Merge pull request #141823 from zopieux/fix-rtl433-hardening

2021-10-16 03:15:52 +02:00 · 2021-10-16 03:15:52 +02:00 · b84bf1f3c3
commit b84bf1f3c3
parent 785cd037fc 7fb3edb077
1 changed files with 5 additions and 0 deletions
--- a/nixos/modules/services/monitoring/prometheus/exporters/rtl_433.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/rtl_433.nix
@ -61,6 +61,11 @@ in
    serviceConfig = {
      # rtl-sdr udev rules make supported USB devices +rw by plugdev.
      SupplementaryGroups = "plugdev";
+      # rtl_433 needs rw access to the USB radio.
+      PrivateDevices = lib.mkForce false;
+      DeviceAllow = lib.mkForce "char-usb_device rw";
+      RestrictAddressFamilies = [ "AF_NETLINK" ];
+
      ExecStart = let
        matchers = (map (m:
          "--channel_matcher '${m.name},${toString m.channel},${m.location}'"