From 29d2ffc111ccf553314101dec44a1d9e6fd650dd Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Sat, 30 Apr 2022 15:35:45 +0200
Subject: [PATCH] defaultHardening: allow `clone3` system call

clone3 is the latest version of the clone system call, which is already
allowed.
clone3 is required by nbxplorer 2.3.20.
---
 pkgs/lib.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/lib.nix b/pkgs/lib.nix
index 5ac6e6e..6919ae6 100644
--- a/pkgs/lib.nix
+++ b/pkgs/lib.nix
@@ -33,7 +33,7 @@ let self = {
       # @system-service whitelist and docker seccomp blacklist (except for "clone"
       # which is a core requirement for systemd services)
       # @system-service is defined in src/shared/seccomp-util.c (systemd source)
-      SystemCallFilter = [ "@system-service" "~add_key clone3  kcmp keyctl mbind move_pages name_to_handle_at personality process_vm_readv process_vm_writev request_key set_mempolicy setns unshare userfaultfd" ];
+      SystemCallFilter = [ "@system-service" "~add_key kcmp keyctl mbind move_pages name_to_handle_at personality process_vm_readv process_vm_writev request_key set_mempolicy setns unshare userfaultfd" ];
       SystemCallArchitectures = "native";
   };