bug: permission denied when trying to `mkOutOfStoreSymlink`

[austinliuigi]

Are you following the right branch?

• [X] My Nixpkgs and Home Manager versions are in sync

Is there an existing issue for this?

• [X] I have searched the existing issues

Issue description

When trying to build my home-manager configuration, I get:

error:
       … while setting up the build environment

       error: getting attributes of path '/nix/store/d5w0zqag0v8wkyab59aph7v9ypkr3h6y-hm_nvim': Permission denied

The corresponding piece of the config that is causing it is:

    home.packages = [
      pkgs.neovim
    ];

    # create a symlink of the config to the proper location
    xdg.configFile = {
      nvim.source = config.lib.file.mkOutOfStoreSymlink "${config.dotfiles}/neovim/.config/nvim";
    };

By the time it errors, /nix/store/d5w0zqag0v8wkyab59aph7v9ypkr3h6y-hm_nvim links to the correct directory. It is afterwards at which it errors.

I am doing this on a multi-user installation of nix (version 2.19.1) on an Ubuntu 22.04 VM. When I build the configuration on a machine running NixOS with nix (version 2.17.0), it works fine.

Maintainer CC

@rycee

System information

- system: `"x86_64-linux"`
 - host os: `Linux 6.2.0-34-generic, Ubuntu, 22.04.3 LTS (Jammy Jellyfish), nobuild`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.19.1`
 - channels(root): `"nixpkgs"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixpkgs`

[cole-h]

This might be caused by https://github.com/NixOS/nix/pull/8965, which was first released in Nix 2.19.0.

[myguidingstar]

I also ran into this issue after upgrading nixpkgs + hm. It's even stranger that I still can't build with nix 2.17

nix run nixpkgs#nixVersions.nix_2_17 build <myflake>#nixosConfigurations.<mysystem>.config.s
ystem.build.toplevel

as it still throws getting attributes of path '/nix/store/<some-file>': Permission denied

[spector700]

I am also getting this with:

  home.file.".config/nvim".source = config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/.config/nixos-config/modules/editors/neovim/nvim";

Is there a workaround?

[prescientmoon]

I am also getting the same issue

[myguidingstar]

@spector700 not sure if it's the best way, but my work around was:

1. temporarily comment out all code that use mkOutOfStoreSymlink
2. in system config, set nix.package = pkgs.nixVersions.nix_2_17;
3. boot to new system, now nix is 2.17
4. undo step 1 and rebuild your system

[rvl]

@spector700 My workaround was to remove the nix.package = pkgs.nixUnstable; setting from NixOS (i.e. revert to nix v2.18.1).

@myguidingstar Changing the version of the nix build command won't work because the nix-daemon service is actually running the build. You can rollback your NixOS system to some previous generation. Or you can temporarily override the version with systemctl edit --runtime nix-daemon.service && systemctl restart nix-daemon.service (review the systemd docs for instructions).

[spector700]

@rvl Thank you that worked

[Jak-Ch-ll]

For anyone not using NixOS, you can install an older version of Nix by using the direct link to the install scripts: sh <(curl -L https://releases.nixos.org/nix/nix-2.18.1/install) --daemon

But uninstall and reinstalling of Nix is a bit of a hassle, does anyone know of an easier way to switch the nix-daemon version on a non NixOS system?

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/home-manager-mkoutofstoresymlink-and-nixunstable/37241/1

[rvl]

But uninstall and reinstalling of Nix is a bit of a hassle, does anyone know of an easier way to switch the nix-daemon version on a non NixOS system?

@Jak-Ch-ll I know of some ways which could work, but can't remember exactly the details of how nix-daemon runs on a non-NixOS system. The procedure would probably also depend on whether your non-NixOS system is also non-Linux and/or non-systemd.

Best to ask on NixOS Discourse. I created a thread, which is linked above.

[dyfrgi]

If you are looking for a workaround for non-NixOS systems, I did the following and it worked for me.

sudo nix-env -i nix-2.18.1
sudo systemctl daemon-reload
sudo systemctl restart nix-daemon.service

I am not certain that the systemctl steps are necessary, but they won't hurt anything. If anyone tries without those, please report back.

After those steps, I was able to use mkOutOfStoreSymlink.

It looks like nix 2.20.5 was just merged into nixpkgs, so the unstable channel should have a fix for this soon. At that point, I think it should be sufficient to run nix-env --upgrade. Whoops, actually NixOS/nix#9579 is still not fixed, so an upgrade probably won't be helpful.

[guibou]

I removed my usage of mkOutOfStoreSymlink by using an activation script:

  home.activation = {
    # This was using .config and mkOuOfStoreSymlink, but it is broken in recent nix
   # see https://github.com/nix-community/home-manager/issues/4692
    updateLinks = ''
      export ROOT="${config.home.homeDirectory}/.config/home-manager/home"
      mkdir -p .config/i3
      ln -sf "$ROOT/i3config" .config/i3/config
      ln -sf "$ROOT/i3status.conf" .i3status.conf
      i3-msg restart

      mkdir -p .config/mpv/scripts
      ln -sf "$ROOT/mpv_sub-cut.lua" .config/mpv/scripts/sub-cut.lua
    '';
  };

Where .config/home-manager/home is the directyr which contains my file to symlink.

This is not perfect (for example, here the i3-msg restart is called for every activation, not only when the i3config file changed, as it was previously, but it works with the new nix version.

[Sgiath]

~I am on NixOS, same issue, solved by reverting back to nixStable~

This is no longer true, nixStable is now on version 2.18.2 and I had to downgrade to 2.17.1 to keep it in the working state. Is there a plan to fix this function or will it be removed? It is not usable anymore with current versions of nix

[PartyWumpus]

This issue is fixed if i build nix from the 2.21-maintenance branch, probably fixed by #10456.

Means it'd be fixed for anyone using nix.package = pkgs.nixVersions.unstable once 2.21.3 comes out. It's (assuming that PR is the one that fixes it) also been backported to 2.20 & 2.19, but not 2.18 which is the current stable. Looks like the issue might not be present in 2.18 though.

Here's how I got nix to use the most most recent commit from 2.21-maintenance

nix.package = pkgs.nixVersions.unstable.overrideAttrs (oldAttrs: {
    src = pkgs.fetchFromGitHub {
        owner = "NixOS";
        repo = "nix";
        # 2.21-maintenance, basically just want 2.21.3
        rev = "60824fa97c588a0faf68ea61260a47e388b0a4e5";
        sha256 = "10z/SoidVl9/lh56cMLj7ntJZHtVrumFvmn1YEqXmaM=";
    };
});

[idlip]

I can confirm that there is no issue with nixUnstable i.e, nix 2.22 (maybe 2.21 also as above comment said)

[GCBallesteros]

@idlip I'm still getting the same error on: 2.22.0 and 2.22.1. I installed those with the following commands:

sudo -i nix upgrade-nix --nix-store-paths-url https://releases.nixos.org/nix/nix-2.22.1/fallback-paths.nix

[rvl]

This issue can be closed I think, given that it was caused by a nix bug, and that there is a new nix release which fixes the bug.

[oxalica]

This issue can be closed I think, given that it was caused by a nix bug, and that there is a new nix release which fixes the bug.

The latest Nix including the fix (2.22) does not yet become the default nix in nixpkgs (2.18). It was updated but soon being reverted due to other blocking issues (https://github.com/NixOS/nixpkgs/pull/315858). Not sure encouraging users to use Nix 2.22 is a good idea though.

[hab25]

Recently-released nix 2.18.3 contains the fix. It is the default nix in nixos-unstable and I expect it will land in nixos-24.05 as the default within the next few days.

[kluen]

Can anybody confirm this is solved? I still have the issue with nix version 2.18.4 (from nixos-unstable).

[johanneskastl]

Can anybody confirm this is solved? I still have the issue with nix version 2.18.4 (from nixos-unstable).

I am hitting this on one machine, while on another it works. Not sure why...

[manuelbb-upb]

I have this issue on Ubuntu with a flake-based home-manager setup. Tested with nix-2.19.2 and (after sudo nix upgrade-nix) with nix-2.18.5. I have also updated all the flake inputs, nixpkgs is following nixos-unstable, currently I have the following rev: github:nixos/nixpkgs/cb9a96f23c491c081b38eab96d22fa958043c9fa