init: drop CAP_SYS_NICE from ambient set after gaining SCHED_RR (#14082)

1 files changed, 7 insertions, 0 deletions

diff --git a/src/init/initHelpers.cpp b/src/init/initHelpers.cpp
index f3911c04..5d4d0b25 100644
--- a/src/init/initHelpers.cpp
+++ b/src/init/initHelpers.cpp
@@ -1,3 +1,6 @@
+#include <linux/capability.h>
+#include <sys/prctl.h>
+
 #include "initHelpers.hpp"
 
 bool NInit::isSudo() {
@@ -21,6 +24,10 @@ void NInit::gainRealTime() {
         return;
     }
 
+    // NixOS-specific fix to prevent all children from inheriting
+    // CAP_SYS_NICE due to how the security wrapper works.
+    prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, CAP_SYS_NICE, 0, 0);
+
     pthread_atfork(nullptr, nullptr, []() {
         const struct sched_param param = {.sched_priority = 0};
         if (pthread_setschedparam(pthread_self(), SCHED_OTHER, &param))