[Backport release-24.11] nixos/ebusd: fix device access (#364192)

NixOS · Dec 11, 2024 · ecfbc4b · ecfbc4b
2 parents 7f64560 + 1ed38ed
commit ecfbc4b
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/nixos/modules/services/home-automation/ebusd.nix b/nixos/modules/services/home-automation/ebusd.nix
@@ -156,7 +156,11 @@ in
 
   config =
     let
-      usesDev = hasPrefix "/" cfg.device;
+      usesDev = lib.any (prefix: lib.hasPrefix prefix cfg.device) [
+        "/"
+        "ens:/"
+        "enh:/"
+      ];
     in
     mkIf cfg.enable {
       systemd.services.ebusd = {
@@ -201,12 +205,14 @@ in
 
           # Hardening
           CapabilityBoundingSet = "";
-          DeviceAllow = optionals usesDev [ cfg.device ];
+          DeviceAllow = lib.optionals usesDev [
+            (lib.removePrefix "ens:" (lib.removePrefix "enh:" cfg.device))
+          ];
           DevicePolicy = "closed";
           LockPersonality = true;
           MemoryDenyWriteExecute = false;
           NoNewPrivileges = true;
-          PrivateDevices = usesDev;
+          PrivateDevices = !usesDev;
           PrivateUsers = true;
           PrivateTmp = true;
           ProtectClock = true;