Fix #2984: attempt to copy if unlinking source directory fails

[yorickvP]

We were seeing an error on single-user nix mode, where rename fails if the right permissions on the source path are missing. Since the paths are removed in sandbox mode anyways, we can use copyPath to work around this.

Testcase: nix-build '<nixpkgs>' -A documentation-highlighter --substituters ""

[edolstra]

Hm, do you know why EACCES happens here?

[yorickvP]

I suspect the build creates an actualPath/.. with no write bit set. Being root will ignore that completely, but single-user mode would have a problem. That suggests we can also fix this problem with a well-placed chmod.

[zhenyavinogradov]

Another trivial expression that triggers the problem: (import <nixpkgs> {}).runCommand "test" {} "mkdir --mode u-w $out"

[domenkozar]

There's quite a few references here and on #2984 that trigger this bug on single-user installation.

[nh2]

I can confirm this issue on a single-user installation on Ubuntu:

nix-build mypackage.nix --out-link .nix-build-gc-root gives:

error: moving build output '/nix/store/...mypackage-0.1.0.0' from the sandbox to the Nix store: Permission denied

Also including the perms for

% ls -lah .nix-build-gc-root
lrwxrwxrwx 1 niklas niklas 58 Jun  9 14:22 .nix-build-gc-root -> /nix/store/...-mypackage-0.1.0.0/

but I don't think those matter, given that rm .nix-build-gc-root changes nothing about the error.

I'm pretty sure this is a new bug / regression, as I've run this before and it worked.

[thomasjm]

@yorickvP doing a chmod u+w or equivalent on the source path sounds better. I just experimented locally and confirmed that the problem seems to arise iff the source path is missing the write bit, like you said. Falling back from rename to copyPath seems like it could incur a performance penalty to copy a large tree, no?

[Ericson2314]

BTW https://git.savannah.gnu.org/cgit/guix.git/commit/?id=d445c30ea6f9693454ca96bae9089ba8738a6f78 seems slightly related.

[mkaito]

I ran into this issue again today. I suppose there aren't that many single-user nix users out there. Should I reinstall nix in multi-user mode, or can I hope for this to get fixed?

[nh2]

I found a workaround for my case:

I had written a derivation that copied the outputs of another derivation like this:

cp -r ${pkgs.otherDerivation} $out

After that, the permissions of $out are dr-xr-xr-x and then that fails to copy from the sandbox to the nix store.

My workaround is to do this instead:

cp -r ${pkgs.otherDerivation} $out
chmod -R u+w $out

then it works also in my single-user install.

[Ericson2314]

Perhaps #4054 fixed this?

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/docker-build-issue/9495/1

[yorickvP]

Hopefully fixed by #4312, have no way to reproduce this anymore.