diff options
| author | Doron Behar <doron.behar@gmail.com> | 2023-12-22 12:35:56 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-22 12:35:56 +0000 |
| commit | 0ae28209f1213ad3a70b825d7fff26ce7e374aad (patch) | |
| tree | 761928438d642b94b3a9f7a98fc41297d5390623 /nixos/modules/services/torrent | |
| parent | 6ee48dcedd948cc9b1f29a2ebeb5f0cde5180e4d (diff) | |
| parent | accbc67b046c4391d6bb6340044b79fb15f34020 (diff) | |
Merge pull request #267319 from ju1m/transmission
nixos/transmission: fixes #258793
Diffstat (limited to 'nixos/modules/services/torrent')
| -rw-r--r-- | nixos/modules/services/torrent/transmission.nix | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix index 7fb7847ce9358..94919509ce179 100644 --- a/nixos/modules/services/torrent/transmission.nix +++ b/nixos/modules/services/torrent/transmission.nix @@ -314,6 +314,9 @@ in BindPaths = [ "${cfg.home}/${settingsDir}" cfg.settings.download-dir + # Transmission may need to read in the host's /run (eg. /run/systemd/resolve) + # or write in its private /run (eg. /run/host). + "/run" ] ++ optional cfg.settings.incomplete-dir-enabled cfg.settings.incomplete-dir ++ @@ -324,7 +327,6 @@ in # an AppArmor profile is provided to get a confinement based upon paths and rights. builtins.storeDir "/etc" - "/run" ] ++ optional (cfg.settings.script-torrent-done-enabled && cfg.settings.script-torrent-done-filename != null) @@ -349,10 +351,10 @@ in MemoryDenyWriteExecute = true; NoNewPrivileges = true; PrivateDevices = true; - PrivateMounts = true; + PrivateMounts = mkDefault true; PrivateNetwork = mkDefault false; PrivateTmp = true; - PrivateUsers = true; + PrivateUsers = mkDefault true; ProtectClock = true; ProtectControlGroups = true; # ProtectHome=true would not allow BindPaths= to work across /home, |