1 files changed, 9 insertions, 4 deletions

diff --git a/hosts/vidhar/borg/copy.py b/hosts/vidhar/borg/copy.py
index 4bfae1cb..9dac86ae 100755
--- a/hosts/vidhar/borg/copy.py
+++ b/hosts/vidhar/borg/copy.py
@@ -21,6 +21,7 @@ from xdg import xdg_runtime_dir
 import pathlib
 
 import unshare
+import pyprctl
 
 import signal
 from time import sleep
@@ -93,15 +94,19 @@ def copy_archive(src_repo_path, dst_repo_path, entry):
         child = os.fork()
         if child == 0:
             # print('unshare/chroot', file=stderr)
-            uid_map_content = f'0 {os.getuid()} 1\n0 0 1'
-            gid_map_content = f'0 {os.getgid()} 1\n0 0 1'
+            uid, gid = os.getuid(), os.getgid()
             unshare.unshare(unshare.CLONE_NEWNS | unshare.CLONE_NEWUSER)
             with open('/proc/self/setgroups', 'w') as setgroups:
                 setgroups.write('deny')
             with open('/proc/self/uid_map', 'w') as uid_map:
-                uid_map.write(uid_map_content)
+                uid_map.write(f'0 {uid} 1')
             with open('/proc/self/gid_map', 'w') as gid_map:
-                gid_map.write(gid_map_content)
+                gid_map.write(f'0 {gid} 1')
+            pyprctl.cap_ambient_raise(pyprctl.Cap.SYS_ADMIN)
+            with open('/proc/self/uid_map', 'w') as uid_map:
+                uid_map.write(f'{uid} {uid} 1')
+            with open('/proc/self/gid_map', 'w') as gid_map:
+                gid_map.write(f'{gid} {gid} 1')
             subprocess.run(['mount', '--make-rprivate', '/'], check=True)
             chroot = pathlib.Path(tmpdir) / 'chroot'
             upper = pathlib.Path(tmpdir) / 'upper'