
"batch" is a shell script so invoking it via setuid wrapper never worked anyway. (The kernel drops perms on executables with shebang.) A previous nixpkgs commit made "batch" invoke the NixOS setuid "at" wrapper to gain needed privileges. Thanks to @yesbox for noticing.