programs: iproute: use a less restrictive sandbox

2024-03-26 10:54:29 +00:00
parent 3cf42db7dc
commit fb79ca4c8e
1 changed files with 4 additions and 0 deletions
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -552,6 +552,10 @@ in
    iproute2.sandbox.method = "landlock";
    iproute2.sandbox.net = "all";
    iproute2.sandbox.capabilities = [ "net_admin" ];
+    iproute2.sandbox.extraPaths = [
+      "/run/netns"  # for `ip netns ...` to work
+      "/var/run/netns"
+    ];

    iptables.sandbox.method = "landlock";
    iptables.sandbox.net = "all";