Is multi user nix safe?
I'm thinking of setting up multi user nix on a compute cluster.
The advantage would be to have a shared storage where common packages are reused, this is a great advantage compared to conda where every environment duplicates storage and inodes.
However, the packages are installed as root. As such I'm a bit wary of whether a user installing something could have the system run malware as root by installing a package.
What are the safeguards in place and how do I know I can trust them?


balsoft
in reply to ranzispa • • •Assuming you're talking about Nix the package manager,
Nothing is actually "installed as root", except for stuff that the root user installs themselves. The Nix Store (where all the "derivations"/packages are stored) can be thought of more as a cache, just because a package is there doesn't mean it's used anywhere. Users don't get to choose the cache "key" (i.e. the directory name in /nix/store) either - it is determined by all the build instructions and dependencies needed to build the package, and Nix doesn't (well, at the very least shouldn't) give users any control about the package build process after it starts.
When users install something, Nix fetches or builds that package into
/nix/store- which doesn't affect other users in any way - and then just symlinks that particular package into some user-owned directory in their$PATH(e.g.$HOME/.local/share/nix/profiles/defaultor so), which also doesn't affect root or other users in any way.So, basically, if some user installs malware only they are affected - the fact that it's also in the shared
/nix/storeis irrelevant since there's nothing in other user's profiles or$PATHor whatever that references it in any way.The most likely vulnerability is something like this:
I must add that this is theoretical and I don't think has ever happened in practice on a multi-user system.
Sorry, I'm pretty bad at explaining stuff, hopefully it makes some sense 😀
Nix & NixOS | Declarative builds and deployments
nixos.org