Unverified Commit a34a8fb9 authored by misuzu's avatar misuzu Committed by GitHub
Browse files

nixos/nfc-nci: Adjust pcscd system call hardening (#508319)

parents 5f1cea8d d62b05d7

nixos/modules/hardware/nfc-nci.nix

+5 −0
Original line number Diff line number Diff line
@@ -185,6 +185,11 @@ in 
      "nxp-pn5xx"

    ];



    # libnfc-nci calls sched_setscheduler via pthread_setschedparam, which would be blocked by upstream SystemCallFilter=~@resources

    systemd.services.pcscd.serviceConfig.SystemCallFilter = lib.mkIf cfg.enableIFD [

      "sched_setscheduler"

    ];



    services.pcscd.readerConfigs = lib.mkIf cfg.enableIFD [

      ''

        FRIENDLYNAME "NFC NCI"