Warn when building without nix daemon

[yshui]

We need root permission to drop supplementary groups, and if we don't do that, some builds can fail in user namespace, most notably go.

Related: #3245

[Ericson2314]

@yshui We discussed your PR in the Nix team meeting and did not come to a conclusion how to proceed. We probably don't want to flood users with warnings they can't do anything about, but we still have to review the full scope of the design considerations your PR reveals.

Complete discussion

Triaged in the Nix team meeting:

• @Ericson2314: PR description perhaps sells it short. If the user enabled sandboxing but is only getting "semi-sandboxing", that deservers a warning.
• Would be good to good to perhaps improve the error message or at least add more comments.
• To discuss more thoroughly later

Discussed in the Nix team meeting:

• @roberth this will run for each build, that would log too often
• @edolstra: why is getgroups(0, NULL) sufficient to determine this condition?
  • it's skipped, see above comment
• @edolstra: probably only go is affected (os: TestChown and friends fail in a user namespace golang/go#42525)
• @thufschmitt, edolstra: wontfix -- don't want to spam non-daemon users with a warning they can't do anything about
• @Ericson2314: Offers to email kernel mailing list and read LWN
  • Original comment: https://lwn.net/Articles/626665/
  • @tomberek also found: https://lwn.net/Articles/855943/
• shadow?
• @Ericson2314: Would be good to document what the builder is doing, what is in scope / out of scope, at some point.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2023-03-10-nix-team-meeting-minutes-39/26279/1

[yshui]

don't want to spam non-daemon users with a warning

what about only print this warning if the build fails?

[yshui]

Or, add a way to detect non-daemon builds from nix scripts (is there already a way?), and print a warning from go nix script?

[thufschmitt]

Or, add a way to detect non-daemon builds from nix scripts (is there already a way?), and print a warning from go nix script?

Yes, that sounds sensible since as far as I can tell, this essentially concerns go (also, maybe we could fix all the standard go builds like I did for one of them in NixOS/nixpkgs#144398). I assume we can just reuse the same logic that caused the test to fail to detect whether the sandbox has the right groups or not.

[fricklerhandwerk]

Triaged in Nix team meeting:

• @Ericson2314 we probably don't need this any more with the require-drop-supplementary-groups setting
  • maybe there could be an additional option that issues a warning rather than silently allowing or failing with an error

@yshui feel free to open a new PR if needed