From e6c5040f417001fc3cf20e21f971f926626a0f6f Mon Sep 17 00:00:00 2001
From: ErrorNoInternet <errornointernet@envs.net>
Date: Wed, 15 Apr 2026 18:20:20 -0400
Subject: init: drop CAP_SYS_NICE from ambient set after gaining SCHED_RR
 (#14082)

---
 src/init/initHelpers.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'src/init/initHelpers.cpp')

diff --git a/src/init/initHelpers.cpp b/src/init/initHelpers.cpp
index f3911c04..5d4d0b25 100644
--- a/src/init/initHelpers.cpp
+++ b/src/init/initHelpers.cpp
@@ -1,3 +1,6 @@
+#include <linux/capability.h>
+#include <sys/prctl.h>
+
 #include "initHelpers.hpp"
 
 bool NInit::isSudo() {
@@ -21,6 +24,10 @@ void NInit::gainRealTime() {
         return;
     }
 
+    // NixOS-specific fix to prevent all children from inheriting
+    // CAP_SYS_NICE due to how the security wrapper works.
+    prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, CAP_SYS_NICE, 0, 0);
+
     pthread_atfork(nullptr, nullptr, []() {
         const struct sched_param param = {.sched_priority = 0};
         if (pthread_setschedparam(pthread_self(), SCHED_OTHER, &param))
-- 
cgit v1.2.3