buildFHSEnvOverlay: do additional unshare to drop capabilities

lowRISC · Sep 18, 2024 · 81b68fd · 81b68fd
1 parent dd6744c
commit 81b68fd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/buildFHSEnvOverlay.nix b/lib/buildFHSEnvOverlay.nix
@@ -187,7 +187,7 @@
       ldconfig &> /dev/null
 
       ${preExecHook}
-      exec ${runScript} "$@"
+      exec unshare -c -- ${runScript} "$@"
     '';
 
   init = writeShellScript "${name}-init" initCmd;