From d43c6dd10067d30ded58dad45382c94c427444bf Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Fri, 30 Jan 2026 00:43:57 +0100
Subject: [PATCH] libstore: use raw syscall for inVFork setgroups

Change-Id: Ia656d2697b883d2b058984787556915b34f44211
---
 lix/libstore/platform/linux.cc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc
index 266a8e5aa..c285771c7 100644
--- a/lix/libstore/platform/linux.cc
+++ b/lix/libstore/platform/linux.cc
@@ -1637,9 +1637,9 @@ Pid LinuxLocalDerivationGoal::startChild(
             context.cgroup->adoptProcess(getpid());
         }
 
-        /* Drop additional groups here because we can't do it
-           after we're in the new user namespace. */
-        if (setgroups(0, 0) == -1) {
+        // Drop additional groups here because we can't do it after we're in the
+        // new user namespace. check `asVFork` for why we use raw syscalls here.
+        if (syscall(SYS_setgroups, 0, nullptr) == -1) {
             if (errno != EPERM)
                 throw SysError("setgroups failed");
             if (settings.requireDropSupplementaryGroups)