lix-project/lix

Fork 70

`extra-trusted-users` being ignored #1183

New issue

Open

opened 2026-04-15 12:47:28 +00:00 by ma27 · 4 comments

ma27 commented

2026-04-15 12:47:28 +00:00

Member

Describe the bug

Granting a user privileged access to the Lix daemon doesn't work via extra-trusted-users in nix.conf, but trusted-users only.

Steps To Reproduce

Set allowed-users to root in nix.conf
Create an unprivileged user
Add unprivileged user to extra-trusted-users in nix.conf
Open a shell as unprivileged user, run nix store ping. Access to the daemon is rejected
5/. Adding the unprivileged user to trusted-users instead of extra-trusted-users gives access

Expected behavior

Expected the unprivileged user to have access in step 4.

`nix --version` output

Observed on Lix version 2.95.1 & nix (Lix, like Nix) 2.96.0-devpre20260314_c452341.

Additional context

none.

## Describe the bug Granting a user privileged access to the Lix daemon doesn't work via `extra-trusted-users` in `nix.conf`, but `trusted-users` only. ## Steps To Reproduce 1. Set `allowed-users` to `root` in `nix.conf` 2. Create an unprivileged user 3. Add unprivileged user to `extra-trusted-users` in `nix.conf` 4. Open a shell as unprivileged user, run `nix store ping`. Access to the daemon is rejected 5/. Adding the unprivileged user to `trusted-users` instead of `extra-trusted-users` gives access ## Expected behavior Expected the unprivileged user to have access in step 4. ## `nix --version` output Observed on Lix version 2.95.1 & `nix (Lix, like Nix) 2.96.0-devpre20260314_c452341`. ## Additional context none.

ma27 added the

bug

label

2026-04-15 12:47:28 +00:00

pennae commented

2026-04-15 12:50:50 +00:00

Owner

what does the file actually look like? order matters! >,<

ma27 commented

2026-04-15 15:11:18 +00:00

Author

Member

To copy the shell session I saved yesterday:

[root@cache01:~]# cat /etc/nix/nix.conf|grep hydra
trusted-users = root root hydra hydra-www @wheel
extra-trusted-users = hydra hydra-queue-runner hydra-www

[root@cache01:~]# sudo -iu hydra-www nix store ping
Store URL: daemon
Version: 2.95.1
Trusted: 1

[root@cache01:~]# sudo -iu hydra-queue-runner nix store ping
Store URL: daemon
error: cannot open connection to remote store 'daemon': error: read failed: Connection reset by peer

To copy the shell session I saved yesterday: [root@cache01:~]# cat /etc/nix/nix.conf|grep hydra trusted-users = root root hydra hydra-www @wheel extra-trusted-users = hydra hydra-queue-runner hydra-www [root@cache01:~]# sudo -iu hydra-www nix store ping Store URL: daemon Version: 2.95.1 Trusted: 1 [root@cache01:~]# sudo -iu hydra-queue-runner nix store ping Store URL: daemon error: cannot open connection to remote store 'daemon': error: read failed: Connection reset by peer

rootile added the

awaiting

contributors

label

2026-06-09 13:03:49 +00:00

samueldr-at-cyberus referenced this issue from lix-project/hydra

2026-06-12 21:54:49 +00:00

nixos-tests: Fix all tests #83

samueldr-at-cyberus referenced this issue from lix-project/hydra

2026-06-12 21:56:50 +00:00

nixos-tests: Fix all tests #83

samueldr-at-cyberus referenced this issue from a commit

2026-06-15 18:11:02 +00:00

tests: Add regression test for daemonAuthorizationSettings

lix-bot commented

2026-06-15 20:10:31 +00:00

Member

This issue was mentioned on Gerrit on the following CLs:

commit message in cl/5672 ("tests: Add regression test for daemonAuthorizationSettings")

This issue was mentioned on Gerrit on the following CLs: * commit message in [cl/5672](https://gerrit.lix.systems/c/lix/+/5672) ("tests: Add regression test for daemonAuthorizationSettings")

samueldr-at-cyberus commented

2026-06-15 20:22:51 +00:00

I have (coincidentally) tracked this down to a regression caused by the changes in 63b0a01d751689b310251c6b5a8c65f40630573a.

An attempt was made at fixing it in https://gerrit.lix.systems/c/lix/+/5671. It may or may not be the correct fix, but this was verified to handle the issue with the integration tests in Hydra.

nix build .#hydraJobs.tests.gitea.x86_64-linux --override-input lix ~/git/nix/fix-1183-config-regression/

Note that there was a workaround merged recently, so either revert it or run against 4b5012cbf455dc08fefeca56a42508653a75a89b, which is the commit I used to validate.

The expected behaviour is that the test succeeds relatively quickly (assuming all other deps are built), and failure will timeout the test in 15 minutes. But any long~ish time for the test met with many repeats of the following log lines should be a good indication that it will time out. (It shouldn't take much time to run the test once Hydra and Gitea are up and running.)

machine # test: invalid integer ‘null’

I have (coincidentally) tracked this down to a regression caused by [the changes in `63b0a01d751689b310251c6b5a8c65f40630573a`](https://git.lix.systems/lix-project/lix/commit/63b0a01d751689b310251c6b5a8c65f40630573a). An attempt was made at fixing it in https://gerrit.lix.systems/c/lix/+/5671. It may or may not be the correct fix, but this was verified to handle the issue with the integration tests in Hydra. ``` nix build .#hydraJobs.tests.gitea.x86_64-linux --override-input lix ~/git/nix/fix-1183-config-regression/ ``` Note that there was a workaround merged recently, so either revert it or run against `4b5012cbf455dc08fefeca56a42508653a75a89b`, which is the commit I used to validate. The expected behaviour is that the test succeeds relatively quickly (assuming all other deps are built), and failure will timeout the test in 15 minutes. But any long~ish time for the test met with many repeats of the following log lines should be a good indication that it will time out. (It shouldn't take much time to run the test once Hydra and Gitea are up and running.) ``` machine # test: invalid integer ‘null’ ```