nix-shell may explode in flight because /tmp/env-vars exist if you have no $TMPDIR set #940

Open
opened 2025-07-28 18:13:26 +00:00 by raito · 5 comments
Owner

Describe the bug

nixpkgs stdenv has a phase load-bearing which is to dump env-vars in the $NIX_BUILD_TOP, in case, this is not possible, this explodes.

This is ironic because dumpVars is meant as a debugging tool but can take down your shell.

Nixpkgs could be slightly more lenient here and warn if dumpVars failed without crashing your shell.

In the meantime, Lix could probably do something better at picking $NIX_BUILD_TOP.

Steps To Reproduce

  1. touch /tmp/env-vars as root
  2. Use an unprivileged user and TMPDIR="" nix-shell -p gcc
  3. Get exit code 1 with no error message.

Expected behavior

Warnings, error messages, and maybe a better choice of $TMPDIR fallback?

nix --version output

Probably all Nix versions.

Additional context

Debugged with the help of @lheckemann

## Describe the bug nixpkgs stdenv has a phase load-bearing which is to dump `env-vars` in the `$NIX_BUILD_TOP`, in case, this is not possible, this explodes. This is ironic because `dumpVars` is meant as a debugging tool but can take down your shell. Nixpkgs could be slightly more lenient here and warn if dumpVars failed without crashing your shell. In the meantime, Lix could probably do something better at picking `$NIX_BUILD_TOP`. ## Steps To Reproduce 1. `touch /tmp/env-vars` as root 2. Use an unprivileged user and `TMPDIR="" nix-shell -p gcc` 3. Get exit code 1 with no error message. ## Expected behavior Warnings, error messages, and maybe a better choice of `$TMPDIR` fallback? ## `nix --version` output Probably all Nix versions. ## Additional context Debugged with the help of @lheckemann
Owner

Isn't this fixed in nix3-develop? I'm pretty sure the latter gives a unique tmpdir for each shell or so.

Isn't this fixed in nix3-develop? I'm pretty sure the latter gives a unique tmpdir for each shell or so.
Author
Owner

i don't use nix3-develop but that might be possibly the case

i don't use nix3-develop but that might be possibly the case
Owner

lol yeah I'm just pointing out that you could probably steal the code that works

lol yeah I'm just pointing out that you could probably steal the code that works

FWIW I think the nix develop code is quite buggy in its own right, for a long time it triggered https://github.com/NixOS/nix/issues/10753 because it put you in a tempdir with different permissions. But it would be good if the two (nix-shell and nix3-develop) were consistent.

FWIW I think the `nix develop` code is quite buggy in its own right, for a long time it triggered https://github.com/NixOS/nix/issues/10753 because it put you in a tempdir with different permissions. But it would be good if the two (nix-shell and nix3-develop) were consistent.
Member

This issue was mentioned on Gerrit on the following CLs:

  • commit message in cl/4090 ("legacy/nix-build: create various temporary directories into a known tempdir")
<!-- GERRIT_LINKBOT: {"cls": [{"backlink": "https://gerrit.lix.systems/c/lix/+/4090", "number": 4090, "kind": "commit message"}], "cl_meta": {"4090": {"change_title": "legacy/nix-build: create various temporary directories into a known tempdir"}}} --> This issue was mentioned on Gerrit on the following CLs: * commit message in [cl/4090](https://gerrit.lix.systems/c/lix/+/4090) ("legacy/nix-build: create various temporary directories into a known tempdir")
Sign in to join this conversation.
No milestone
No project
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: lix-project/lix#940
No description provided.