nixos/logrotate: reorder setuid syscall group (#345487)

NixOS · Sep 30, 2024 · 16524a2 · 16524a2
2 parents f0ab201 + 4ca03e3
commit 16524a2
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/nixos/modules/services/logging/logrotate.nix b/nixos/modules/services/logging/logrotate.nix
@@ -261,6 +261,7 @@ in
  CapabilityBoundingSet = [
  "CAP_CHOWN"
  "CAP_DAC_OVERRIDE"
+ "CAP_KILL"
  "CAP_SETUID"
  "CAP_SETGID"
  ];
@@ -285,9 +286,9 @@ in
  RestrictSUIDSGID = false; # can create sgid directories
  SystemCallArchitectures = "native";
  SystemCallFilter = [
- "@system-service @setuid"
+ "@system-service"
  "~@privileged @resources"
- "@chown"
+ "@chown @setuid"
  ];
  UMask = "0027";
  } // lib.optionalAttrs (!cfg.allowNetworking) {