # ~/.config/Yubico/u2f_keys (the default key file location)
        ProtectHome = "read-only";
      })
+      (lib.mkIf config.security.pam.zfs.enable {
+        PrivateDevices = false;
+        DeviceAllow = [
+          "/dev/zfs rw"
+        ];
+      })
    ];

    # The polkit daemon reads action/rule files