From bc04c826cc4240314b3bc4c435944fd3ce5547f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 14 Oct 2024 09:46:33 +0200
Subject: [PATCH 1/2] knot-dns: 3.4.0 -> 3.4.1

https://gitlab.nic.cz/knot/knot-dns/-/releases/v3.4.1
---
 pkgs/servers/dns/knot-dns/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 5c3c5df26210..26f060676d39 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "2730b11398944faa5151c51b0655cf26631090343c303597814f2a57df424736";
+    sha256 = "252a2b83a9319a605103f7491d73a881e97c63339d09170ac9d525155fa41b1a";
   };
 
   outputs = [ "bin" "out" "dev" ];

From 46954f61c698919bf7b07b12cc6d6349ef695f57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 14 Oct 2024 10:26:46 +0200
Subject: [PATCH 2/2] nixos/knotd: extend SystemCallFilter

It was breaking knot-dns.tests.knot
New knotd uses fchown to cover cases where user changes during startup.
In typical Linux cases the user is kept the same and there are
capabilities instead, but the syscall still happens and got caught here.
---
 nixos/modules/services/networking/knot.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index 145b4ad1dd3f..d174edb0fc93 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -337,6 +337,7 @@ in {
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+          "@chown"
         ] ++ optionals (cfg.enableXDP) [
           "bpf"
         ];