{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nix/issues/8","repository_url":"https://api.github.com/repos/NixOS/nix","labels_url":"https://api.github.com/repos/NixOS/nix/issues/8/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nix/issues/8/comments","events_url":"https://api.github.com/repos/NixOS/nix/issues/8/events","html_url":"https://github.com/NixOS/nix/issues/8","id":4238218,"number":8,"title":"Support private files in the Nix store","user":{"login":"edolstra","id":1148549,"avatar_url":"https://avatars.githubusercontent.com/u/1148549?v=3","gravatar_id":"","url":"https://api.github.com/users/edolstra","html_url":"https://github.com/edolstra","followers_url":"https://api.github.com/users/edolstra/followers","following_url":"https://api.github.com/users/edolstra/following{/other_user}","gists_url":"https://api.github.com/users/edolstra/gists{/gist_id}","starred_url":"https://api.github.com/users/edolstra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edolstra/subscriptions","organizations_url":"https://api.github.com/users/edolstra/orgs","repos_url":"https://api.github.com/users/edolstra/repos","events_url":"https://api.github.com/users/edolstra/events{/privacy}","received_events_url":"https://api.github.com/users/edolstra/received_events","type":"User","site_admin":false},"labels":[{"id":3709171,"url":"https://api.github.com/repos/NixOS/nix/labels/feature","name":"feature","color":"0b02e1","default":false}],"state":"open","locked":false,"assignee":{"login":"edolstra","id":1148549,"avatar_url":"https://avatars.githubusercontent.com/u/1148549?v=3","gravatar_id":"","url":"https://api.github.com/users/edolstra","html_url":"https://github.com/edolstra","followers_url":"https://api.github.com/users/edolstra/followers","following_url":"https://api.github.com/users/edolstra/following{/other_user}","gists_url":"https://api.github.com/users/edolstra/gists{/gist_id}","starred_url":"https://api.github.com/users/edolstra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edolstra/subscriptions","organizations_url":"https://api.github.com/users/edolstra/orgs","repos_url":"https://api.github.com/users/edolstra/repos","events_url":"https://api.github.com/users/edolstra/events{/privacy}","received_events_url":"https://api.github.com/users/edolstra/received_events","type":"User","site_admin":false},"assignees":[{"login":"edolstra","id":1148549,"avatar_url":"https://avatars.githubusercontent.com/u/1148549?v=3","gravatar_id":"","url":"https://api.github.com/users/edolstra","html_url":"https://github.com/edolstra","followers_url":"https://api.github.com/users/edolstra/followers","following_url":"https://api.github.com/users/edolstra/following{/other_user}","gists_url":"https://api.github.com/users/edolstra/gists{/gist_id}","starred_url":"https://api.github.com/users/edolstra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edolstra/subscriptions","organizations_url":"https://api.github.com/users/edolstra/orgs","repos_url":"https://api.github.com/users/edolstra/repos","events_url":"https://api.github.com/users/edolstra/events{/privacy}","received_events_url":"https://api.github.com/users/edolstra/received_events","type":"User","site_admin":false}],"milestone":null,"comments":47,"created_at":"2012-04-23T11:03:45Z","updated_at":"2016-12-07T11:27:41Z","closed_at":null,"body":"Sometimes it's desirable to have files in the Nix store that are not world-readable, such as configuration files containing passwords. This could be implemented as follows:\n- Private files are marked as such by giving them a certain magic prefix to the name, e.g. `p:`. When these are registered, Nix should make them readable only to root (permission 0700) and the calling user (using an ACL). (The Nix daemon knows the uid of the caller.)\n- The permissions on a derivation should be propagated to the output paths. Also, private derivations should be run with a umask of 0077.\n- If another user attempts to register an already valid private file, then its uid should be added to the ACL of the file.  If it's a derivation, then the uid should also be added to the ACLs of any valid outputs.\n- Store operations that read files from the store (such as `exportPath()`) should check that the caller is in the ACL of the file.\n\nSo, for instance, if the root user builds a NixOS configuration containing some private files, then those files are only readable as root.  If Alice builds the same configuration, then those files will be readable by root and Alice. If Alice then uses Charon to copy the configuration to a remote machine (i.e. `nix-copy-closure --to root@remote ...`), then the files on the remote machine will only be readable by root.\n\nThis model only allows files that are private to the instantiating user and root. So it doesn't support specifying a file that is readable only to the `sshd` user.  But that's probably not necessary.\n"},"comment":{"url":"https://api.github.com/repos/NixOS/nix/issues/comments/265423826","html_url":"https://github.com/NixOS/nix/issues/8#issuecomment-265423826","issue_url":"https://api.github.com/repos/NixOS/nix/issues/8","id":265423826,"user":{"login":"wmertens","id":54934,"avatar_url":"https://avatars.githubusercontent.com/u/54934?v=3","gravatar_id":"","url":"https://api.github.com/users/wmertens","html_url":"https://github.com/wmertens","followers_url":"https://api.github.com/users/wmertens/followers","following_url":"https://api.github.com/users/wmertens/following{/other_user}","gists_url":"https://api.github.com/users/wmertens/gists{/gist_id}","starred_url":"https://api.github.com/users/wmertens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wmertens/subscriptions","organizations_url":"https://api.github.com/users/wmertens/orgs","repos_url":"https://api.github.com/users/wmertens/repos","events_url":"https://api.github.com/users/wmertens/events{/privacy}","received_events_url":"https://api.github.com/users/wmertens/received_events","type":"User","site_admin":false},"created_at":"2016-12-07T11:27:41Z","updated_at":"2016-12-07T11:27:41Z","body":"On Wed, Dec 7, 2016 at 12:14 PM Kevin Cox <notifications@github.com> wrote:\n\n> Well, if you have a 500-user shared host, it probably is a bit problematic,\n>\n> I don't see how this is problematic. If you want to share with a lot of\n> people you are going to have a long ACL (or add them to a group) but you\n> would have the same problem with other methods. Somehow you have to give\n> people access.\n>\nD'oh, forgot about groups, of course.\n\n\n> Bottom of line, someone should collect use cases (there are many already\n> in nixpkgs) and see what method solves them or not.\n>\n> +💯\n>\n\nThe only use cases I saw so far involved key files or passwords that needed\nto be provided to daemons at runtime. For that, I would prefer having the\ndata encrypted at rest.\n\nIn any case, both approaches are orthogonal, so they can both be\nimplemented and even used simultaneously.\n"}}
{"actor":{"display_login":"wmertens"}}