nixos/botamusique: allow syscalls in the @resources group

Calls to ffmpeg from botamusique require the `set_mempolicy` syscall. Fixes: NixOS#205702
mweinelt · Dec 12, 2022 · d6f4f45 · d6f4f45
1 parent 72ce854
commit d6f4f45
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/nixos/modules/services/audio/botamusique.nix b/nixos/modules/services/audio/botamusique.nix
@@ -103,9 +103,8 @@ in
         StateDirectory = "botamusique";
         SystemCallArchitectures = "native";
         SystemCallFilter = [
-          "@system-service"
+          "@system-service @resources"
           "~@privileged"
-          "~@resources"
         ];
         UMask = "0077";
         WorkingDirectory = "/var/lib/botamusique";