From 4ee7a3abc12bc8cb4e503f6b4fe2995a20dc203f Mon Sep 17 00:00:00 2001
From: Sarah <cid+git@cid-chan.moe>
Date: Sun, 17 Oct 2021 14:05:45 +0200
Subject: [PATCH] Let's disable some security.

---
 module.nix | 50 +++++++++++++++++++++++++-------------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/module.nix b/module.nix
index 06981d1..1b0710c 100644
--- a/module.nix
+++ b/module.nix
@@ -62,33 +62,33 @@ in
         Group = cfg.group;
 
         PrivateMounts = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateIPC = true;
-        PrivateUsers = true;
+        # PrivateDevices = true;
+        # PrivateTmp = true;
+        # PrivateIPC = true;
+        # PrivateUsers = true;
 
-        SystemCallFilters = [
-          "@aio"
-          "@basic-io"
-          "@file-system"
-          "@io-event"
-          "@process"
-          "@network-io"
-          "@timer"
-          "@signal"
-          "@alarm"
-        ];
-        SystemCallErrorNumber = "EPERM";
+        # SystemCallFilters = [
+        #   "@aio"
+        #   "@basic-io"
+        #   "@file-system"
+        #   "@io-event"
+        #   "@process"
+        #   "@network-io"
+        #   "@timer"
+        #   "@signal"
+        #   "@alarm"
+        # ];
+        # SystemCallErrorNumber = "EPERM";
 
-        ProtectSystem = "full";
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectClock = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectKernelLogs = true;
-        ProtectControlGroups = true;
-        RestrictNamespaces = "";
+        # ProtectSystem = "full";
+        # ProtectHome = true;
+        # ProtectHostname = true;
+        # ProtectClock = true;
+        # ProtectKernelTunables = true;
+        # ProtectKernelModules = true;
+        # ProtectKernelLogs = true;
+        # ProtectControlGroups = true;
+        # RestrictNamespaces = "";
 
         NoNewPrivileges = true;
         ReadOnlyPaths = lib.mkMerge [