daemon user fails to install on macOS

[angerman]

During the daemon installation on macOS, this fails with:

---- sudo execution ------------------------------------------------------------
I am executing:

    $ sudo tee -a /etc/bashrc

extend your /etc/bashrc with nix-daemon settings


# Nix
if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
fi
# End Nix


---- sudo execution ------------------------------------------------------------
I am executing:

    $ sudo HOME=/var/root /nix/store/6639l9815ggdnb4aka22qcjy7p8w4hb9-nix-2.3.1/bin/nix-env -i /nix/store/6639l9815ggdnb4aka22qcjy7p8w4hb9-nix-2.3.1

to installing a bootstrapping Nix in to the default Profile

installing 'nix-2.3.1'
Assertion failed: (S_ISLNK(st.st_mode)), function canonicalisePathMetaData, file src/libstore/local-store.cc, line 529.
/var/folders/f1/yshs9bgn5_zgphb1__yp_gfc0000gn/T/nix-binary-tarball-unpack.XXXXXXXXXX.z7usH1I5/unpack/nix-2.3.1-x86_64-darwin/install-multi-user: line 216: 63542 Abort trap: 6           sudo "$@"

---- oh no! --------------------------------------------------------------------
Jeeze, something went wrong. If you can take all the output and open
an issue, we'd love to fix the problem so nobody else has this issue.

:(

We'd love to help if you need it.

[angerman]

Of note: /nix is a mount in my case:

/dev/disk2s1 on /nix (hfs, local, nodev, nosuid, journaled, noowners)

[angerman]

note the nosuid, noowners; this will cause nix to fail. mounting with -o suid will make nix install.

[infinisil]

I had the same problem when I tried to install Nix on macOS machines in CircleCI. In my case I created /nix to be an APFS volume (as the current Nix installer does). The fix that worked for me was

sudo diskutil enableOwnership /nix

I found the enableOwnership option thanks to @abathur who pointed out this Nix installer: https://github.com/TobiasBales/t/blob/c6d6c53e70306ae6d680045e32de123e47a56e23/ignite.sh#L22-L42

Alternatively, this also worked, but it's not as nice:

nixdisk=$(diskutil info -plist /nix | xpath '/plist/dict/key[text()="DeviceIdentifier"]/following-sibling::string[1]/text()' 2>/dev/null)
sudo diskutil umount /nix
# Maybe suid could be replaced with owners too
sudo mount -o suid -t apfs "$nixdisk" /nix

And here is the whole final /nix setup I used if anybody needs it (for a single-user install), the steps are really just copied from https://github.com/NixOS/nix/blob/master/scripts/create-darwin-volume.sh:

echo nix | sudo tee -a /etc/synthetic.conf
/System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -B
disk=$(diskutil info -plist / | xpath "/plist/dict/key[text()='ParentWholeDisk']/following-sibling::string[1]/text()" 2>/dev/null)
sudo diskutil apfs addVolume "$disk" APFS 'Nix Store' -mountpoint /nix

sudo diskutil enableOwnership /nix
sudo chown -R "$(whoami)" /nix

[SuperSandro2000]

@infinisil I also needed to do this on OSX Catalina and it makes the installation a lot harder and complicated than necessary. Can we integrate this into the installer?

[abathur]

@infinisil @SuperSandro2000 I've been reluctant to cargo-cult parts of this myself because I didn't understand why it wasn't generally needed and whether we can cause any problems doing it.

I spotted a sentence in the diskutil manpage this afternoon that may explain it:

For some locations of devices (e.g. internal hard disks), consideration of ownership settings on FSOs is the default. For others (e.g. plug-in USB disks), it is not.

If we can nail down conditions pretty well, it'll be easier to add this to the installer with confidence.

After looking at the plist from diskutil info, I suspect this option might change the key GlobalPermissionsEnabled. If it is easy for either of you to play with this, I'm curious if the command below prints <false/> in the case you're describing, and <true/> after running enableOwnership?

$ /usr/sbin/diskutil info -plist "Nix Store" | xmllint --xpath "(/plist/dict/key[text()='GlobalPermissionsEnabled'])/following-sibling::*[1]" -

The output from diskutil list might also be helpful.

[SuperSandro2000]

I am a bit lazy to setup a new machine but after running sudo diskutil enableOwnership /nix I get the following:

/usr/sbin/diskutil info -plist "Nix Store" | xmllint --xpath "(/plist/dict/key[text()='GlobalPermissionsEnabled'])/following-sibling::*[1]" -
<true/>

diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *268.4 MB   disk0
   1:                        EFI EFI                     101.4 MB   disk0s1
   2:           Linux Filesystem                         163.9 MB   disk0s2

/dev/disk1 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *2.1 GB     disk1
   1:                  Apple_HFS macOS Base System       2.0 GB     disk1s1

/dev/disk2 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *137.4 GB   disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:                 Apple_APFS Container disk3         137.1 GB   disk2s2

/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +137.1 GB   disk3
                                 Physical Store disk2s2
   1:                APFS Volume MacOSCatalina - Data    26.9 GB    disk3s1
   2:                APFS Volume Preboot                 24.1 MB    disk3s2
   3:                APFS Volume Recovery                525.8 MB   disk3s3
   4:                APFS Volume VM                      1.1 GB     disk3s4
   5:                APFS Volume MacOSCatalina           11.3 GB    disk3s5
   6:                APFS Volume Nix Store               64.2 GB    disk3s6

[abathur]

I did confirm that disabling ownership does change GlobalPermissionsEnabled to false, so it certainly seems plausible that there's a 1-to-1 correlation between GlobalPermissionsEnabled==false and this issue.

@infinisil @SuperSandro2000 were these single or multi-user installs?

[SuperSandro2000]

I don't know anymore. I tried so much getting it working that I forgot which exactly. I think it first occurred with single user.