remove `nix {shell,run}` chroot special case code #372

New issue

Open

opened 2024-06-02 21:16:00 +00:00 by pennae · 4 comments

pennae commented

2024-06-02 21:16:00 +00:00

Owner

what runProgramInStore does probably can be done entirely with pam_mount and pam_namespace, and much better at that. we should not saddle ourselves with this kind of potentially application-breaking stuff if we can avoid it.

what `runProgramInStore` does probably can be done entirely with `pam_mount` and `pam_namespace`, and much better at that. we should not saddle ourselves with this kind of potentially application-breaking stuff if we can avoid it.

jade commented

2024-06-03 01:27:53 +00:00

Owner

Yes, but configuring those requires root, right? Or are they on in a configurable manner in the default auth stack of the average distro? Regardless I think it is very confusing that Nix automatically does this evil magic.

pennae commented

2024-06-03 11:49:54 +00:00

Author

Owner

they do require admin intervention. however, looking at how to even trigger these code path, the only readily available way to trigger this code at all is to set NIX_STORE_DIR to something that doesn't match the compile-time default. at the same time this feature directly contradicts in-code documentation:

Logical location of the Nix store, usually
/nix/store. Note that you can only copy store paths
between stores if they have the same store setting.

not only can you copy between them, you can also specifically nix {shell,run} from such a store but not run directly, which is extremely sus

they do require admin intervention. however, looking at how to even trigger these code path, the only readily available way to trigger this code at all is to set `NIX_STORE_DIR` to something that doesn't match the compile-time default. at the same time this feature directly contradicts [in-code documentation](https://git.lix.systems/lix-project/lix/src/branch/main/src/libstore/store-api.hh#L142-L144): > Logical location of the Nix store, usually > `/nix/store`. Note that you can only copy store paths > between stores if they have the same `store` setting. not only can you copy between them, you can also *specifically* `nix {shell,run}` from such a store *but not run directly*, which is extremely sus

jade commented

2024-06-03 19:13:53 +00:00

Owner

yeah i mean, i understand both sides of this, like, in principle you'd like to be able to do this thing in hpc installations or so where you just untar the thing in your home directory, but we just don't support it well at all and if we deleted the functionality from ourselves, i assume everyone using it in their manual setups could just replace it with bwrap

the advantage of it being "official" is that people know it can be done, but not much else.

jade commented

2024-06-03 19:15:25 +00:00

Owner

Also it is hit by another code path: no daemon available and can't write to /nix/store. This means a lot more people might be hitting it than you think.

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: lix-project/lix#372

No description provided.

remove nix {shell,run} chroot special case code #372

remove `nix {shell,run}` chroot special case code #372