nixos/ebusd: fix device access (#352743)

Changed files
+9 -3
nixos
modules
services
home-automation
+9 -3
nixos/modules/services/home-automation/ebusd.nix
···
config =
let
-
usesDev = lib.hasPrefix "/" cfg.device;
+
usesDev = lib.any (prefix: lib.hasPrefix prefix cfg.device) [
+
"/"
+
"ens:/"
+
"enh:/"
+
];
in
lib.mkIf cfg.enable {
systemd.services.ebusd = {
···
# Hardening
CapabilityBoundingSet = "";
-
DeviceAllow = lib.optionals usesDev [ cfg.device ];
+
DeviceAllow = lib.optionals usesDev [
+
(lib.removePrefix "ens:" (lib.removePrefix "enh:" cfg.device))
+
];
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = false;
NoNewPrivileges = true;
-
PrivateDevices = usesDev;
+
PrivateDevices = !usesDev;
PrivateUsers = true;
PrivateTmp = true;
ProtectClock = true;