Fix permission denied when building symlink derivation which points t… by Artturin · Pull Request #9723 · NixOS/nix

Artturin · 2024-01-08T21:25:10Z

…o a symlink out of the store

Fix issue #9579

error: getting attributes of path '/nix/store/ws9yl6ph10v79gx4p9ilhyxg214xf7i7-direct-symlink': Permission denied

let
  pkgs = import /home/artturin/nixgits/my-nixpkgs { };
  local = "/home/artturin/nixgits/my-nixpkgs";
in
rec {
  direct-symlink = pkgs.runCommand "direct-symlink" { } ''
    ln -vs ${local}/.version $out
  '';
  indirect-symlink = pkgs.runCommand "indirect-symlink" { } ''
    # Doesn't fail
    # ln -vs ${direct-symlink} $out/not-top
    # Fails
    ln -vs ${direct-symlink} $out
  '';
}

Motivation

Context

Meant to address Permission denied error when building symlink derivation #9579
Issue introduced by Bindmount files instead of hardlinking or copying to chroot #8965

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

Artturin · 2024-01-08T21:30:54Z

src/libstore/build/local-derivation-goal.cc

+            copyPath(source, target);
+            return;
+            // either link or copy
+            // link doesn't work at all


Doesn't work in the case of the example in the commit message
---------------------

Hmm

indirect-symlink = pkgs.runCommand "indirect-symlink" { } '' cat ${direct-symlink} ln -vs ${direct-symlink} $out '';

> cat: /nix/store/k3isri0ks6l63rk54z4714dc67sd1cp3-direct-symlink: No such file or directory

Commented out the auto deletion of the chroot dir

$ sudo ls -l /nix/store/q5glq907j6jn39aw99ncmcv5ijvnh5cs-indirect-symlink.drv.chroot/nix/store/55lg749likjz3ivq2varjcbj17xjam40-direct-symlink lrwxrwxrwx root root 37 B Sat Jan 20 18:13:44 2024  /nix/store/q5glq907j6jn39aw99ncmcv5ijvnh5cs-indirect-symlink.drv.chroot/nix/store/55lg749likjz3ivq2varjcbj17xjam40-direct-symlink@ ⇒ /home/artturin/nixgits/my-nixpkgs/.version

I think what is happening is that the symlink to /home/... is being mounted/linked/copied to the chroot but the chroot doesn't have access to the result of the symlink

I checked on 2.18.1 and there was still cat: /nix/store/55lg749likjz3ivq2varjcbj17xjam40-direct-symlink: No such file or directory, therefore it's not a regression caused by #8965

…o a symlink out of the store Fix issue 9579 caused by PR 8965 `error: getting attributes of path '/nix/store/ws9yl6ph10v79gx4p9ilhyxg214xf7i7-direct-symlink': Permission denied` ```nix let pkgs = import /home/artturin/nixgits/my-nixpkgs { }; local = "/home/artturin/nixgits/my-nixpkgs"; in rec { direct-symlink = pkgs.runCommand "direct-symlink" { } '' ln -vs ${local}/.version $out ''; indirect-symlink = pkgs.runCommand "indirect-symlink" { } '' # Doesn't fail # ln -vs ${direct-symlink} $out/not-top # Fails ln -vs ${direct-symlink} $out ''; } ``` `cat ${direct-symlink}` still fails with `cat: /nix/store/55lg749likjz3ivq2varjcbj17xjam40-direct-symlink: No such file or directory` but that was happening with 2.18.1 before the PR 8965

Artturin · 2024-01-22T17:47:26Z

Tried to make a test but it works in nix build and nix develop both on master and with this PR (the test is being run)

commit 31554217b0bbf3392125f3c6d24d340d092deec3
Author: Artturin <Artturin@artturin.com>
Date:   2024-01-22 17:57:50 +0200

    Add test for out of store symlink
    
    Issue 9579
    
    "error: getting attributes of path '/nix/store/ws9yl6ph10v79gx4p9ilhyxg214xf7i7-direct-symlink': Permission denied"

diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index 192e275e3..05bebae5d 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -110,6 +110,7 @@ nix_tests = \
   build.sh \
   build-delete.sh \
   output-normalization.sh \
+  out-of-store-symlink.sh \
   selfref-gc.sh \
   db-migration.sh \
   bash-profile.sh \
diff --git a/tests/functional/out-of-store-symlink.nix b/tests/functional/out-of-store-symlink.nix
new file mode 100644
index 000000000..0271b0d9e
--- /dev/null
+++ b/tests/functional/out-of-store-symlink.nix
@@ -0,0 +1,22 @@
+with import ./config.nix;
+
+let
+  direct-symlink = mkDerivation rec {
+    name = "direct-symlink";
+    buildCommand = ''
+      ln -vs ${(builtins.unsafeGetAttrPos "name" direct-symlink).file} $out
+    '';
+    meta.description = "direct-symlink";
+  };
+in
+mkDerivation rec {
+  name = "indirect-symlink";
+  buildCommand = ''
+    # Fails with:
+    # `cat: /nix/store/f2l57qr1lapn3ksyqwivi9848q3g95y4-direct-symlink: No such file or directory`
+    # Probably because the sandbox does not have access to the target of the out of store symlink.
+    # cat ${direct-symlink}
+    ln -vs ${direct-symlink} $out
+  '';
+  meta.description = "direct-symlink";
+}
diff --git a/tests/functional/out-of-store-symlink.sh b/tests/functional/out-of-store-symlink.sh
new file mode 100644
index 000000000..9887966d6
--- /dev/null
+++ b/tests/functional/out-of-store-symlink.sh
@@ -0,0 +1,5 @@
+source common.sh
+
+clearStore
+
+nix build --no-link -f ./out-of-store-symlink.nix

Ericson2314 · 2024-01-25T23:48:36Z

@Artturin I lost a comment, but this should be using lstat not stat. The easiest way to do that is actually to use PosixSourceAccessor and the methods on it, which will return nicer types (and also be a platform abstraction helper later ("Posix" should be removed from its name)).

thufschmitt · 2024-01-26T08:52:39Z

Discussed during the Nix maintainers meeting on 2024-01-22.
Assigned to @Ericson2314

Details

- @Ericson2314: Oops, I thought I left a review here, but now I don't see anything.

Needs lstat

Assigned to @Ericson2314

nixos-discourse · 2024-01-26T09:06:13Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2024-01-22-nix-team-meeting-minutes-117/38838/1

Artturin · 2024-01-27T01:40:43Z

@Artturin I lost a comment, but this should be using lstat not stat. The easiest way to do that is actually to use PosixSourceAccessor and the methods on it, which will return nicer types (and also be a platform abstraction helper later ("Posix" should be removed from its name)).

If I switch to lstat then error: bind mount from '/nix/store/f2l57qr1lapn3ksyqwivi9848q3g95y4-direct-symlink' to '/nix/store/s1k8hwbh09wnicl9yfpk108vzncjxhl2-indirect-symlink.drv.chroot/nix/store/f2l57qr1lapn3ksyqwivi9848q3g95y4-direct-symlink' failed: Permission denied

and if using the accessor
if (accessor.maybeLstat(CanonPath(source)) == -1) {

Diagnostics:
1. clang: Invalid operands to binary expression ('std::optional<Stat>' and 'int') [typecheck_invalid_operands]

Ericson2314 · 2024-02-16T13:51:24Z

@Artturin sorry for missing this. maybeLstat has a different return type, that is why the -1 comparison doesn't work! It returns a std::optional instead so you probably want to do

auto [accessor, canonPath] = PosixSourceAccessor::createAtRoot(tmpFile);
if (auto statOpt = accessor.maybeLstat(canonPath)) {

This is very anti-Nix, but duplicates my old dotfile setup. From here it will be possible to incrementally move configuration into Home Manager. Note that as of today, this requires using nix version 2.18, which can be installed with `sudo nix-env -i nix-2.18.1`. It may also be necessary to explicitly restart the nix-daemon service with `sudo systemctl daemon-reload` and `sudo systemctl restart nix-daemon.service`. This is needed due to NixOS/nix#9579, which unfortunately is also not fixed in nix 2.20.5, which is the new version in nixpkgs. It looks like NixOS/nix#9723 will fix this and will hopefully land before nix 2.21.

carschandler · 2024-03-21T14:36:43Z

Any progress on this?

alois31 · 2024-04-06T10:03:52Z

If I switch to lstat then error: bind mount from '/nix/store/f2l57qr1lapn3ksyqwivi9848q3g95y4-direct-symlink' to '/nix/store/s1k8hwbh09wnicl9yfpk108vzncjxhl2-indirect-symlink.drv.chroot/nix/store/f2l57qr1lapn3ksyqwivi9848q3g95y4-direct-symlink' failed: Permission denied

It is not possible to bind-mount symlinks using mount. S_ISLNK should be checked explicitly and the source symlink be copied in this case.

Ericson2314 · 2024-04-11T13:37:32Z

Closed because #10456 is now merged

Artturin mentioned this pull request Jan 8, 2024

Permission denied error when building symlink derivation #9579

Closed

Artturin commented Jan 8, 2024

View reviewed changes

Artturin force-pushed the fixpermdeniedbind branch from 326728d to 8996119 Compare January 20, 2024 19:31

Artturin requested a review from Ericson2314 January 20, 2024 19:31

Artturin marked this pull request as ready for review January 20, 2024 19:31

Artturin requested a review from thufschmitt as a code owner January 20, 2024 19:31

Artturin added the backport 2.19-maintenance label Jan 20, 2024

Ericson2314 self-assigned this Jan 22, 2024

thufschmitt mentioned this pull request Apr 10, 2024

Fix adding symlink to the sandbox paths #10456

Merged

Ericson2314 closed this Apr 11, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix permission denied when building symlink derivation which points t…#9723

Fix permission denied when building symlink derivation which points t…#9723
Artturin wants to merge 1 commit intoNixOS:masterfrom
Artturin:fixpermdeniedbind

Artturin commented Jan 8, 2024 •

edited by Ericson2314

Loading

Uh oh!

Artturin Jan 8, 2024 •

edited

Loading

Uh oh!

Artturin Jan 20, 2024

Uh oh!

Artturin Jan 20, 2024

Uh oh!

Artturin commented Jan 22, 2024 •

edited

Loading

Uh oh!

Ericson2314 commented Jan 25, 2024

Uh oh!

thufschmitt commented Jan 26, 2024

Uh oh!

nixos-discourse commented Jan 26, 2024

Uh oh!

Artturin commented Jan 27, 2024 •

edited

Loading

Uh oh!

Ericson2314 commented Feb 16, 2024

Uh oh!

carschandler commented Mar 21, 2024

Uh oh!

alois31 commented Apr 6, 2024

Uh oh!

Ericson2314 commented Apr 11, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

Artturin commented Jan 8, 2024 • edited by Ericson2314 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Context

Priorities and Process

Uh oh!

Artturin Jan 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Artturin Jan 20, 2024

Choose a reason for hiding this comment

Uh oh!

Artturin Jan 20, 2024

Choose a reason for hiding this comment

Uh oh!

Artturin commented Jan 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ericson2314 commented Jan 25, 2024

Uh oh!

thufschmitt commented Jan 26, 2024

Uh oh!

nixos-discourse commented Jan 26, 2024

Uh oh!

Artturin commented Jan 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ericson2314 commented Feb 16, 2024

Uh oh!

carschandler commented Mar 21, 2024

Uh oh!

alois31 commented Apr 6, 2024

Uh oh!

Ericson2314 commented Apr 11, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Artturin commented Jan 8, 2024 •

edited by Ericson2314

Loading

Artturin Jan 8, 2024 •

edited

Loading

Artturin commented Jan 22, 2024 •

edited

Loading

Artturin commented Jan 27, 2024 •

edited

Loading