From 9cd3b961e4e530b4361ef25132fc8ee9756aab4b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= Date: Thu, 10 Jul 2025 15:25:29 +0200 Subject: [PATCH] daemon: Consider the current user as trusted. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This allows use of ‘guix gc --verify=repair’ when running guix-daemon as an unprivileged user. * nix/nix-daemon/nix-daemon.cc (acceptConnection): Consider the current user as trusted. Reported-by: David Elsing Change-Id: I559e56cf0640e8dc9bbc510317aa2bdc024ff681 --- nix/nix-daemon/nix-daemon.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nix/nix-daemon/nix-daemon.cc b/nix/nix-daemon/nix-daemon.cc index 9fff31a587c7d2a6794b2750c2f6c740871b9296..f2ffe8fa6f82fa78706b13b1cc4c6b8c26767dee 100644 --- a/nix/nix-daemon/nix-daemon.cc +++ b/nix/nix-daemon/nix-daemon.cc @@ -963,7 +963,10 @@ static void acceptConnection(int fdSocket) clientPid = cred.pid; clientUid = cred.uid; clientGid = cred.gid; - trusted = clientUid == 0; + + /* The root user is always trusted; additionally, when running as + an unprivileged user, that user is also trusted. */ + trusted = (clientUid == 0) || (clientUid == getuid()); struct passwd * pw = getpwuid(cred.uid); string user = pw ? pw->pw_name : std::to_string(cred.uid);