security: enable full systemd-status for group 'proc'

Previously, systemd-status was broken for all users except root. Use a 'default' deny policy, which is overridden for group 'proc'. Add operator to group 'proc'. Also, remove redundant XML boilerplate.
2020-08-20 13:12:06 +02:00
parent 96ea2e671c
commit 588a0b2405
3 changed files with 25 additions and 16 deletions
@@ -227,6 +227,7 @@ in {
      isNormalUser = true;
      extraGroups = [
          "systemd-journal"
+          "proc" # Enable full /proc access and systemd-status
          cfg.bitcoind.group
        ]
        ++ (optionals cfg.clightning.enable [ "clightning" ])