nixos/nix
1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-22 02:09:36 +01:00
Code Activity

Disable CLONE_NEWUSER when it’s unavailable

Browse source 
Some kernels disable "unpriveleged user namespaces". This is
unfortunate, but we can still use mount namespaces. Anyway, since each
builder has its own nixbld user, we already have most of the benefits
of user namespaces.
This commit is contained in:
Matthew Bauer 2019-07-25 09:37:57 -04:00
parent b640f69a4d
commit d171090530
2 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/nix/run.cc
View file

@ -199,7 +199,10 @@ void chrootHelper(int argc, char * * argv)
uid_t gid = getgid();
if (unshare(CLONE_NEWUSER | CLONE_NEWNS) == -1)
throw SysError("setting up a private mount namespace");
/* Try with just CLONE_NEWNS in case user namespaces are
specifically disabled. */
if (unshare(CLONE_NEWNS) == -1)
throw SysError("setting up a private mount namespace");
/* Bind-mount realStoreDir on /nix/store. If the latter mount
point doesn't already exists, we have to create a chroot