Unshare mount namespace in main()

Doing it as a side-effect of calling LocalStore::makeStoreWritable()
is very ugly.

Also, make sure that stopping the progress bar joins the update
thread, otherwise that thread should be unshared as well.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/nix/main.cc b/src/nix/main.cc
index 1e033f4f2..01889a71f 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -255,6 +255,14 @@ void mainWrapped(int argc, char * * argv)
     initNix();
     initGC();
 
+    #if __linux__
+    if (getuid() == 0) {
+        saveMountNamespace();
+        if (unshare(CLONE_NEWNS) == -1)
+            throw SysError("setting up a private mount namespace");
+    }
+    #endif
+
     programPath = argv[0];
     auto programName = std::string(baseNameOf(programPath));