Merge pull request #7856 from yorickvP/fix-nsswitch

Wait with making /etc unwritable until after build env setup

src/libstore/build/local-derivation-goal.cc

@@ -971,10 +971,6 @@ void LocalDerivationGoal::startBuilder()
  "nobody:x:65534:65534:Nobody:/:/noshell\n",
  sandboxUid(), sandboxGid(), settings.sandboxBuildDir));
 
- /* Make /etc unwritable */
- if (!parsedDrv->useUidRange())
- chmod_(chrootRootDir + "/etc", 0555);
-
  /* Save the mount- and user namespace of the child. We have to do this
  *before* the child does a chroot. */
  sandboxMountNamespace = open(fmt("/proc/%d/ns/mnt", (pid_t) pid).c_str(), O_RDONLY);
@@ -1855,6 +1851,10 @@ void LocalDerivationGoal::runChild()
  }
  }
 
+ /* Make /etc unwritable */
+ if (!parsedDrv->useUidRange())
+ chmod_(chrootRootDir + "/etc", 0555);
+
  /* Unshare this mount namespace. This is necessary because
  pivot_root() below changes the root of the mount
  namespace. This means that the call to setns() in