[backport 2.3] Separate auth and logic for the daemon

[Ericson2314]

Before, processConnection wanted to know a user name and user id, and nix-daemon --stdio, when it isn't proxying to an underlying daemon, would just assume "root" and 0. But nix-daemon --stdio (no proxying) shouldn't make guesses about who holds the other end of its standard streams.

Now processConnection takes an "auth hook", so nix-daemon can provide the appropriate policy and daemon.cc doesn't need to know or care what it is.

(cherry picked from commit 8d4162f)

Depends on #5650
(not actually, but yes in terms of it wouldn't be useful until then.)

[thufschmitt]

Care to explain why this needs to be backported? The new test makes me believe that it’s just for the fake ssh feature, but I’m not sure what the link between the two is

[Ericson2314]

@regnat heh a few things:

1. I backported it trying to fix cross daemon test failures, and yes it ended up being only that test that excised it. However, I found the remote-store and remote-program query params are also easy to backport (and I did that in [backport 2.3] Allow testing with different daemons #5650), and between all backports it will allow my newer more extensive remote building tests to work.

2. However, my comment i wrote and backported is overly narrow. The case with the "root" that is causing the problems is hit when nix-daemon --stdio is run, and that daemon wouldn't itself connect to another daemon. So it will also occurs when ssh-ing to machines that are "in single user mode".

[stale]

I marked this as stale due to inactivity. → More info

[Ericson2314]

draft until it is needed.

[dpulls]

🎉 All dependencies have been resolved !

[Ericson2314]

My comments from 4 years ago were not that clear :). The reasons to backport this are:

1. It will enable writing more tests, for cross-version testing purposes

2. For anyone still using 2.3, it fixes some genuinely weird and unexpected behavior for Nix will attempt to create profiles and GC root dirs for root with nix-daemon --stdio.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2025-02-17-meeting-minutes-213-214/60813/1