anchor.diff:              '';
             };
   
  +          localSourceAllow = mkOption {
  +            type = types.listOf types.str;
  +            description = ''
  +              Permissions granted for the <option>services.syncoid.user</option> user
  +              for local source datasets. See
  +              <link xlink:href="https://openzfs.github.io/openzfs-docs/man/8/zfs-allow.8.html"/>
  +              for available permissions.
  +              Defaults to <option>services.syncoid.localSourceAllow</option> option.
  +            '';
  +          };
  +
  +          localTargetAllow = mkOption {
  +            type = types.listOf types.str;
  +            description = ''
  +              Permissions granted for the <option>services.syncoid.user</option> user
  +              for local target datasets. See
  +              <link xlink:href="https://openzfs.github.io/openzfs-docs/man/8/zfs-allow.8.html"/>
  +              for available permissions.
  +              Make sure to include the <literal>change-key</literal> permission if you send raw encrypted datasets,
  +              the <literal>compression</literal> permission if you send raw compressed datasets, and so on.
  +              For remote target datasets you'll have to set your remote user permissions by yourself.
  +            '';
  +          };
  +
             sendOptions = mkOption {
               type = types.separatedString " ";
               default = "";
  
positive.code:             path = [ "/run/booted-system/sw/bin/" ];
              serviceConfig = {
                ExecStartPre =
                  # Permissions snapshot and destroy are in case --no-sync-snap is not used
                  (map (buildAllowCommand "allow" [ "bookmark" "hold" "send" "snapshot" "destroy" ]) (localDatasetName c.source)) ++
                  (map (buildAllowCommand "allow" [ "create" "mount" "receive" "rollback" ]) (localDatasetName c.target));
                ExecStopPost =
                  # Permissions snapshot and destroy are in case --no-sync-snap is not used
                  (map (buildAllowCommand "unallow" [ "bookmark" "hold" "send" "snapshot" "destroy" ]) (localDatasetName c.source)) ++
                  (map (buildAllowCommand "unallow" [ "create" "mount" "receive" "rollback" ]) (localDatasetName c.target));
                ExecStart = lib.escapeShellArgs ([ "${pkgs.sanoid}/bin/syncoid" ]
                  ++ optionals c.useCommonArgs cfg.commonArgs
                  ++ optional c.recursive "-r"
  
negative.code:         config = {
            source = mkDefault name;
            sshKey = mkDefault cfg.sshKey;
            localSourceAllow = mkDefault cfg.localSourceAllow;
            localTargetAllow = mkDefault cfg.localTargetAllow;
          };
        }));
        default = { };
  