nixos/tor: do not bind storeDir when systemd-confinement is enabled

Otherwise it undermines systemd-confinement whose job is to filter what gets bind mounted from the storeDir.
2026-01-20 20:03:51 +01:00
parent aa24bdf88f
commit d5d3834b9d
1 changed files with 1 additions and 1 deletions
@@ -1441,9 +1441,9 @@ in
        #InaccessiblePaths = [ "-+${runDir}/root" ];
        UMask = "0066";
        BindReadOnlyPaths = [
-          builtins.storeDir
          "/etc"
        ]
+        ++ lib.optional (!config.systemd.services.tor.confinement.enable) builtins.storeDir
        ++ lib.optionals config.services.resolved.enable [
          "/run/systemd/resolve/stub-resolv.conf"
          "/run/systemd/resolve/resolv.conf"