cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixos/grafana: allow @chown syscalls when using unix sockets

Browse source 
Grafana will unconditionally call chown on the socket after creating it,
even if the configuration does not ask for a different socket gid.
This commit is contained in:
D Anzorge 2022-12-13 02:47:50 +01:00
parent c2720cebe7
commit 9be81d0acf
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
nixos/modules/services/monitoring/grafana.nix
View file

@ -1291,7 +1291,10 @@ in {
SystemCallArchitectures = "native";
# Upstream grafana is not setting SystemCallFilter for compatibility
# reasons, see https://github.com/grafana/grafana/pull/40176
SystemCallFilter = [ "@system-service" "~@privileged" ];
SystemCallFilter = [
"@system-service"
"~@privileged"
] ++ lib.optional (cfg.settings.server.protocol == "socket") [ "@chown" ];
UMask = "0027";
};
preStart = ''