/tmp permission

[NikkiSatmaka]

I want to setup nix package manager https://nixos.org/download.html#nix-install-linux using the multi user installation.
It should've be possible. I tested this on vanilla debian and lmde and succeeded.

However, on Spiral, this error would pop out
mktemp: failed to create directory via template ‘/tmp/user/1000tmp.XXXXXXXXXX’: Permission denied

Is there some special permission setup regarding /tmp?

[geckolinux]

Hi there, I'm pretty sure that's a Nix bug:
NixOS/nix#6703
You might want to post there to see if they can figure out what is unique about your /tmp config that is making it fail in this case.

The only other possible difference between SpiralLinux and vanilla Debian would be the libpam-tmpdir package, SpiralLinux includes it by default, not sure about vanilla Debian:
https://forums.whonix.org/t/make-symlink-attacks-and-other-tmp-based-attacks-harder-or-impossible-using-libpam-tmpdir/8488

There's also this suggestion about plain old permissions on the /tmp directory, but I don't (knowingly) mess with any of that in the SpiralLinux config:
https://unix.stackexchange.com/a/409961

[NikkiSatmaka]

Thanks for the explanation

The only other possible difference between SpiralLinux and vanilla Debian would be the libpam-tmpdir package, SpiralLinux includes it by default, not sure about vanilla Debian:
https://forums.whonix.org/t/make-symlink-attacks-and-other-tmp-based-attacks-harder-or-impossible-using-libpam-tmpdir/8488

This is neat. Thanks for including this

There's also this suggestion about plain old permissions on the /tmp directory, but I don't (knowingly) mess with any of that in the SpiralLinux config:
https://unix.stackexchange.com/a/409961

I've tried this before. Didn't seem to be a workaround for the bug

I gave up installing the multi user and installed using single user. I'll try the workaround in that nix thread. Should've checked over there as well. Thank you

[geckolinux]

Cool, hope you can figure it out. It would be a good idea to post your experience in that Nix thread. Judging from the small number of posts in that bug report I assume it's not an issue for most users. I honestly don't understand why it would happen only in some cases, so I'd be interested in hearing their explanation regarding whether it's a non-optimal default in the distro or something that their scripts should reasonably be expected to handle gracefully.

[geckolinux]

Hi there, sorry for the slow reply.
Could you please try Nix with and without the libpam-tmpdir package installed? (Reboot the system after adding or removing the package). It looks like libpam-tmpdir is definitely preferable for security of the system, but it would be good to test and narrow down the source of this problem. Thanks!

[NikkiSatmaka]

My main system already had nix multi user installed and it's kinda PITA to remove, so I tried this in a VM.
Your hunch was correct. With libpam-tmpdir, it would result in an error which needs the fix mentioned in the nix github. Without libpam-tmpdir, it would work just fine.
Tried this with both gnome and plasma, same result

[geckolinux]

Hi there, sorry for the slow reply.
Thanks for confirming. So I guess I would recommend for your needs to just remove libpam-tmpdir. I think it won't be an issue for most users, so probably best to leave it installed so as to avoid comments from critics that SpiralLinux is "insecure" etc. I don't think in practice it would be a security problem to remove it though.

[NikkiSatmaka]

It might be unnecessary. I've just tested out a clean install on a VM and directly install nix to find that the notice is gone and it could install properly. Maybe they've done some fixes on their end.

Btw, Any plan to release a new ISO soon?

[geckolinux]

Ah, great. Yeah, this does seem like something that should ultimately be fixed in Nix, so that's probably what they've done.

Btw, Any plan to release a new ISO soon?

Yep, I was busy putting out the recent GeckoLinux release, so now that's done I'll work on implementing these "todo" items in SpiralLinux:
https://github.com/SpiralLinux/SpiralLinux-project/issues?q=is%3Aissue+is%3Aopen+label%3Atodo