nixops
nixops copied to clipboard
permissions problems
I regularly seem to have ownership problems when using nixops. For instance journalctl -b
would show
Cannot execute '/etc/NetworkManager/dispatcher.d/02overridedns': not owned by root.
or when setting zsh as a shell https://github.com/NixOS/nixpkgs/issues/39189
Output from the nixops VM:
[root@client:~]# ls -lL /etc/NetworkManager/dispatcher.d/
total 12
-r-xr-xr-x 1 nobody nogroup 511 Jan 1 1970 02overridedns
-r-xr-xr-x 1 root root 1251 Jan 1 1970 03userscript0001
-r-xr-xr-x 1 root root 288 Jan 1 1970 03userscript0002
I configure the libvirtd service with
qemuVerbatimConfig = ''
namespaces = []
# # Whether libvirt should dynamically change file ownership
# # dynamic_ownership = 1
user="teto"
group="libvirtd"
'';
Try this fix I've got on IRC (looks like bug during VM store init):
mount -o remount,rw /nix/store
chown -R root:root /nix/store
Seems like I missed your answer. It worked great but if anyone has a hint on the root cause, it would be nice to fix. I've started to stack up a few patches on top of nixops to fix various things and would enjoy a better out of the box experience.
NB: this permission problem also prevents the use of sudo which is quite annoying.
seeing this as well on a fresh nixos 18.09 + nixops + libvirt
within (any freshly installed) guests:
sudo: error in /etc/sudo.conf, line 0 while loading plugin "sudoers_policy"
sudo: /nix/store/kqb1mmkmacysi9whzqjwqlmi3dqr5r5y-sudo-1.8.24/libexec/sudo/sudoers.so must be owned by uid 0
sudo: fatal error, unable to load plugins
I have this in my defaults
section as a nasty workaround:
system.activationScripts.nixops-vm-fix-931 = {
text = ''
if ls -l /nix/store | grep sudo | grep -q nogroup; then
mount -o remount,rw /nix/store
chown -R root:nixbld /nix/store
fi
'';
deps = [];
};
The libvirtd image for nixops gets built within a qemu VM (see nix/libvirtd-image.nix). The problem stems from that the qemu runs within the nix-bld environment, and that makes /nix/store appear as uid=nobody(65534) gid=100. This gets propagated to the VM image by using "cp -p" to copy from the /nix/store mounted via 9p.
https://github.com/NixOS/nix/pull/2602 fixes this.
Opened a PR to move us to the image builder of <nixpkgs/nixos/lib/make-disk-image.nix> which does not copy the jailed-distorted ownership view of /nix/store to the image. This should fix this issue.
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
https://discourse.nixos.org/t/nixos-generators-from-single-user-nix-install-has-ownership-issues/18216/1