Repository navigation
Impure evaluation fails under Landlock in Nix 2.35: opening / requires read permission #16703
Description
Describe the bug
Nix 2.35.3 fails during impure evaluator initialization in a Landlock sandbox
that permits the working files and Nix store but does not permit reading /.
Even nix eval --impure --expr '1 + 1' fails. Nix 2.34.9 succeeds under the
same restrictions. Pure evaluation succeeds on both versions.
Reproduce
Minimal standalone flake (uses Landrun directly): https://github.com/adrian-gierakowski/nix-landrun-repro
nix run github:adrian-gierakowski/nix-landrun-repro#repro
nix run github:adrian-gierakowski/nix-landrun-repro#controlThe flake pins Nix 2.35.3 and 2.34.9, uses a dummy store, and isolates Nix
configuration in a temporary directory. No sandnix or project configuration is
required. Run on Linux with Landlock enabled; reproduced with ABI 7.
Actual result on 2.35.3:
Pure evaluation: 2
Impure evaluation: error: opening file "/": Permission denied
The repro command exits nonzero intentionally. Both expressions return 2
with the control command (2.34.9).
Expected behavior
Evaluating 1 + 1 should not require permission to enumerate /.
Reading permitted files should work without granting read access to all of /.
Investigation
The regression follows commit
7981f28:
getFSSourceAccessor() now calls makeFSSourceAccessor("/"), which opens a
readable descriptor during initialization, before the expression is evaluated.
openat(AT_FDCWD, "/", O_RDONLY|O_NOFOLLOW|O_CLOEXEC) = -1 EACCES
An O_PATH | O_DIRECTORY descriptor works in the same sandbox and can be used
to access allowed descendants. Reopening / for directory enumeration remains
denied. A possible fix is to use traversal-only directory handles on Linux,
retaining readable handles for actual file reads and directory enumeration.
Candidate fix
The reproduction flake also provides patched and verify packages (added in adrian-gierakowski/nix-landrun-repro@d66e1a0).
patched runs the same expression with the O_PATH change. verify checks
permitted reads, imports, listings, and symlinks, and confirms forbidden reads
and directory listings remain denied. The included patch adds an accessor
unit test for an execute-only directory.
Investigation, reproducer, and candidate fix prepared with OpenAI Codex (GPT-6).
Activity