From d13640f3d7e4a1dd7871fa4a08d4b2b0d11303b6 Mon Sep 17 00:00:00 2001 From: Yorick van Pelt Date: Fri, 17 Feb 2023 16:31:55 +0100 Subject: [PATCH] Wait with making /etc unwritable until after build env setup This fixes /etc/nsswitch.conf (cherry picked from commit bbba49b3e42fb4bacd9b253f41291dc381ba10db) --- src/libstore/build/local-derivation-goal.cc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc index c34d96af62b..fc0b021fa0c 100644 --- a/src/libstore/build/local-derivation-goal.cc +++ b/src/libstore/build/local-derivation-goal.cc @@ -1025,10 +1025,6 @@ void LocalDerivationGoal::startBuilder() "nobody:x:65534:65534:Nobody:/:/noshell\n", sandboxUid(), sandboxGid(), settings.sandboxBuildDir)); - /* Make /etc unwritable */ - if (!parsedDrv->useUidRange()) - chmod_(chrootRootDir + "/etc", 0555); - /* Save the mount- and user namespace of the child. We have to do this *before* the child does a chroot. */ sandboxMountNamespace = open(fmt("/proc/%d/ns/mnt", (pid_t) pid).c_str(), O_RDONLY); @@ -1913,6 +1909,10 @@ void LocalDerivationGoal::runChild() } } + /* Make /etc unwritable */ + if (!parsedDrv->useUidRange()) + chmod_(chrootRootDir + "/etc", 0555); + /* Unshare this mount namespace. This is necessary because pivot_root() below changes the root of the mount namespace. This means that the call to setns() in