nixos/postgresql: relax hardening for plv8 plugin

NixOS · Nov 10, 2024 · 5b1bddb · 5b1bddb
1 parent f5f87e7
commit 5b1bddb
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
@@ -2,6 +2,7 @@
 
 let
   inherit (lib)
+    any
     attrValues
     concatMapStrings
     concatStringsSep
@@ -60,6 +61,8 @@ let
 
   groupAccessAvailable = versionAtLeast postgresql.version "11.0";
 
+  pluginNames = map (plugin: plugin.pname) postgresql.extraPlugins;
+  wantsPlugin = plugin: elem plugin plugin pluginNames;
 in
 
 {
@@ -654,10 +657,12 @@ in
             RestrictRealtime = true;
             RestrictSUIDSGID = true;
             SystemCallArchitectures = "native";
-            SystemCallFilter = [
-              "@system-service"
-              "~@privileged @resources"
-            ];
+            SystemCallFilter =
+              [
+                "@system-service"
+                "~@privileged @resources"
+              ]
+              ++ lib.optionals (any wantsPlugin [ "plv8" ]) [ "@pkey" ];
             UMask = if groupAccessAvailable then "0027" else "0077";
           }
           (mkIf (cfg.dataDir != "/var/lib/postgresql") {