Nix: inability to resolve some ~wrapped / impure setuid executables such as `sudo` about resholve

[grahamc]

I have a use case this is biting me in. The scripts are running as root already under systemd.

My approach has been to use substitute in place:

  (substituteAll {
    ...
    mount = "${util-linux}/bin/mount";
    umount = "${util-linux}/bin/umount";
  })

for mountloc in $(@mount@ \
   ...
   @umount@ "$mountloc" || true
done

and then passing resholve:

keep = [
    "${util-linux}/bin/mount"
    "${util-linux}/bin/umount"
  ];

but I would prefer to tell resholve that I do want it to resolve these paths even if it is troublesome.

I guess the main reason I prefer it is because I accidentally made a mistake the first time I made this adjustment: I passed an absolute path to umount as unmount and my script broke.

[abathur]

@SamLukeYes the last workaround in the first post may help here. Since 0.8.3 you can use fix.<command> = true to bypass the error here and force it to resolve from inputs.

(This assumes that you've verified that the unwrapped commands will run correctly for the invocations in your script.)

[abathur]

There's now a real nixpkgs case here:

• https://gist.github.com/r-rmcgibbo/cd7ae74a0029886c15c8071e0e7c9a76
• https://github.com/archlinux/arch-install-scripts
• https://github.com/NixOS/nixpkgs/pull/138080/files#diff-724a80eaed950d49b1a3c49a83efda4498d574f4be58a130f66c675e6a4fafd2R56-R60

[abathur]

Additional context-dumping for later:

• NixOS/nixpkgs#124536 (comment)
• https://gist.github.com/Infinisil/3366e7dfc9a01f6eeb25b5cb475cc585
• https://search.nixos.org/options?channel=21.05&show=security.wrappers&from=0&size=50&sort=relevance&type=packages&query=wrappers

[dbaynard]

msmtpq is broken because of ping (see NixOS/nixpkgs#195532). The approach here doesn't appear to work.

I'd be grateful for some help — perhaps the resolution could then be added to the documentation?

[abathur]

@dbaynard Just in case you're watching here but not there, I reached out to what I assume is your handle on Matrix earlier this evening.

[SamLukeYes]

I have a use case this is biting me in. The scripts are running as root already under systemd.

My approach has been to use substitute in place:

  (substituteAll {
    ...
    mount = "${util-linux}/bin/mount";
    umount = "${util-linux}/bin/umount";
  })

for mountloc in $(@mount@ \
   ...
   @umount@ "$mountloc" || true
done

and then passing resholve:

keep = [
    "${util-linux}/bin/mount"
    "${util-linux}/bin/umount"
  ];

but I would prefer to tell resholve that I do want it to resolve these paths even if it is troublesome.

I guess the main reason I prefer it is because I accidentally made a mistake the first time I made this adjustment: I passed an absolute path to umount as unmount and my script broke.

There's a similar case in arch-install-scripts. When using NixOS's setuid wrappers, its unshare mode doesn't work (https://github.com/archlinux/arch-install-scripts/issues/38). I think simply resolving mount/umount would fix it.