libstore: use raw syscall for inVFork setgroups

Change-Id: Ia656d2697b883d2b058984787556915b34f44211
2026-01-30 00:29:27 +00:00
parent ab4f8718f9
commit d43c6dd100
1 changed files with 3 additions and 3 deletions
@@ -1637,9 +1637,9 @@ Pid LinuxLocalDerivationGoal::startChild(
            context.cgroup->adoptProcess(getpid());
        }

-        /* Drop additional groups here because we can't do it
-           after we're in the new user namespace. */
-        if (setgroups(0, 0) == -1) {
+        // Drop additional groups here because we can't do it after we're in the
+        // new user namespace. check `asVFork` for why we use raw syscalls here.
+        if (syscall(SYS_setgroups, 0, nullptr) == -1) {
            if (errno != EPERM)
                throw SysError("setgroups failed");
            if (settings.requireDropSupplementaryGroups)