Fix "Bad system call" running i686-linux binaries on x86_64-linux

To determine which seccomp filters to install, we were incorrectly
using settings.thisSystem, which doesn't denote the actual system when
--system is used.

Fixes #2791.

2 files changed, 7 insertions, 0 deletions

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index e3dcd246c681..a7170566533e 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -38,6 +38,9 @@ extern char * * environ;
 namespace nix {
 
 
+const std::string nativeSystem = SYSTEM;
+
+
 BaseError & BaseError::addPrefix(const FormatOrString & fs)
 {
     prefix_ = fs.s + prefix_;
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 9f239bff371a..54936a5cb10b 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -30,6 +30,10 @@ struct Sink;
 struct Source;
 
 
+/* The system for which Nix is compiled. */
+extern const std::string nativeSystem;
+
+
 /* Return an environment variable. */
 string getEnv(const string & key, const string & def = "");