From 46f22dc20ad86d7520aef0544120d46a4a990972 Mon Sep 17 00:00:00 2001
From: Vonfry <dev@vonfry.name>
Date: Sun, 24 Aug 2025 13:14:16 +0800
Subject: [PATCH] nixos/mihomo: add an option for processes info

---
 nixos/modules/services/networking/mihomo.nix | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/networking/mihomo.nix b/nixos/modules/services/networking/mihomo.nix
index efacc1e99411..ccafcacb0efc 100644
--- a/nixos/modules/services/networking/mihomo.nix
+++ b/nixos/modules/services/networking/mihomo.nix
@@ -10,6 +10,14 @@
 }:
 let
   cfg = config.services.mihomo;
+
+  AmbientCapabilities =
+    lib.optional cfg.tunMode "CAP_NET_ADMIN"
+    ++ lib.optionals cfg.processesInfo [
+      "CAP_DAC_READ_SEARCH"
+      "CAP_SYS_PTRACE"
+    ];
+  CapabilityBoundingSet = AmbientCapabilities;
 in
 {
   options.services.mihomo = {
@@ -48,10 +56,14 @@ in
     };
 
     tunMode = lib.mkEnableOption ''
-      necessary permission for Mihomo's systemd service for TUN mode to function properly.
+      necessary capabilities for Mihomo's systemd service for TUN mode to function properly.
 
       Keep in mind, that you still need to enable TUN mode manually in Mihomo's configuration
     '';
+
+    processesInfo = lib.mkEnableOption ''
+      necessary capabilities for rules about process information such as `process-name`
+    '';
   };
 
   config = lib.mkIf cfg.enable {
@@ -76,8 +88,7 @@ in
         LoadCredential = "config.yaml:${cfg.configFile}";
 
         ### Hardening
-        AmbientCapabilities = "";
-        CapabilityBoundingSet = "";
+        inherit AmbientCapabilities CapabilityBoundingSet;
         DeviceAllow = "";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
@@ -105,8 +116,6 @@ in
         UMask = "0077";
       }
       // lib.optionalAttrs cfg.tunMode {
-        AmbientCapabilities = "CAP_NET_ADMIN";
-        CapabilityBoundingSet = "CAP_NET_ADMIN";
         PrivateDevices = false;
         PrivateUsers = false;
         RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";