@@ -1008,7 +1008,11 @@ in
10081008 #InaccessiblePaths = [ "-+${runDir}/root" ];
10091009 UMask = "0066";
10101010 BindPaths = [ stateDir ];
1011− BindReadOnlyPaths = [ storeDir "/etc" ];
1011+ BindReadOnlyPaths = [ storeDir "/etc" ] ++
1012+ optionals config.services.resolved.enable [
1013+ "/run/systemd/resolve/stub-resolv.conf"
1014+ "/run/systemd/resolve/resolv.conf"
1015+ ];
10121016 AmbientCapabilities = [""] ++ lib.optional bindsPrivilegedPort "CAP_NET_BIND_SERVICE";
10131017 CapabilityBoundingSet = [""] ++ lib.optional bindsPrivilegedPort "CAP_NET_BIND_SERVICE";
10141018 # ProtectClock= adds DeviceAllow=char-rtc r