From a0ef21262f4d5652bfb65cfacaec01d89c475a93 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 13 Nov 2018 16:15:30 +0100
Subject: Restore parent mount namespace before executing a child process

This ensures that they can't write to /nix/store. Fixes #2535.
---
 src/nix/edit.cc | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'src/nix/edit.cc')

diff --git a/src/nix/edit.cc b/src/nix/edit.cc
index c9671f76d0fa..d8d5895bd867 100644
--- a/src/nix/edit.cc
+++ b/src/nix/edit.cc
@@ -3,6 +3,7 @@
 #include "eval.hh"
 #include "attr-path.hh"
 #include "progress-bar.hh"
+#include "affinity.hh"
 
 #include <unistd.h>
 
@@ -72,6 +73,10 @@ struct CmdEdit : InstallableCommand
 
         stopProgressBar();
 
+        restoreAffinity();
+        restoreSignals();
+        restoreMountNamespace();
+
         execvp(args.front().c_str(), stringsToCharPtrs(args).data());
 
         throw SysError("cannot run editor '%s'", editor);
-- 
cgit 1.4.1