fix(nixos): relax SystemCallFilter for the dynamic linker

We need to add a few file system related syscalls, so the dynamic
linker won't get killed if we use a dynamically linked executable.

1 files changed, 16 insertions, 1 deletions

diff --git a/nixos/flipdot-gschichtler.nix b/nixos/flipdot-gschichtler.nix
index 06efd62..35af0b3 100644
--- a/nixos/flipdot-gschichtler.nix
+++ b/nixos/flipdot-gschichtler.nix
@@ -72,7 +72,22 @@ in {
         Group = userGroupName;
 
         # mmap and munmap are used by libscrypt-kdf
-        SystemCallFilter = "@default @basic-io @io-event @network-io fcntl @signal @process @timer brk mmap munmap open";
+        SystemCallFilter = lib.concatStringsSep " " [
+          "@default"
+          "@basic-io"
+          "@io-event"
+          "@network-io"
+          "fcntl"
+          "@signal"
+          "@process"
+          "@timer"
+          "brk"
+          "mmap" "munmap" "mprotect"
+          "open" "openat"
+          "close"
+          "fstat" "stat"
+          "access"
+          ];
         SystemCallArchitectures = "native";
 
         CapabilityBoundingSet = "";