/nix/store is writable in a nix-shell started by root

[zhaofengli]

Describe the bug

/nix/store is read-write in a nix-shell started by root.

Steps To Reproduce

$ mount | grep store
rpool/nix on /nix/store type zfs (ro,relatime,xattr,posixacl) <-- no active nix-shell: ok
$ nix-shell

[nix-shell:~]$ mount | grep store
rpool/nix on /nix/store type zfs (ro,relatime,xattr,posixacl) <-- non-root nix-shell: ok

[nix-shell:~]$ exit
$ sudo nix-shell -p bash

[nix-shell:/home/zhaofeng]# mount | grep store
rpool/nix on /nix/store type zfs (rw,relatime,xattr,posixacl) <-- root nix-shell: why?

Expected behavior

/nix/store should stay read-only.

nix-env --version output

The machine above is running unstable with nix-env (Nix) 2.4pre20201201_5a6ddb3.
Also reproduced on a 20.09 machine with nix-env (Nix) 2.3.9.

Additional context

The behavior is not related to ZFS, and I was able to reproduce it on a machine with single-partition ext4.

Edit: Somehow I was under the impression that this would affect the mount namespace outside the nix-shell, but this is not the case with more testing. I have updated the description.

[Profpatsch]

@regnat writes:

On opening the store, Nix enters a mount namespace with the store path re-mounted writable, and because nix-shell just calls execve(bash, …), it inherits this namespace

[thufschmitt]

Note that it only happens because nix bypasses the daemon by default when running as root (see #4263). A workaround is to set NIX_REMOTE=daemon to force it to use the daemon − in which case the store will stay read-only:

$ sudo nix-shell -p mount --run mount | grep store
znvme/nix on /nix/store type zfs (rw,relatime,xattr,noacl)
$ sudo NIX_REMOTE=daemon nix-shell -p mount --run mount | grep store
znvme/nix on /nix/store type zfs (ro,relatime,xattr,noacl)

[robinbb]

This is clearly not desirable, as it is astonishing. The root user should be able to launch a Nix shell without unknowingly winding up with a writable Nix store.

[edolstra]

We used to have code for restoring the original mount namespace before executing the shell (a0ef212), but I had to revert it (01d07b1).

[zhaofengli]

Somehow I was under the impression that this would affect the mount namespace outside the nix-shell, but this is not the case with more testing. I have updated the description.

[grahamc]

[root@hyperchicken:~]# nix-shell -p hello
these paths will be fetched (0.04 MiB download, 0.20 MiB unpacked):
  /nix/store/0pisd259nldh8yfjvw663mspm60cn5v8-hello-2.10
copying path '/nix/store/0pisd259nldh8yfjvw663mspm60cn5v8-hello-2.10' from 'https://cache.nixos.org'...

[nix-shell:~]# exit

[root@hyperchicken:~]# nix-shell '<nixpkgs>' -A hello

[nix-shell:~]# touch $out/foo

[nix-shell:~]# exit

[grahamc@hyperchicken:~]$ ls /nix/store/0pisd259nldh8yfjvw663mspm60cn5v8-hello-2.10/
bin  foo  share

[grahamc@hyperchicken:~]$ nix-store --verify-path /nix/store/0pisd259nldh8yfjvw663mspm60cn5v8-hello-2.10/
path '/nix/store/0pisd259nldh8yfjvw663mspm60cn5v8-hello-2.10' was modified! expected hash 'sha256:1ngmy2cszc6277pdq146818xrzp698dygdpa49vj5jqapwhk4nrx', got 'sha256:17nr03ig02p7phdppvw5ssgygk0xv7i28rs6cqk2r2nx23x9lixb'

[stale]

I marked this as stale due to inactivity. → More info