diff options
Diffstat (limited to 'src/libstore/globals.hh')
| -rw-r--r-- | src/libstore/globals.hh | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh index dec132ff0..9a9b4903f 100644 --- a/src/libstore/globals.hh +++ b/src/libstore/globals.hh @@ -524,7 +524,7 @@ public: Setting<bool> sandboxFallback{this, true, "sandbox-fallback", "Whether to disable sandboxing when the kernel doesn't allow it."}; - Setting<bool> requireDropSupplementaryGroups{this, true, "require-drop-supplementary-groups", + Setting<bool> requireDropSupplementaryGroups{this, getuid() == 0, "require-drop-supplementary-groups", R"( Following the principle of least privilege, Nix will attempt to drop supplementary groups when building with sandboxing. |