NixOS / nixpkgs

Nix Packages collection & NixOS
MIT License
18.2k stars 14.2k forks source link

Can't use sudo inside distrobox #325067

Open gaykitty opened 4 months ago

gaykitty commented 4 months ago

Describe the bug

Whenever I try to run sudo inside of a distrobox I get the error: sudo: /run/current-system/sw/bin/sudo must be owned by uid 0 and have the setuid bit set. I believe this is happening because /run/wrappers/bin is not present inside of the distrobox container.

Steps To Reproduce

Not sure. I tried to create a fresh distrobox but that's also failing for me. When I try to enter the newly created box I get:

Starting container...                       [ OK ]
Installing basic packages...                Error: An error occurred

Notify maintainers

@AtilaSaraiva

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 6.6.36, NixOS, 24.05 (Uakari), 24.05.20240704.c0d0be0`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.18.4`
 - channels(sasha): `"nixos, nixpkgs"`
 - channels(root): `"nixos-23.05"`
 - nixpkgs: `/home/sasha/.nix-defexpr/channels/nixpkgs`

Add a :+1: reaction to issues you find important.

chewblacka commented 4 months ago

channels(root): "nixos-23.05" Is this the issue perhaps?

gaykitty commented 4 months ago

My system is flake based, so I don't thonk so.

jeaye commented 4 months ago

I see the same thing in an Ubuntu 24.04 container I made with distrobox some time ago, after upgrading NixOS to 24.05.

❯ nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 6.6.36, NixOS, 24.05 (Uakari), 24.05.2472.c0d0be00d4ec`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.18.4`
 - channels(root): `"nixos-24.05"`
 - nixpkgs: `/home/jeaye/.nix-defexpr/channels/nixpkgs`

Any luck, @gaykitty?

Atemu commented 4 months ago

Even if it was present, it wouldn't work because our sudo refuses to work within user namespaces as doing so would be a privilege escalation vuln.

How does this work on other distros?

gaykitty commented 4 months ago

What changed between 23.11 and 24.05 that caused this issue?