From fb5e34fb3976a8a3dbef502e2863c23619a1f596 Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Thu, 9 Jan 2025 20:10:24 +0900 Subject: [PATCH] nixos/cryptpad: fix service with nodejs 22.11 (for real) The previous fix had only been tested locally through a runtime edit of the service, and the order in which @chown had been re-added was different so commit cf498c1a61b3 ("nixos/cryptpad: fix service with nodejs 22.11") did not actually fix the issue. This properly orders @chown after @privileged so the rule is respected, and also properly denies with EPERM instead of allowing the chown family of syscalls: this will properly prevent seccomp from killing nodejs while still disallowing fchown() Fixes https://github.com/NixOS/nixpkgs/issues/370717 --- nixos/modules/services/web-apps/cryptpad.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-apps/cryptpad.nix b/nixos/modules/services/web-apps/cryptpad.nix index a5f142553495..0ec6df1419bb 100644 --- a/nixos/modules/services/web-apps/cryptpad.nix +++ b/nixos/modules/services/web-apps/cryptpad.nix @@ -195,10 +195,12 @@ in SystemCallFilter = [ "@pkey" "@system-service" - "@chown" + # /!\ order matters: @privileged contains @chown, so we need + # @privileged negated before we re-list @chown for libuv copy + "~@privileged" + "~@chown:EPERM" "~@keyring" "~@memlock" - "~@privileged" "~@resources" "~@setuid" "~@timer"