lix-project/lix
22
83
Fork 57
Code Issues 519 Code Review (Gerrit) Projects 8 Releases Packages Wiki Activity

nix-daemon fails to lookup dynamically allocated users #1029

New issue
Open
opened 2025-11-07 01:30:12 +00:00 by mweinelt · 5 comments
mweinelt commented 2025-11-07 01:30:12 +00:00
Member
Copy link

Describe the bug

I have services that from dynamically allocated users (via systemd) make calls to the nix-daemon. Every once in a while nix-daemon starts denying access and logs that the uid is not allowed to connect.

I only ever configured the usernames as trusted, so if it cannot look up the username any more, then rip.

The stopping happens when I switch into a new generation.

# cat /etc/nsswitch.conf 
passwd:    files systemd
group:     files [success=merge] systemd
shadow:    files
sudoers:   files

hosts:     mymachines files myhostname dns
networks:  files

ethers:    files
services:  files
protocols: files
rpc:       files

# getent passwd 63182
gitea-runner:x:63182:63182:Dynamic User:/:/nix/store/nhs0ppna5rf03hrdd7nz34jagbxddk5q-util-linux-minimal-2.41.1-login/bin/nologin

Nov 02 18:19:36 pallas nix-daemon[2736]: accepted connection from pid 1889485, user gitea-runner (trusted)
Nov 02 18:20:21 pallas nix-daemon[2736]: accepted connection from pid 1889532, user gitea-runner (trusted)
Nov 02 20:05:55 pallas nix-daemon[2736]: accepted connection from pid 1898261, user gitea-runner (trusted)
Nov 02 20:06:16 pallas nix-daemon[2736]: accepted connection from pid 1898467, user gitea-runner (trusted)
Nov 03 07:39:54 pallas systemd[1]: Stopping Nix Daemon...
Nov 07 01:04:54 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon
Nov 07 01:04:56 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon
Nov 07 01:04:58 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon
Nov 07 01:05:00 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon
Nov 07 01:05:02 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon
Nov 07 01:07:24 pallas systemd[1]: Stopping Nix Daemon...
Nov 07 01:07:24 pallas systemd[1]: nix-daemon.service: Deactivated successfully.
Nov 07 01:07:24 pallas systemd[1]: Stopped Nix Daemon.
Nov 07 01:07:24 pallas systemd[1]: Started Nix Daemon.
Nov 07 01:07:32 pallas nix-daemon[2088798]: accepted connection from pid 2088910, user gitea-runner (trusted)
Nov 07 01:08:00 pallas nix-daemon[2088798]: accepted connection from pid 2091827, user gitea-runner (trusted)
Nov 07 01:08:00 pallas nix-daemon[2088798]: accepted connection from pid 2091825, user gitea-runner (trusted)
Nov 07 01:08:00 pallas nix-daemon[2088798]: accepted connection from pid 2091824, user gitea-runner (trusted)

Happens on multiple machines and the shared configuration is DynamicUser=.

Nov 02 23:08:06 juno nix-daemon[8071]: accepted connection from pid 101518, user mach-symbols-upload
Nov 02 23:10:03 juno nix-daemon[8071]: accepted connection from pid 101542, user mach-symbols-upload
Nov 02 23:11:55 juno nix-daemon[8071]: accepted connection from pid 101557, user mach-symbols-upload
Nov 02 23:13:55 juno nix-daemon[8071]: accepted connection from pid 101577, user mach-symbols-upload
Nov 03 05:06:42 juno systemd[1]: Stopping Nix Daemon...
Nov 03 12:00:29 juno nix-daemon[106712]: error: error processing connection: user '64495' is not allowed to connect to the Nix daemon
Nov 03 12:36:49 juno nix-daemon[106712]: error: error processing connection: user '64495' is not allowed to connect to the Nix daemon
Nov 03 12:37:12 juno systemd[1]: Stopping Nix Daemon...
Nov 03 12:37:12 juno systemd[1]: nix-daemon.service: Deactivated successfully.
Nov 03 12:37:12 juno systemd[1]: Stopped Nix Daemon.
Nov 03 12:37:12 juno systemd[1]: nix-daemon.service: Consumed 99ms CPU time, 40M memory peak, 31.2M read from disk.
Nov 03 12:37:12 juno systemd[1]: Started Nix Daemon.
Nov 03 12:37:16 juno nix-daemon[112201]: accepted connection from pid 112208, user mach-symbols-upload
Nov 03 12:39:43 juno nix-daemon[112201]: accepted connection from pid 112246, user mach-symbols-upload
Nov 03 12:42:04 juno nix-daemon[112201]: accepted connection from pid 112277, user mach-symbols-upload

Steps To Reproduce

  1. Configure a systemd service with DynamicUser=
  2. Make that systemd service access the nix-daemon
  3. Configure automatic updates
  4. Wait until the service cannot access the nix-daemon anymore

Expected behavior

Looking up transient users that systemd creates should be reliable.

nix --version output

nix (Lix, like Nix) 2.91.3

Additional context

## Describe the bug I have services that from dynamically allocated users (via systemd) make calls to the nix-daemon. Every once in a while nix-daemon starts denying access and logs that the uid is not allowed to connect. I only ever configured the usernames as trusted, so if it cannot look up the username any more, then rip. The stopping happens when I switch into a new generation. ``` # cat /etc/nsswitch.conf passwd: files systemd group: files [success=merge] systemd shadow: files sudoers: files hosts: mymachines files myhostname dns networks: files ethers: files services: files protocols: files rpc: files ``` ``` # getent passwd 63182 gitea-runner:x:63182:63182:Dynamic User:/:/nix/store/nhs0ppna5rf03hrdd7nz34jagbxddk5q-util-linux-minimal-2.41.1-login/bin/nologin ``` ``` Nov 02 18:19:36 pallas nix-daemon[2736]: accepted connection from pid 1889485, user gitea-runner (trusted) Nov 02 18:20:21 pallas nix-daemon[2736]: accepted connection from pid 1889532, user gitea-runner (trusted) Nov 02 20:05:55 pallas nix-daemon[2736]: accepted connection from pid 1898261, user gitea-runner (trusted) Nov 02 20:06:16 pallas nix-daemon[2736]: accepted connection from pid 1898467, user gitea-runner (trusted) Nov 03 07:39:54 pallas systemd[1]: Stopping Nix Daemon... Nov 07 01:04:54 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon Nov 07 01:04:56 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon Nov 07 01:04:58 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon Nov 07 01:05:00 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon Nov 07 01:05:02 pallas nix-daemon[1934485]: error: error processing connection: user '63182' is not allowed to connect to the Nix daemon Nov 07 01:07:24 pallas systemd[1]: Stopping Nix Daemon... Nov 07 01:07:24 pallas systemd[1]: nix-daemon.service: Deactivated successfully. Nov 07 01:07:24 pallas systemd[1]: Stopped Nix Daemon. Nov 07 01:07:24 pallas systemd[1]: Started Nix Daemon. Nov 07 01:07:32 pallas nix-daemon[2088798]: accepted connection from pid 2088910, user gitea-runner (trusted) Nov 07 01:08:00 pallas nix-daemon[2088798]: accepted connection from pid 2091827, user gitea-runner (trusted) Nov 07 01:08:00 pallas nix-daemon[2088798]: accepted connection from pid 2091825, user gitea-runner (trusted) Nov 07 01:08:00 pallas nix-daemon[2088798]: accepted connection from pid 2091824, user gitea-runner (trusted) ``` Happens on multiple machines and the shared configuration is `DynamicUser=`. ``` Nov 02 23:08:06 juno nix-daemon[8071]: accepted connection from pid 101518, user mach-symbols-upload Nov 02 23:10:03 juno nix-daemon[8071]: accepted connection from pid 101542, user mach-symbols-upload Nov 02 23:11:55 juno nix-daemon[8071]: accepted connection from pid 101557, user mach-symbols-upload Nov 02 23:13:55 juno nix-daemon[8071]: accepted connection from pid 101577, user mach-symbols-upload Nov 03 05:06:42 juno systemd[1]: Stopping Nix Daemon... Nov 03 12:00:29 juno nix-daemon[106712]: error: error processing connection: user '64495' is not allowed to connect to the Nix daemon Nov 03 12:36:49 juno nix-daemon[106712]: error: error processing connection: user '64495' is not allowed to connect to the Nix daemon Nov 03 12:37:12 juno systemd[1]: Stopping Nix Daemon... Nov 03 12:37:12 juno systemd[1]: nix-daemon.service: Deactivated successfully. Nov 03 12:37:12 juno systemd[1]: Stopped Nix Daemon. Nov 03 12:37:12 juno systemd[1]: nix-daemon.service: Consumed 99ms CPU time, 40M memory peak, 31.2M read from disk. Nov 03 12:37:12 juno systemd[1]: Started Nix Daemon. Nov 03 12:37:16 juno nix-daemon[112201]: accepted connection from pid 112208, user mach-symbols-upload Nov 03 12:39:43 juno nix-daemon[112201]: accepted connection from pid 112246, user mach-symbols-upload Nov 03 12:42:04 juno nix-daemon[112201]: accepted connection from pid 112277, user mach-symbols-upload ``` ## Steps To Reproduce 1. Configure a systemd service with `DynamicUser=` 2. Make that systemd service access the nix-daemon 3. Configure automatic updates 4. Wait until the service cannot access the nix-daemon anymore ## Expected behavior Looking up transient users that systemd creates should be reliable. ## `nix --version` output nix (Lix, like Nix) 2.91.3 ## Additional context
pennae commented 2025-11-07 02:27:33 +00:00
Owner
Copy link

probably a glibc bug. glibc caches nscd failure, so once nscd is unavailable when the daemon wants to ask it something it'll never retry. there's nothing we can about this (that we know of), but lix head will not be affected by this since it runs these specific queries in a subprocess

probably a glibc bug. glibc caches nscd *failure*, so once nscd is unavailable when the daemon wants to ask it something it'll never retry. there's nothing we can about this (that we know of), but lix head will not be affected by this since it runs these specific queries in a subprocess
mweinelt commented 2025-11-09 13:48:59 +00:00
Author
Member
Copy link

But probably not before 2.94.0, so not the default lix in 25.11, right?

But probably not before 2.94.0, so not the default lix in 25.11, right?
pennae commented 2025-11-09 17:29:38 +00:00
Owner
Copy link

that change is only in 2.94 so far, but we could probably backport that specific change to 2.93. not sure it's a great idea though since it does change how daemons are launched :/

that change is only in 2.94 so far, but we could probably backport that specific change to 2.93. not sure it's a great idea though since it does change how daemons are launched :/
pennae commented 2025-11-11 15:03:54 +00:00
Owner
Copy link

not sure we'll get to actually doing this. it may make sense to add systemd ordering constraint to the daemon/nscd link to mitigate this in the meantime

not sure we'll get to actually doing this. it may make sense to add systemd ordering constraint to the daemon/nscd link to mitigate this in the meantime
mweinelt commented 2025-11-11 15:04:47 +00:00
Author
Member
Copy link

I can mitigate this on my own until 2.94.0, no biggie.

I can mitigate this on my own until 2.94.0, no biggie.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
sb/raito/flakes-out-of-core
sb/raito/eval-explorations
release-2.93
release-2.94
ci-config
sb/pennae/ci-config
release-2.91
release-2.92
sb/raito/darwin-kqueue-disablement
sb/raito/hydra-merge
sb/raito/phantom-referrers-gc
repl-overlay-example
reuse-compliance
release-2.90
sb/pennae/io-rewrite
git-series/activity-cleanup
sb/tom-hubrecht/primops.cc-v2
sb/bacchanalia/cache-strlen%topic=substr-perf
sb/qyriad/beta-1
sb/qyriad/2.90-beta.0
sb/rbt/test-branch
sb/rbt/justfile
sb/rbt/repl-overlays
sb/qyriad/maint-meson
sb/qyriad/maint/meson
sb/puck/meson-c-api
sb/jade/burn-it-all
dependabot/github_actions/zeebe-io/backport-action-2.4.1
dependabot/github_actions/cachix/install-nix-action-25
dependabot/github_actions/actions/labeler-5
dependabot/github_actions/cachix/cachix-action-14
2.94.0
2.93.3
2.92.3
2.93.2
2.91.3
2.92.2
2.91.2
2.93.1
2.93.0
2.92.0
2.91.1
2.91.0
2.90.0
2.90.0-rc1
2.90-beta.1
2.90-beta.0
Labels
Clear labels   
Affects/CppNix

Probably affects CppNix. This is a best-effort tag for troubles in old code; it exists to inform the CppNix team about problems they might care about also.

  
Affects/Nightly

Found in Lix nightly.

  
Affects/Only nightly

Tag for regressions in Lix nightly. We intend to fix all of these prior to releases.

  
Affects/Stable

Affects the stable release of Lix. Usually such issues affect nightly too but there is no guarantee.

  
Area/build-packaging

regarding the building or packaging of Lix itself

  
Area/cli

The command line interface of Lix

  
Area/evaluator

libexpr and anything else related to the evaluation of Nix expressions

  
Area/fetching

Fetching sources or other materials from the World Wide Web in Lix

  
Area/flakes

   
Area/language

language design, features, extensions, etc

  
Area/lix ci

Lix's own CI and deployment pipeline

  
Area/nix-eval-jobs

nix-eval-jobs for Lix

  
Area/profiles

profiles: nix-env, nix profile, and installer flavors all alike

  
Area/protocol

The protocol, used for communicating between the client and the daemon

  
Area/releng

Release engineering

  
Area/remote-builds

remote builds

  
Area/repl

nix repl

  
Area/repl/debugger

The --debugger that brings up a Lix repl

  
Area/store

libstore and anything else relating to the Nix store

  
awaiting
author
needs more information from the issue author

  
awaiting
contributors
needs more information from contributors

  
bug

it's a bug

  
Context
contributors
This issue might require some context that isn't written down. It might be possible to handle as a person who already worked on this area.

  
Context
drive-by
This issue contains all the necessary information to do a drive-by contribution: that is, you don't have to talk with anyone at all to successfully solve it!

  
Context
maintainers
This issue requires a lot of know-how. Attention from maintainers is needed to proceed.

  
Context
RFD
This issue needs discussion from multiple maintainers and interested parties: it's a Request For Discussion.

  
crash 💥

Lix crashes (possibly bad error handling)

  
Cross Compilation

   
devx

development experience issues

  
docs

requires or is about documentation changes

  
Downstream Dependents

regarding an external tool's usage with Lix (e.g. nix-eval-jobs)

  
E/easy

bug is relatively simple and could simply be fixed with some minor effort

  
E/hard

this issue should probably be solved with close involvement of an expert

  
E/help wanted

maintainers may not get to this soon, but we want it fixed

  
E/reproducible

This bug is reproducible and obvious.

  
E/requires rearchitecture

this bug cannot be fixed properly without fixing a known architectural flaw

  
Feature/S3

S3 support in Lix

  
imported

Issue imported from upstream nix (please do not remove this label, it will cause dupes if import is rerun)

  
Language/Bash

   
Language/C++

   
Language/NixLang

   
Language/Python

   
Language/Rust

   
Needs Langver

We can't get to this until we implement language versioning

  
OS/Linux

Affects specifically Lix on Linux

  
OS/macOS

Affects specifically Lix on macOS

  
performance

make lix go faster

  
regression

This is a regression since some previous version of Lix

  
release-blocker

Blocks public release

  
stability

Fixing this makes the software more stable

  
Status
blocked
Blocked on something

  
Status
invalid
not our bug, duplicate, similar

  
Status
postponed
closed but should maybe look at later (generally with S-wontfix)

  
Status
wontfix
We chose not to change this (see issue comments for more detail).

  
testing

Tests that should be added

  
testing/flakey

Tests that are unreliable/flakey (not to be confused with flakes that test)

  
Topic/Large Scale Installations

Large scale installations of Lix, e.g. NixOS Hydra, Lix CI, big corporate installations etc.

  
ux

makes the user experience better :)

No labels
Affects/CppNix
Affects/Nightly
Affects/Only nightly
Affects/Stable
Area/build-packaging
Area/cli
Area/evaluator
Area/fetching
Area/flakes
Area/language
Area/lix ci
Area/nix-eval-jobs
Area/profiles
Area/protocol
Area/releng
Area/remote-builds
Area/repl
Area/repl/debugger
Area/store
awaiting
author
awaiting
contributors
bug
Context
contributors
Context
drive-by
Context
maintainers
Context
RFD
crash 💥
Cross Compilation
devx
docs
Downstream Dependents
E/easy
E/hard
E/help wanted
E/reproducible
E/requires rearchitecture
Feature/S3
imported
Language/Bash
Language/C++
Language/NixLang
Language/Python
Language/Rust
Needs Langver
OS/Linux
OS/macOS
performance
regression
release-blocker
stability
Status
blocked
Status
invalid
Status
postponed
Status
wontfix
testing
testing/flakey
Topic/Large Scale Installations
ux
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lix-project/lix#1029
No description provided.