* Urgh. Do setgid() before setuid(), because the semantics of setgid()

  changes completely depending on whether you're root...

1 files changed, 4 insertions, 4 deletions

diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 6e71c2c7d4e7..e4829883f936 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -1364,13 +1364,13 @@ void DerivationGoal::startBuilder()
                 if (setgroups(0, 0) == -1)
                     throw SysError("cannot clear the set of supplementary groups");
                 
-                setuid(buildUser.getUID());
-                assert(getuid() == buildUser.getUID());
-                assert(geteuid() == buildUser.getUID());
-
                 setgid(gidBuildGroup);
                 assert(getgid() == gidBuildGroup);
                 assert(getegid() == gidBuildGroup);
+
+                setuid(buildUser.getUID());
+                assert(getuid() == buildUser.getUID());
+                assert(geteuid() == buildUser.getUID());
             }
             
             /* Execute the program.  This should not return. */