vpn: set capabilities

2026-08-19 21:41:54 +03:00
parent e216e9bc7a
commit fe4052fe73
1 changed files with 21 additions and 1 deletions
@@ -1,8 +1,28 @@
-{
+{ lib, ... }: {
  programs.clash-verge = {
    enable = true;
    serviceMode = true;
    tunMode = true;
    autoStart = true;
  };
  systemd.services.clash-verge.serviceConfig = {
    CapabilityBoundingSet = lib.mkForce [
      "CAP_NET_ADMIN"
      "CAP_NET_RAW"
      "CAP_SYS_ADMIN"
      "CAP_DAC_OVERRIDE"
      "CAP_DAC_READ_SEARCH"
      "CAP_SYS_PTRACE"
      "CAP_SETUID"
      "CAP_SETGID"
      "CAP_CHOWN"
      "CAP_MKNOD"
    ];
    AmbientCapabilities = [
      "CAP_DAC_READ_SEARCH"
      "CAP_SYS_PTRACE"
    ];
  };
 }