Change:
Ananicy systemd service fails. Here's the log from journal: The service gets auto-restarted after that failure and the next error is different: Also, here's the stack trace from coredump: Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Works fine on non-hardened linux.
This also works fine: Seems like the issue is with ananicy-cpp.
Could you try with the latest kernel, though I am not sure how a kernel change could be impacting this. EDIT: it is failing to load BPF programs, using the latest kernel (6.9+ as of now) should fix things.
I can't check 6.9 because I'm on zfs. With 6.8 hardened the error is still there.
You could try 's cachyos hardended kernel. That is on 6.9 AFAIK.
on regular linux-cachyos (6.9) works fine. i suppose will work on cachyos-hardenedas well, but if you mind - i'll test.
core dumped..
so. after some tests we came to a suggestion that this is hardened kernel issue: ! i've and Luis tested it out. on on my end nothing gone wrong, benchmark done and done well. as suggested - you can try from chaotic-nyx flake, but not hardened one. :D
To be honest any non-hardened kernel should work.
Yeah, works fine with default . I think it's possible to build with netlink instead of bpf. Maybe this would work on hardened? nvm, it's
That's not it. On nixos I have in with .
'k!
ones might be important? <details</details
In order ananicy-cpp to function, make sure that kernelparams "debugfs=off" is not set.
Thanks is the default on hardened. Adding to cmdline fixes the issue. Doesn't work with .
Compiling with cmake flag also makes it work (with the default ).
Seems like debugfs is not required, only tracefs, which can be enabled with
Good to know. Maybe i'll disable once again debugfs.
So I think the fix should be to disable on hardened kernel?
I've realized that we cannot do the check whether kernel is hardened or not in package itself. I was thinking, that the best course of action would be to create nixos module for ananicy-cpp.
sounds actually good, i agree with it. :D
Please test , just override
I disabled debugfs and tracefs, and tested it like this: No more errors.
The problem with debugs/tracefs is that it seems like there's no nixos way to check for debufs/tracefs. I was thinking of adding option which would default to false on hardened and true otherwise. With we could add an assert for .
No need to add an additional module. You can check if 's pname == 's pname AND , then the override should be applied. You could send the patch here and I'll commit it for you, or send another PR after I merge this.
I think it would be better to expose withBpf as module option so it can be documented properly for the users.
should disable BPF in Ananicy-CPP by default if hardened is enabled.

Discussion:
<del> { config, lib, pkgs, ... }: with lib; </del> <ins> { config, lib, pkgs, ... }: </ins> let cfg = config.services.ananicy; <del> configFile = pkgs.writeText "ananicy.conf" (generators.toKeyValue { } cfg.settings); extraRules = pkgs.writeText "extraRules" (concatMapStringsSep "n" (l: builtins.toJSON l) cfg.extraRules); extraTypes = pkgs.writeText "extraTypes" (concatMapStringsSep "n" (l: builtins.toJSON l) cfg.extraTypes); extraCgroups = pkgs.writeText "extraCgroups" (concatMapStringsSep "n" (l: builtins.toJSON l) cfg.extraCgroups); servicename = if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then "ananicy-cpp" else "ananicy"; </del> <ins> configFile = pkgs.writeText "ananicy.conf" (lib.generators.toKeyValue { } cfg.settings); extraRules = pkgs.writeText "extraRules" ( lib.concatMapStringsSep "n" (l: builtins.toJSON l) cfg.extraRules ); extraTypes = pkgs.writeText "extraTypes" ( lib.concatMapStringsSep "n" (l: builtins.toJSON l) cfg.extraTypes ); extraCgroups = pkgs.writeText "extraCgroups" ( lib.concatMapStringsSep "n" (l: builtins.toJSON l) cfg.extraCgroups ); servicename = if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-pp)) then "ananicy-cpp" else "ananicy"; # Ananicy-CPP with BPF is not supported on hardened kernels https://github.com/NixOS/nixpkgs/issues/327382 finalPackage = if (servicename == "ananicy-cpp" && config.boot.kernelPackages.isHardened) then (cfg.package { withBpf = false; }) else cfg.package; </ins> in { <del> options = { services.ananicy = { enable = mkEnableOption "Ananicy, an auto nice daemon"; </del> <ins> options.services.ananicy = { enable = lib.mkEnableOption "Ananicy, an auto nice daemon"; </ins> <del> package = mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; }; </del> <ins> package = lib.mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; }; </ins> <del> rulesProvider = mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; } // { description = '' Which package to copy default rules,types,cgroups from. ''; }; </del> <ins> rulesProvider = lib.mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; } // { description = '' Which package to copy default rules,types,cgroups from. ''; }; </ins> <del> settings = mkOption { type = with types; attrsOf (oneOf [ int bool str ]); default = { }; example = { apply_nice = false; }; description = '' See <https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf> ''; </del> <ins> settings = lib.mkOption { type = with lib.types; attrsOf (oneOf [ int bool str ]); default = { }; example = { apply_nice = false; </ins> }; <ins> description = '' See <https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf> ''; }; </ins> <del> extraRules = mkOption { type = with types; listOf attrs; default = [ ]; description = '' Rules to write in 'nixRules.rules'. See: <https://github.com/Nefelim4ag/Ananicy#configuration> <https://gitlab.com/ananicy-cpp/ananicy-cpp/#global-configuration> ''; example = [ { name = "eog"; type = "Image-Viewer"; } { name = "fdupes"; type = "BG_CPUIO"; } ]; }; extraTypes = mkOption { type = with types; listOf attrs; default = [ ]; description = '' Types to write in 'nixTypes.types'. See: <https://gitlab.com/ananicy-cpp/ananicy-cpp/#types> ''; example = [ { type = "my_type"; nice = 19; other_parameter = "value"; } { type = "compiler"; nice = 19; sched = "batch"; ioclass = "idle"; } ]; }; extraCgroups = mkOption { type = with types; listOf attrs; default = [ ]; description = '' Cgroups to write in 'nixCgroups.cgroups'. See: <https://gitlab.com/ananicy-cpp/ananicy-cpp/#cgroups> ''; example = [ { cgroup = "cpu80"; CPUQuota = 80; } ]; }; </del> <ins> extraRules = lib.mkOption { type = with lib.types; listOf attrs; default = [ ]; description = '' Rules to write in 'nixRules.rules'. See: <https://github.com/Nefelim4ag/Ananicy#configuration> <https://gitlab.com/ananicy-cpp/ananicy-cpp/#global-configuration> ''; example = [ { name = "eog"; type = "Image-Viewer"; } { name = "fdupes"; type = "BG_CPUIO"; } ]; }; extraTypes = lib.mkOption { type = with lib.types; listOf attrs; default = [ ]; description = '' Types to write in 'nixTypes.types'. See: <https://gitlab.com/ananicy-cpp/ananicy-cpp/#types> ''; example = [ { type = "my_type"; nice = 19; other_parameter = "value"; } { type = "compiler"; nice = 19; sched = "batch"; ioclass = "idle"; } ]; }; extraCgroups = lib.mkOption { type = with lib.types; listOf attrs; default = [ ]; description = '' Cgroups to write in 'nixCgroups.cgroups'. See: <https://gitlab.com/ananicy-cpp/ananicy-cpp/#cgroups> ''; example = [ { cgroup = "cpu80"; CPUQuota = 80; } ]; </ins> }; }; <del> config = mkIf cfg.enable { </del> <ins> config = lib.mkIf cfg.enable { </ins> environment = { <del> systemPackages = [ cfg.package ]; </del> <ins> systemPackages = [ finalPackage ]; </ins> etc."ananicy.d".source = pkgs.runCommandLocal "ananicyfiles" { } '' mkdir -p $out # ananicy-cpp does not include rules or settings on purpose

# configured through .setings rm -f $out/ananicy.conf cp ${configFile} $out/ananicy.conf <del> ${optionalString (cfg.extraRules != [ ]) "cp ${extraRules} $out/nixRules.rules"} ${optionalString (cfg.extraTypes != [ ]) "cp ${extraTypes} $out/nixTypes.types"} ${optionalString (cfg.extraCgroups != [ ]) "cp ${extraCgroups} $out/nixCgroups.cgroups"} </del> <ins> ${lib.optionalString (cfg.extraRules != [ ]) "cp ${extraRules} $out/nixRules.rules"} ${lib.optionalString (cfg.extraTypes != [ ]) "cp ${extraTypes} $out/nixTypes.types"} ${lib.optionalString (cfg.extraCgroups != [ ]) "cp ${extraCgroups} $out/nixCgroups.cgroups"} </ins> ''; }; # ananicy and ananicy-cpp have different default settings services.ananicy.settings = let <del> mkOD = mkOptionDefault; </del> <ins> mkOD = lib.mkOptionDefault; </ins> in { cgroup_load = mkOD true;

apply_sched = mkOD true; apply_oom_score_adj = mkOD true; apply_cgroup = mkOD true; <del> } // (if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then { # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12 loglevel = mkOD "warn"; # default is info but its spammy cgroup_realtime_workaround = true; log_applied_rule = mkOD false; } else { # https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf check_disks_schedulers = mkOD true; check_freq = mkOD 5; }); </del> <ins> } // ( if servicename == "ananicy-cpp" then { # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12 loglevel = mkOD "warn"; # default is info but its spammy cgroup_realtime_workaround = true; log_applied_rule = mkOD false; } else { # https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf check_disks_schedulers = mkOD true; check_freq = mkOD 5; } ); </ins> systemd = { <del> packages = [ cfg.package ]; </del> <ins> packages = [ finalPackage ]; </ins> services."${servicename}" = { wantedBy = [ "default.target" ]; }; }; }; <del> meta = { maintainers = with maintainers; [ artturin ]; }; </del> <ins> meta.maintainers = with lib.maintainers; [ artturin ]; </ins> }