From 040223da85e39f18225430eaee54feddaf419138 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sat, 1 Aug 2026 08:06:54 +0200
Subject: [PATCH] nixos/murmur: Harden /proc visibility by setting `ProcSubset`
 to `pid`

https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProcSubset=

Tested that the Mumble server still works and clients can connect to it.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/networking/murmur.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index 8f72e3c52b84..65c6725d8f50 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -386,6 +386,7 @@ in
         PrivateMounts = true;
         PrivateTmp = true;
         PrivateUsers = true;
+        ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = "strict";
         ProtectHome = true;