IFD in pure eval mode doesn't allow access to dependencies.

[tejing1]

Describe the bug

When using IFD in pure eval mode, you can read files from the output of the derivation in string context, but not its dependencies.

Steps To Reproduce

$ nix repl --pure-eval
Welcome to Nix 2.18.5. Type :? for help.

nix-repl> :lf github:nixos/nixpkgs/5633bcff0c6162b9e4b5f1264264611e950c8ec7                                                                                
Added 16 variables.

nix-repl> pkgs = legacyPackages.x86_64-linux                                                                                                               

nix-repl> let foo = pkgs.writeText "foo" "contents"; in builtins.readFile "${foo}"                                                                         
"contents"

nix-repl> let bar = pkgs.writeText "bar" "contents"; baz = pkgs.runCommand "baz" {} "mkdir $out; ln -s ${bar} $out/bar"; in builtins.readFile "${baz}/bar" 
error:
       … while calling the 'readFile' builtin

         at «string»:1:115:

            1| let bar = pkgs.writeText "bar" "contents"; baz = pkgs.runCommand "baz" {} "mkdir $out; ln -s ${bar} $out/bar"; in builtins.readFile "${baz}/bar"
             |                                                                                                                   ^

       … while realising the context of path '/nix/store/247629cjx9y7bqc0l4y2f3zkszm8kkdv-baz/bar'

         at «none»:0: (source not available)

       error: access to canonical path '/nix/store/hb1p8r9sdgy3li8f3z5yx7df0f6bchzw-bar' is forbidden in restricted mode

Expected behavior

Nix should be able to follow the symlink to the package's dependency and read the target file without issue.

nix-env --version output

$ nix-env --version
nix-env (Nix) 2.18.5

Note: Checked with nix 2.24.8, still an issue.

Additional context

Stumbled on this when debugging why another user's flake-based devshell needed --impure. It was setting this:

NIX_LD = builtins.readFile "${pkgs.stdenv.cc}/nix-support/dynamic-linker";

Priorities

Add :+1: to issues you find important.

[tejing1]

Interestingly, it works fine if the store path is already realized...

$ nix repl --pure-eval
Welcome to Nix 2.18.5. Type :? for help.

nix-repl> :lf github:nixos/nixpkgs/5633bcff0c6162b9e4b5f1264264611e950c8ec7                                                                                
Added 16 variables.

nix-repl> pkgs = legacyPackages.x86_64-linux                                                                                                               

nix-repl> let foo = pkgs.writeText "foo" "contents"; in builtins.readFile "${foo}"                                                                         
"contents"

nix-repl> let foo = pkgs.writeText "foo" "contents"; quux = pkgs.runCommand "quux" {} "mkdir $out; ln -s ${foo} $out/foo"; in builtins.readFile "${quux}/foo"
"contents"

nix-repl> let bar = pkgs.writeText "bar" "contents"; baz = pkgs.runCommand "baz" {} "mkdir $out; ln -s ${bar} $out/bar"; in builtins.readFile "${baz}/bar"    
error:
       … while calling the 'readFile' builtin

         at «string»:1:115:

            1| let bar = pkgs.writeText "bar" "contents"; baz = pkgs.runCommand "baz" {} "mkdir $out; ln -s ${bar} $out/bar"; in builtins.readFile "${baz}/bar"
             |                                                                                                                   ^

       … while realising the context of path '/nix/store/247629cjx9y7bqc0l4y2f3zkszm8kkdv-baz/bar'

         at «none»:0: (source not available)

       error: access to canonical path '/nix/store/hb1p8r9sdgy3li8f3z5yx7df0f6bchzw-bar' is forbidden in restricted mode

[tejing1]

Huh. nix 2.19 is apparently exempt. Versions both before and after suffer from the problem, though:

$ for v in 2_24 2_23 2_22 2_21 2_20 2_19 2_18 2_17; do echo -n Version $v:; nix run nixpkgs-unstable\#nixVersions.nix_$v -- eval --expr 'let pkgs = (builtins.getFlake "github:nixos/nixpkgs/5633bcff0c6162b9e4b5f1264264611e950c8ec7").legacyPackages.x86_64-linux; bar = pkgs.writeText "bar" "contents-'"$v"'"; baz = pkgs.runCommand "baz" {} "mkdir $out; ln -s ${bar} $out/bar"; in builtins.readFile "${baz}/bar"' 2>/dev/null || echo failure;done
Version 2_24:failure
Version 2_23:failure
Version 2_22:failure
Version 2_21:failure
Version 2_20:failure
Version 2_19:"contents-2_19"
Version 2_18:failure
Version 2_17:failure

[MathiasSven]

Within that window between 2.19 and 2.20, it seems that the commit that returned to "failure" was this one: PosixSourceAccessor: Don't follow any symlinks