nixos/modules/clash: add permissions to open /dev/net/tun

inclyc · Dec 29, 2023 · 01ed2c3 · 01ed2c3
1 parent ced0d7a
commit 01ed2c3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/nixos/modules/clash/default.nix b/nixos/modules/clash/default.nix
@@ -48,9 +48,9 @@ in
           Restart = "on-failure";
           CapabilityBoundingSet = [ "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_NET_BIND_SERVICE" ];
           AmbientCapabilities = CapabilityBoundingSet;
+          DeviceAllowed = [ "/dev/net/tun" ];
           ProtectSystem = "strict";
           ProtectHome = "yes";
-          PrivateDevices = "yes";
           PrivateUsers = "yes";
           ProtectHostname = "yes";
           ProtectClock = "yes";