nixos/modules/clash: add permissions to open /dev/net/tun

inclyc · Dec 29, 2023 · de27bd2 · de27bd2
1 parent ced0d7a
commit de27bd2
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/nixos/modules/clash/default.nix b/nixos/modules/clash/default.nix
@@ -48,10 +48,9 @@ in
           Restart = "on-failure";
           CapabilityBoundingSet = [ "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_NET_BIND_SERVICE" ];
           AmbientCapabilities = CapabilityBoundingSet;
+          DeviceAllowed = [ "/dev/net/tun" ];
           ProtectSystem = "strict";
           ProtectHome = "yes";
-          PrivateDevices = "yes";
-          PrivateUsers = "yes";
           ProtectHostname = "yes";
           ProtectClock = "yes";
           ProtectKernelTunables = "yes";