Restore parent mount namespace before executing a child process

This ensures that they can't write to /nix/store. Fixes #2535.

1 files changed, 2 insertions, 0 deletions

diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 1bbe256b2d8b..77898c632360 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -285,6 +285,8 @@ static int runProgram(const string & program, const Strings & args)
     if (pid == -1) throw SysError("forking");
     if (pid == 0) {
         restoreAffinity();
+        restoreSignals();
+        restoreMountNamespace();
         execvp(program.c_str(), stringsToCharPtrs(args2).data());
         _exit(1);
     }