lix-project/lix

Fork 61

Enabling cgroups breaks nix for non-root users #1088

New issue

Open

opened 2026-01-01 14:59:35 +00:00 by mweinelt · 4 comments

mweinelt commented

2026-01-01 14:59:35 +00:00

Member

Describe the bug

Enabling cgroups breaks running nix as a non-root allowed or trusted user.

error: Running all builds with cgroups requires privilege separation for build users but Lix is not configured to use build users.

Steps To Reproduce

Enable the cgroups xp and opt into use-cgroups
Add a non-root user to allowed-users
Switch to that user and e.g. try to nix-store --realise /nix/store/23h28jbaikpckh51cjscs19jw6jffkx2-firefox-unwrapped-140.6.0esr-symbols
See error

Expected behavior

Nix access should work for allowed and trusted users.

`nix --version` output

nix (Lix, like Nix) 2.95.0-pre20251223-dev_c0f1770
System type: x86_64-linux
Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux, x86_64-v4-linux
Features: gc, signed-caches
System configuration file: /etc/nix/nix.conf
User configuration files: /root/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/root/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/root/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/root/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf
Store directory: /nix/store
State directory: /nix/var/nix
Data directory: /nix/store/yhkl6g46yb2gnaa60rd82ydixcnd00wg-lix-2.95.0-pre20251223-dev_c0f1770/share

Additional context

cc #537

## Describe the bug Enabling cgroups breaks running nix as a non-root `allowed` or `trusted` user. > error: Running all builds with cgroups requires privilege separation for build users but Lix is not configured to use build users. ## Steps To Reproduce 1. Enable the cgroups xp and opt into `use-cgroups` 2. Add a non-root user to `allowed-users` 3. Switch to that user and e.g. try to `nix-store --realise /nix/store/23h28jbaikpckh51cjscs19jw6jffkx2-firefox-unwrapped-140.6.0esr-symbols` 4. See error ## Expected behavior Nix access should work for allowed and trusted users. ## `nix --version` output ``` nix (Lix, like Nix) 2.95.0-pre20251223-dev_c0f1770 System type: x86_64-linux Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux, x86_64-v4-linux Features: gc, signed-caches System configuration file: /etc/nix/nix.conf User configuration files: /root/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/root/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/root/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/root/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/yhkl6g46yb2gnaa60rd82ydixcnd00wg-lix-2.95.0-pre20251223-dev_c0f1770/share ``` ## Additional context cc #537

mweinelt added the

bug

label

2026-01-01 14:59:35 +00:00

pennae added the

OS/Linux

Area/store

labels

2026-01-01 15:09:01 +00:00

pennae commented

2026-02-19 12:22:27 +00:00

Owner

this sounds like something that should only happening when attempting to build into a local store as a non-root user. we can't reproduce anything like this at this time. did you have a NIX_REMOTE set when this happened?

mweinelt commented

2026-02-19 14:05:30 +00:00

Author

Member

Yes, NIX_REMOTE=daemon is set right now, but looks like this was never persisted.

# /run/systemd/system/mach-symbols-upload.service.d/override.conf
[Service]
Environment=NIX_REMOTE=daemon

Yes, `NIX_REMOTE=daemon` is set right now, but looks like this was never persisted. ``` # /run/systemd/system/mach-symbols-upload.service.d/override.conf [Service] Environment=NIX_REMOTE=daemon ```

mweinelt commented

2026-02-19 19:48:41 +00:00

Author

Member

We debugged this just now and the issue is in nix copy.

From a dynamic user we excuted the following:

$ nix-store --realise /nix/store/1scyphnhcvpcjvs0wc7lkwpbqjq4vj86-firefox-unwrapped-140.7.0esr-symbols
this path will be fetched (153.29 MiB download, 154.68 MiB unpacked):
  /nix/store/1scyphnhcvpcjvs0wc7lkwpbqjq4vj86-firefox-unwrapped-140.7.0esr-symbols
copying path '/nix/store/1scyphnhcvpcjvs0wc7lkwpbqjq4vj86-firefox-unwrapped-140.7.0esr-symbols' from 'https://cache.nixos.org'...
^Cerror: interrupted by the user

$ NIX_REMOTE=daemon nix copy --from https://cache.nixos.org /nix/store/1scyphnhcvpcjvs0wc7lkwpbqjq4vj86-firefox-unwrapped-140.7.0esr-symbols --debug -v
querying info about missing paths...
running command: '/nix/store/1h1x6qsh4v6i90zl1ydq0sb32alk13hn-lix-2.95.0-pre20260217-dev_f31ece2/libexec/lix/check-namespace-support' '7'
error: Running all builds with cgroups requires privilege separation for build users but Lix is not configured to use build users.

$ nix shell nixpkgs#hello
$ hello
Hello, world!

We debugged this just now and the issue is in `nix copy`. From a dynamic user we excuted the following: ```bash $ nix-store --realise /nix/store/1scyphnhcvpcjvs0wc7lkwpbqjq4vj86-firefox-unwrapped-140.7.0esr-symbols this path will be fetched (153.29 MiB download, 154.68 MiB unpacked): /nix/store/1scyphnhcvpcjvs0wc7lkwpbqjq4vj86-firefox-unwrapped-140.7.0esr-symbols copying path '/nix/store/1scyphnhcvpcjvs0wc7lkwpbqjq4vj86-firefox-unwrapped-140.7.0esr-symbols' from 'https://cache.nixos.org'... ^Cerror: interrupted by the user $ NIX_REMOTE=daemon nix copy --from https://cache.nixos.org /nix/store/1scyphnhcvpcjvs0wc7lkwpbqjq4vj86-firefox-unwrapped-140.7.0esr-symbols --debug -v querying info about missing paths... running command: '/nix/store/1h1x6qsh4v6i90zl1ydq0sb32alk13hn-lix-2.95.0-pre20260217-dev_f31ece2/libexec/lix/check-namespace-support' '7' error: Running all builds with cgroups requires privilege separation for build users but Lix is not configured to use build users. $ nix shell nixpkgs#hello $ hello Hello, world! ```

lix-bot commented

2026-02-19 21:33:24 +00:00

Member

This issue was mentioned on Gerrit on the following CLs:

commit message in cl/5218 ("libstore: only check cgroup support when actually building")

This issue was mentioned on Gerrit on the following CLs: * commit message in [cl/5218](https://gerrit.lix.systems/c/lix/+/5218) ("libstore: only check cgroup support when actually building")