From b41af64d1eeea7146731d9c6022f681bb51f9335 Mon Sep 17 00:00:00 2001 From: eldritch horrors Date: Fri, 30 Jan 2026 18:41:41 +0100 Subject: [PATCH] libstore: compile linux syscall filter in prepareSandbox this is literally part of preparing the sandbox. Change-Id: Ic1a574bdaa68b5f39326b91c10198b774f7b2f7e --- lix/libstore/platform/linux.cc | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc index f6b1fe8ce..1665b8a79 100644 --- a/lix/libstore/platform/linux.cc +++ b/lix/libstore/platform/linux.cc @@ -1035,6 +1035,13 @@ void LinuxLocalDerivationGoal::setupSyscallFilter() void LinuxLocalDerivationGoal::prepareSandbox() { +#if HAVE_SECCOMP + // Our seccomp filter program is surprisingly expensive to compile (~10ms). + // For this reason, we precompile it once and then cache it. + // This has to be done in the parent so that all builds get to use the same cache. + getSyscallFilter(); +#endif + /* Create a temporary directory in which we set up the chroot environment using bind-mounts. We put it in the Nix store to ensure that we can create hard-links to non-directory @@ -1514,13 +1521,6 @@ Pid LinuxLocalDerivationGoal::startChild( const Path & builder, const Strings & envStrs, const Strings & args, AutoCloseFD logPTY ) { -#if HAVE_SECCOMP - // Our seccomp filter program is surprisingly expensive to compile (~10ms). - // For this reason, we precompile it once and then cache it. - // This has to be done in the parent so that all builds get to use the same cache. - getSyscallFilter(); -#endif - // If we're not sandboxing no need to faff about, use the fallback if (!useChroot) { return LocalDerivationGoal::startChild(builder, envStrs, args, std::move(logPTY));