search

NixOS / nix

Nix, the purely functional package manager
https://nixos.org/
GNU Lesser General Public License v2.1
12.12k stars 1.47k forks source link

Nix 2.2 enabled sandboxing on Linux by default, breaking a bunch of installations by default #3000

Open grahamc opened 5 years ago

grahamc commented 5 years ago

I think it was the right idea to enable it by default, but probably having a way to detect its support first might be good.

The change broke installations for:

Grid comparison:

Full reports:

FruitieX commented 5 years ago

Possibly related, installation under WSL 2 Ubuntu is also broken:

error: while setting up the build environment: mounting /proc: Operation not permitted
./install: unable to install Nix into your default profile

Disabling sandboxing seems to help:

mkdir ~/.config/nix
echo "sandbox = false" > ~/.config/nix/nix.conf

With this workaround in place I was able to complete installation of Nix under WSL 2 simply by re-running the installation script.

stale[bot] commented 3 years ago

I marked this as stale due to inactivity. → More info

valignatev commented 2 years ago

This is still relevant mr bot, thank you

SuperSandro2000 commented 2 years ago

Ubuntu 12.04, centos 6 an debian 8 are really old and I don't think we should spend time on them.

debian9 and gentoo can probably be fixed by either installing rsync which should not be required on newer version IIRC.

Edit: rsync requirement got removed with https://github.com/NixOS/nix/pull/5150

valignatev commented 2 years ago

Ah, I had this problem yesterday on archlinux with very fresh updates, and I went to this issue from the archwiki where it was listed together with the workaound

klarkc commented 2 years ago

Ah, I had this problem yesterday on archlinux with very fresh updates, and I went to this issue from the archwiki where it was listed together with the workaound

The workaround there tells to disable sandbox in nix config file, this is a important thing? Should that be disabled?

MagicRB commented 2 years ago

@klarkc extremely, its akin to disabling sandboxing in docker, a malicious build script could read all your files send them off to a server and you'd never notice

stale[bot] commented 2 years ago

I marked this as stale due to inactivity. → More info

valignatev commented 2 years ago

bot begone