diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index c2c1452e..7da5b1c5 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -1100,7 +1100,7 @@ in # These directives deny the subset of kernel capabilities it # provably doesn't need without restricting its network or # filesystem access (ProtectSystem / RestrictAddressFamilies are - # deferred to a follow-up with a watched deploy — see #1845). + # deferred to a follow-up with a watched deploy. NoNewPrivileges = true; # already runs as unprivileged user PrivateTmp = true; # hive-c0re and its nix subprocesses use tmpfiles under StateDirectory, not /tmp ProtectHome = true; # HOME = /var/lib/hyperhive (StateDirectory); no /home/* access needed