From dde8eeb39ae9fb73011462c74e5fa6405e432147 Mon Sep 17 00:00:00 2001
From: Graham Christensen <graham@grahamc.com>
Date: Sat, 11 May 2019 15:57:38 -0400
Subject: [PATCH] chdir, setgroups

---
 src/libstore/build.cc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index f38d2eaa0..8397cd0d1 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -466,8 +466,12 @@ void handleDiffHook(bool allowVfork, uid_t uid, uid_t gid, Path tryA, Path tryB,
     auto diffHook = settings.diffHook;
     if (diffHook != "" && settings.runDiffHook) {
         auto wrapper = [&]() {
+            if (chdir("/") == -1)
+                throw SysError("chdir / failed");
             if (setgid(gid) == -1)
                 throw SysError("setgid failed");
+            if (setgroups(0, 0) == -1)
+                throw SysError("setgroups failed");
             if (setuid(uid) == -1)
                 throw SysError("setuid failed");