From 0ebb1c524ddecbf002ccf7fb530711d56ed1e9b2 Mon Sep 17 00:00:00 2001 From: Tom Hubrecht Date: Sun, 14 Dec 2025 20:13:46 +0100 Subject: [PATCH] daemon: Make the error more explicit when the sandbox group tries to connect Fixes #1069 Change-Id: I32ece312b0a1c4fbbc21902d71a15c6ff40b3aed --- lix/nix/daemon.cc | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/lix/nix/daemon.cc b/lix/nix/daemon.cc index 326cc90f9..b0359a6d3 100644 --- a/lix/nix/daemon.cc +++ b/lix/nix/daemon.cc @@ -253,14 +253,25 @@ static std::pair authPeer(const PeerInfo & peer) struct group * gr = peer.gidKnown ? getgrgid(peer.gid) : 0; std::string group = gr ? gr->gr_name : std::to_string(peer.gid); + if (group == settings.buildUsersGroup) { + throw Error( + "the user '%1%' is not allowed to connect to the Nix daemon as its group is '%2%', " + "which is the group of users running the sandboxed builds.", + user, + group + ); + } + const Strings & trustedUsers = authorizationSettings.trustedUsers; const Strings & allowedUsers = authorizationSettings.allowedUsers; - if (matchUser(user, group, trustedUsers)) + if (matchUser(user, group, trustedUsers)) { trusted = Trusted; + } - if ((!trusted && !matchUser(user, group, allowedUsers)) || group == settings.buildUsersGroup) + if (!trusted && !matchUser(user, group, allowedUsers)) { throw Error("user '%1%' is not allowed to connect to the Nix daemon", user); + } return { trusted, std::move(user) }; }