diff options
author | Matt McHenry <github@matt.mchenryfamily.org> | 2023-12-12 21:34:58 -0500 |
---|---|---|
committer | Matt McHenry <github@matt.mchenryfamily.org> | 2023-12-17 11:35:48 -0500 |
commit | db64f7f7379858bfa3172a4fce108ef8a25df96d (patch) | |
tree | f975e5080640b89b99fd43fcec7cdcceeec9aefe /nixos/modules/services/development | |
parent | 2c7f3c0fb7c08a0814627611d9d7d45ab6d75335 (diff) | |
download | nixlib-db64f7f7379858bfa3172a4fce108ef8a25df96d.tar nixlib-db64f7f7379858bfa3172a4fce108ef8a25df96d.tar.gz nixlib-db64f7f7379858bfa3172a4fce108ef8a25df96d.tar.bz2 nixlib-db64f7f7379858bfa3172a4fce108ef8a25df96d.tar.lz nixlib-db64f7f7379858bfa3172a4fce108ef8a25df96d.tar.xz nixlib-db64f7f7379858bfa3172a4fce108ef8a25df96d.tar.zst nixlib-db64f7f7379858bfa3172a4fce108ef8a25df96d.zip |
lorri.service: remove ProtectHome, relax ProtectSystem
per lorri's readme: lorri creates an indirect garbage collection root for each .drv in $XDG_CACHE_HOME/lorri (~/.cache/lorri/ by default) each time it evaluates your project. ... so it doesn't make sense to have ProtectHome enabled for lorri.service. lorri also needs to be able to modify /nix/var/nix/gcroots/per-user/, so ProtectSystem can't be 'strict'; 'full' is the next strongest. fixes: lorri: ERRO IO error binding to socket: Read-only file system (os error 30) bisecting this error leads to a range of unbuildable commits including 'a31429165204 Merge pull request #243242 from RaitoBezarius/systemd-254', so it's likely that systemd update changed the behaviour of ProtectHome somehow (though the release notes don't have any obvious culprits).
Diffstat (limited to 'nixos/modules/services/development')
-rw-r--r-- | nixos/modules/services/development/lorri.nix | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/nixos/modules/services/development/lorri.nix b/nixos/modules/services/development/lorri.nix index 74f56f5890fc..df3d814d7444 100644 --- a/nixos/modules/services/development/lorri.nix +++ b/nixos/modules/services/development/lorri.nix @@ -44,8 +44,7 @@ in { serviceConfig = { ExecStart = "${cfg.package}/bin/lorri daemon"; PrivateTmp = true; - ProtectSystem = "strict"; - ProtectHome = "read-only"; + ProtectSystem = "full"; Restart = "on-failure"; }; }; |