wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-06-30 11:43:15 +02:00
Code Activity

Always attempt setgroups but allow failure to be ignored.

Browse source
This commit is contained in:
Ben Radford 2023-07-11 10:44:03 +01:00
parent 25b20b4ad2
commit 07dabcc90e
No known key found for this signature in database
GPG key ID: 9DF5D4640AB888D5
3 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/libstore/globals.hh
View file

@ -524,7 +524,7 @@ public:
Setting<bool> sandboxFallback{this, true, "sandbox-fallback",
"Whether to disable sandboxing when the kernel doesn't allow it."};
Setting<bool> dropSupplementaryGroups{this, getuid() == 0, "drop-supplementary-groups",
Setting<bool> requireDropSupplementaryGroups{this, true, "require-drop-supplementary-groups",
R"(
Whether to drop supplementary groups when building with sandboxing.
This is normally a good idea if we are root and have the capability to