From d5d3834b9da4da874242c6ce09c2cf2766d69eb3 Mon Sep 17 00:00:00 2001
From: Julien Moutinho <julm+ngipkgs@sourcephile.fr>
Date: Tue, 20 Jan 2026 17:14:45 +0100
Subject: [PATCH] nixos/tor: do not bind storeDir when systemd-confinement is
 enabled

Otherwise it undermines systemd-confinement
whose job is to filter what gets bind mounted from the storeDir.
---
 nixos/modules/services/security/tor.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix
index 0c86f9572e09..53a79984a38d 100644
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@@ -1441,9 +1441,9 @@ in
         #InaccessiblePaths = [ "-+${runDir}/root" ];
         UMask = "0066";
         BindReadOnlyPaths = [
-          builtins.storeDir
           "/etc"
         ]
+        ++ lib.optional (!config.systemd.services.tor.confinement.enable) builtins.storeDir
         ++ lib.optionals config.services.resolved.enable [
           "/run/systemd/resolve/stub-resolv.conf"
           "/run/systemd/resolve/resolv.conf"