Merge pull request #205573 from mweinelt/evcc-fixups

This commit is contained in:
Martin Weinelt
2022-12-11 01:44:57 +01:00
committed by GitHub
2 changed files with 6 additions and 1 deletions

View File

@@ -48,7 +48,10 @@ in
wantedBy = [
"multi-user.target"
];
environment.HOME = "/var/lib/evcc";
path = with pkgs; [
glibc # requires getent
];
serviceConfig = {
ExecStart = "${package}/bin/evcc --config ${configFile} ${escapeShellArgs cfg.extraArgs}";
CapabilityBoundingSet = [ "" ];
@@ -77,6 +80,7 @@ in
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
StateDirectory = "evcc";
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"

View File

@@ -87,6 +87,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
with subtest("Check journal for errors"):
_, output = machine.execute("journalctl -o cat -u evcc.service")
assert "FATAL" not in output
assert "ERROR" not in output
with subtest("Check systemd hardening"):