lix-project/lix

Fork 58

user for remote builds fails if its group is nixbld #1069

New issue

Closed

opened 2025-12-08 15:20:28 +00:00 by crop · 3 comments

crop commented

2025-12-08 15:20:28 +00:00

Describe the bug

when one setup a user specifically for remote builds but i put as group nixbld the authentication of the build user fails in the daemon.

Steps To Reproduce

  users.users.nixremote = {
    enable = true;
    isSystemUser = true;
    description = "Nix build user (restricted)";
    group = "nixbld";
    extraGroups = [ "nixbld" ];
    useDefaultShell = true;
    createHome = false;
    openssh.authorizedKeys.keys = [ "ssh-ed25519 ..." ];
  };

this lead to the problem the the daemon failed with:

Dec 08 03:08:03 silent nix-daemon[1329]: error: error processing connection: user 'nixbld' is not allowed to connect to the Nix daemon

Expected behavior

Dec 08 12:56:52 silent nix-daemon[20189]: accepted connection from pid 25127, user nixremote (trusted)

it works if the group is named like the user (haven't tried anything else

`nix --version` output

 nix --version
nix (Lix, like Nix) 2.93.3
System type: x86_64-linux
Additional system types: aarch64-linux, i686-linux
Features: gc, signed-caches
System configuration file: /etc/nix/nix.conf
Store directory: /nix/store
State directory: /nix/var/nix
Data directory: /nix/store/kg6pv5f01vj5w6k7scy2zfvnkcgbifcw-lix-2.93.3/share

Additional context

 nix show-config|grep trusted-users
trusted-users = root nixremote

Add any other context about the problem here.

## Describe the bug when one setup a user specifically for remote builds but i put as group `nixbld` the authentication of the build user fails in the daemon. ## Steps To Reproduce ``` users.users.nixremote = { enable = true; isSystemUser = true; description = "Nix build user (restricted)"; group = "nixbld"; extraGroups = [ "nixbld" ]; useDefaultShell = true; createHome = false; openssh.authorizedKeys.keys = [ "ssh-ed25519 ..." ]; }; ``` this lead to the problem the the daemon failed with: `Dec 08 03:08:03 silent nix-daemon[1329]: error: error processing connection: user 'nixbld' is not allowed to connect to the Nix daemon` ## Expected behavior `Dec 08 12:56:52 silent nix-daemon[20189]: accepted connection from pid 25127, user nixremote (trusted)` it works if the group is named like the user (haven't tried anything else ## `nix --version` output ``` nix --version nix (Lix, like Nix) 2.93.3 System type: x86_64-linux Additional system types: aarch64-linux, i686-linux Features: gc, signed-caches System configuration file: /etc/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/kg6pv5f01vj5w6k7scy2zfvnkcgbifcw-lix-2.93.3/share ``` ## Additional context ``` nix show-config|grep trusted-users trusted-users = root nixremote ``` Add any other context about the problem here.

crop added the

bug

label

2025-12-08 15:20:28 +00:00

pennae commented

2025-12-08 17:30:16 +00:00

Owner

this is fully intentional. nixbld is the default group for build users, and thus the common group used by all builds. allowing builds to connect back to the daemon would wreak havoc with the entire scheduling system (cf recursive nix) and is thus not allowed. if you want to use the name nixbld for your user you can rename the group used by sandboxes using the build-users-group setting, but that also requires replacing the nixos module responsible for daemon setup.

is there a specific reason you want to configure a remotely accessible user using the reserved sandbox groups?

this is fully intentional. `nixbld` is the default group for build users, and thus the common group used by all builds. allowing builds to connect back to the daemon would wreak havoc with the entire scheduling system (cf recursive nix) and is thus not allowed. if you want to use the name `nixbld` for your user you can rename the group used by sandboxes using the `build-users-group` setting, but that also requires replacing the nixos module responsible for daemon setup. is there a specific reason you want to configure a remotely accessible user using the reserved sandbox groups?

pennae added

and removed

labels

2025-12-08 17:31:07 +00:00

crop commented

2025-12-08 19:20:33 +00:00

Author

i was wondering for a few hours why the remote building doesn't work.
if it is possible to create an error message for this case it would be helpful for the second person who has this unlikely idea :-) .

i was wondering for a few hours why the remote building doesn't work. if it is possible to create an error message for this case it would be helpful for the second person who has this unlikely idea :-) .

pennae added this to the 2.95 milestone

2025-12-08 19:23:46 +00:00

lix-bot commented

2025-12-14 19:14:22 +00:00

Member

This issue was mentioned on Gerrit on the following CLs:

commit message in cl/4780 ("daemon: Make the error more explicit when the sandbox group tries to connect")

This issue was mentioned on Gerrit on the following CLs: * commit message in [cl/4780](https://gerrit.lix.systems/c/lix/+/4780) ("daemon: Make the error more explicit when the sandbox group tries to connect")