vpn: set capabilities

2026-08-19 21:41:54 +03:00
parent e216e9bc7a
commit fe4052fe73
1 changed files with 21 additions and 1 deletions
@@ -1,8 +1,28 @@
-{
+{ lib, ... }: {
  programs.clash-verge = {
    enable = true;
    serviceMode = true;
    tunMode = true;
    autoStart = true;
  };
+
+  systemd.services.clash-verge.serviceConfig = {
+    CapabilityBoundingSet = lib.mkForce [
+      "CAP_NET_ADMIN"
+      "CAP_NET_RAW"
+      "CAP_SYS_ADMIN"
+      "CAP_DAC_OVERRIDE"
+      "CAP_DAC_READ_SEARCH"
+      "CAP_SYS_PTRACE"
+      "CAP_SETUID"
+      "CAP_SETGID"
+      "CAP_CHOWN"
+      "CAP_MKNOD"
+    ];
+
+    AmbientCapabilities = [
+      "CAP_DAC_READ_SEARCH"
+      "CAP_SYS_PTRACE"
+    ];
+  };
 }