From 5ba9a3961c592b569f6ad16f819645c7c73f05f0 Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Wed, 21 Jan 2026 15:59:30 +0100
Subject: [PATCH] libstore: move setupSyscallFilter to linux platform bits

setting them that little bit later really doesn't hurt us at all.

Change-Id: I6b50fbe0b58d037de729748cb4f87dd628bd111b
---
 lix/libstore/build/local-derivation-goal.cc | 2 --
 lix/libstore/build/local-derivation-goal.hh | 6 ------
 lix/libstore/platform/linux.cc              | 2 ++
 lix/libstore/platform/linux.hh              | 2 +-
 4 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc
index 3d8b8d9f9..d21b043b6 100644
--- a/lix/libstore/build/local-derivation-goal.cc
+++ b/lix/libstore/build/local-derivation-goal.cc
@@ -1127,8 +1127,6 @@ void LocalDerivationGoal::runChild()
 
         commonExecveingChildInit();
 
-        setupSyscallFilter();
-
         /* Make the contents of netrc and the CA certificate bundle
            available to builtin:fetchurl (which may run under a
            different uid and/or in a sandbox). */
diff --git a/lix/libstore/build/local-derivation-goal.hh b/lix/libstore/build/local-derivation-goal.hh
index 9c27bb1a7..4b21ae39f 100644
--- a/lix/libstore/build/local-derivation-goal.hh
+++ b/lix/libstore/build/local-derivation-goal.hh
@@ -316,12 +316,6 @@ protected:
     kj::Promise<Result<WorkResult>> handleRawChild() noexcept;
     kj::Promise<Result<std::optional<WorkResult>>> handleRawChildStream() noexcept;
 
-    /**
-     * Set up the system call filtering required for the sandbox.
-     * This currently only has an effect on Linux.
-     */
-    virtual void setupSyscallFilter() {}
-
     /**
      * Prepare the sandbox. Currently only used on linux to build the sandbox namespace,
      * write configuration files inside it, and to set up networking with pasta enabled.
diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc
index 15d4aa5b6..28ae74bdd 100644
--- a/lix/libstore/platform/linux.cc
+++ b/lix/libstore/platform/linux.cc
@@ -907,6 +907,8 @@ std::string LinuxLocalDerivationGoal::rewriteResolvConf(std::string fromHost)
 
 bool LinuxLocalDerivationGoal::prepareChildSetup()
 {
+    setupSyscallFilter();
+
     if (!useChroot) {
         return true;
     }
diff --git a/lix/libstore/platform/linux.hh b/lix/libstore/platform/linux.hh
index 00dc7206c..988b49c73 100644
--- a/lix/libstore/platform/linux.hh
+++ b/lix/libstore/platform/linux.hh
@@ -84,7 +84,7 @@ private:
      * Set up system call filtering using seccomp, unless disabled at build time.
      * This also sets the NO_NEW_PRIVS flag.
      */
-    void setupSyscallFilter() override;
+    void setupSyscallFilter();
 
     bool supportsUidRange() override
     {