From 7e7260ef027221955db61dbaa65f395ceae664c3 Mon Sep 17 00:00:00 2001
From: lunik1 <ch.gpg@themaw.xyz>
Date: Fri, 3 Dec 2021 00:02:52 +0000
Subject: [PATCH] nixos/snapraid: relax permissions of snapraid-sync

Remove PrivateDevices to silence warning about SnapRAID being
unable to access disk UUIDs.

Add CAP_FOWNER when touch is enabled so file time stamps can be
set.

(cherry picked from commit 6073b099d05458ba4dc3ade6cae7cb838ae5b2b9)
---
 nixos/modules/tasks/snapraid.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/tasks/snapraid.nix b/nixos/modules/tasks/snapraid.nix
index 4529009930fc..ff956f306709 100644
--- a/nixos/modules/tasks/snapraid.nix
+++ b/nixos/modules/tasks/snapraid.nix
@@ -193,7 +193,6 @@ in
             LockPersonality = true;
             MemoryDenyWriteExecute = true;
             NoNewPrivileges = true;
-            PrivateDevices = true;
             PrivateTmp = true;
             ProtectClock = true;
             ProtectControlGroups = true;
@@ -208,7 +207,8 @@ in
             SystemCallArchitectures = "native";
             SystemCallFilter = "@system-service";
             SystemCallErrorNumber = "EPERM";
-            CapabilityBoundingSet = "CAP_DAC_OVERRIDE";
+            CapabilityBoundingSet = "CAP_DAC_OVERRIDE" ++
+              lib.optionalString cfg.touchBeforeSync " CAP_FOWNER";
 
             ProtectSystem = "strict";
             ProtectHome = "read-only";