nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-22 23:13:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/ananicy: disable ananicy-cpp's BPF on hardened kernels

Browse Source
This commit is contained in:
John Titor 2024-08-02 15:06:35 +05:30
parent d626da64ec
commit 2cf5032969
No known key found for this signature in database
GPG Key ID: 29B0514F4E3C1CC0
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
nixos/modules/services/misc/ananicy.nix
View File

@ -18,7 +18,13 @@ let
lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraCgroups
);
servicename =
if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then "ananicy-cpp" else "ananicy";
if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-pp)) then "ananicy-cpp" else "ananicy";
# Ananicy-CPP with BPF is not supported on hardened kernels https://github.com/NixOS/nixpkgs/issues/327382
finalPackage =
if (servicename == "ananicy-cpp" && config.boot.kernelPackages.isHardened) then
(cfg.package { withBpf = false; })
else
cfg.package;
in
{
options.services.ananicy = {
@ -107,7 +113,7 @@ in
config = lib.mkIf cfg.enable {
environment = {
systemPackages = [ cfg.package ];
systemPackages = [ finalPackage ];
etc."ananicy.d".source = pkgs.runCommandLocal "ananicyfiles" { } ''
mkdir -p $out
# ananicy-cpp does not include rules or settings on purpose
@ -159,7 +165,7 @@ in
);
systemd = {
packages = [ cfg.package ];
packages = [ finalPackage ];
services."${servicename}" = {
wantedBy = [ "default.target" ];
};