nixos/zigbee2mqtt: only add port to DeviceAllow if it is a device (#356573)

2024-11-16 22:52:47 +01:00
parent 66d813d978 577e162073
commit f3a1d218b0
1 changed files with 1 additions and 3 deletions
@@ -76,9 +76,7 @@ in

        # Hardening
        CapabilityBoundingSet = "";
-        DeviceAllow = [
-          config.services.zigbee2mqtt.settings.serial.port
-        ];
+        DeviceAllow = lib.optionals (lib.hasPrefix "/" cfg.settings.serial.port) [ cfg.settings.serial.port ];
        DevicePolicy = "closed";
        LockPersonality = true;
        MemoryDenyWriteExecute = false;