Nix Daemon Trusted-User Gating

Source: src/libstore/daemon.cc in the Nix repo.

Ops Requiring trusted-users

Op	Condition	Error message
BuildDerivation	input-addressed (non-CA) derivations	"you are not privileged to build input-addressed derivations"
BuildPaths	mode == bmRepair	"repairing is not allowed because you are not in 'trusted-users'"
BuildPathsWithResults	mode == bmRepair	same
VerifyStore	repair == true	"you are not privileged to repair paths"
AddPermRoot	always	"you are not privileged to create perm roots"
AddBuildLog	always	"you are not privileged to add logs"
AddToStore / AddMultipleToStore / AddToStoreNar	dontCheckSigs == true	silently downgraded to false for untrusted
SetOptions	restricted settings (build-timeout, trusted substituters, etc.)	silently ignored for untrusted
FindRoots	always	untrusted only sees permanent roots, not temp roots

Ops That Do NOT Require Trusted Status

All read queries (IsValidPath, QueryPathInfo, QueryValidPaths, QuerySubstitutablePaths, QueryReferrers, QueryDerivationOutputs, QueryMissing, QueryRealisation, etc.), AddTempRoot, AddIndirectRoot, BuildPaths/BuildPathsWithResults in normal mode, BuildDerivation for CA derivations, AddToStore/AddToStoreNar with sigs checked, AddTextToStore, EnsurePath, NarFromPath, OptimiseStore, SyncWithGC, RegisterDrvOutput, CollectGarbage (except ignoreLiveness — rejected for everyone).

Authentication Flow

1. Daemon creates socket with mode 0666

2. Client connects → daemon calls getPeerInfo(remote.get()) → SO_PEERCRED gets PID, UID, GID

3. authPeer(peer) maps UID against trusted-users and allowed-users in nix.conf

4. If neither list matches → connection rejected entirely

5. If only allowed-users matches → TrustedFlag = NotTrusted

6. If trusted-users matches → TrustedFlag = Trusted

7. The TrustedFlag is passed to performOp() which gates operations per the table above