nixos/nfc-nci: Adjust pcscd system call hardening

2026-04-09 14:39:14 +02:00
parent 68d8aa3d66
commit d62b05d75b
1 changed files with 5 additions and 0 deletions
@@ -185,6 +185,11 @@ in
      "nxp-pn5xx"
    ];

+    # libnfc-nci calls sched_setscheduler via pthread_setschedparam, which would be blocked by upstream SystemCallFilter=~@resources
+    systemd.services.pcscd.serviceConfig.SystemCallFilter = lib.mkIf cfg.enableIFD [
+      "sched_setscheduler"
+    ];
+
    services.pcscd.readerConfigs = lib.mkIf cfg.enableIFD [
      ''
        FRIENDLYNAME "NFC NCI"