From 340154c843b17aaa492bdd1a193762b6d63372f0 Mon Sep 17 00:00:00 2001
From: Soispha <soispha@vhack.eu>
Date: Wed, 2 Aug 2023 14:16:57 +0200
Subject: Revert: "Fix(system/services/nix-sync): Remove the last access to the
 file system"

This reverts commit 89695f07d3a82fa7651b3c599b2b9327ecb6d097 because it
did not do anything, besides cause `nix` to spit some warnings.
---
 system/services/nix-sync/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'system/services/nix-sync')

diff --git a/system/services/nix-sync/default.nix b/system/services/nix-sync/default.nix
index 11cb551..8c466b8 100644
--- a/system/services/nix-sync/default.nix
+++ b/system/services/nix-sync/default.nix
@@ -104,7 +104,7 @@
       LogsDirectory = "nix-sync";
       LogsDirectoryMode = "0750";
       # Proc filesystem
-      ProcSubset = "pid";
+      ProcSubset = "all";
       ProtectProc = "invisible";
       # New file permissions
       UMask = "0027"; # 0640 / 0750
@@ -115,7 +115,7 @@
       NoNewPrivileges = true;
       # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
       ReadWritePaths = ["${esa (parents repo.path)}" "-${esa repoCachePath}" "-${esa cfg.cachePath}"];
-      # ReadOnlyPaths = ["/nix"];
+      ReadOnlyPaths = ["/nix"];
       ProtectSystem = "strict";
       ProtectHome = true;
       PrivateTmp = true;
-- 
cgit 1.4.1