Allow numeric uids/gids in allowed-users and trusted-users #8510
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
new-cli
|
It might not make much of a difference, but |
|
Also, this closes #8444. |
|
@cole-h Yeah I was being imprecise. I meant Linux-style sandboxing, which macOS doesn't have. So it always fails on macOS and it fails on Linux when sandboxing is disabled. |
|
Can we use |
|
This is a nice thing, I hope we can get it merged soon! |
`whoami` doesn't work when auto-uid-allocation is enabled and sandboxing is disabled, since then the build UID doesn't have a matching entry in /etc/passwd.
|
Gentle ~bump on this since we're having to move our UID/GID on macOS for compatibility with the early Sequoia beta. It would be nice to get out of the permanent-user game before we need to move again :) See: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
Also, don't use
whoami. It doesn't work when auto-uid-allocation is enabled and sandboxing is disabled, since then the build UID doesn't have a matching entry in/etc/passwd.This also does some cleanups in
PeerInfo, replacing the bool guards withstd::optional. There was at least a theoretical possibility that we were using uninitialized uid/gid fields.Context
Checklist for maintainers
Maintainers: tick if completed or explain if not relevant
tests/**.shsrc/*/teststests/nixos/*Priorities
Add 👍 to pull requests you find important.