Nix: Regression: error: restoring parent mount namespace: Invalid argument

[mpickering]

There is a regression in 2.2 due to the following two commits.

a32ff2573ba4d0df4e3360c5a96398738da953f6
a0ef21262f4d5652bfb65cfacaec01d89c475a93

Reverting these two commits causes the error not to happen.

It can be reproduced by running this script.

https://github.com/mpickering/ghc-artefact-nix/blob/master/ghc-head-from.sh

wget https://github.com/mpickering/ghc-artefact-nix/blob/master/ghc-head-from.sh
nix-shell -p jq
./ghc-head-from.sh

[tilpner]

This happens when running as root, not (so far) as other users

[mpickering]

@tilpner says this can be reproduced with nix-shell -p hello rather than my complicated instructions.

[edolstra]

On what system?

[mpickering]

@edolstra We are both on NixOS.

[iblech]

I can reproduce this bug reliably under the following circumstances (on current NixOS unstable-small):

1. nix-shell is run as root.
2. While nix-shell is busy fetching derivations, a device is mounted or unmounted.

[tilpner]

@iblech Are you sure it requires 2.? Mounting/unmounting is not necessary here.

[iblech]

You are right! Condition 2 is not necessary. Reliably, the following happens:

• A first invocation of nix-shell -p foo, for any value of foo I've tested, successfully fetches the required derivations and then aborts with error: restoring parent mount namespace: Invalid argument.
• A second invocation immediately following the first one works just fine.

This is on Kernel 4.20.6 on a virtual private server.

[iblech]

Can confirm, @volth's error-inducing approach is 100% reproducible here.

[7c6f434c]

With prefetched git from all versions (no builds necessary):

• NIX_REMOTE=daemon of course helps
• -I nixpkgs= to an https:// URL fails as reported
• the Nixpkgs tarball being cached doesn't change anything
• file:/// URL also fails
• local directory as Nixpkgs path works fine
• local tarball as a file gets interpreted as a Nix file and doesn't provide a data point

[edolstra]

This is caused by

EINVAL The caller is multithreaded and tried to join a new user namespace.

We need to get rid of all other threads before restoring the mount namespace.

[arianvp]

I can reproduce this on 19.03 consistently.

it always happens on first download, and afterwards it's fine.

[root@nixos1903true-s-1vcpu-1gb-ams3-01:~]# nix run nixpkgs.hello
[1 copied (0.2 MiB), 0.0 MiB DL]
error: restoring parent mount namespace: Invalid argument

[root@nixos1903true-s-1vcpu-1gb-ams3-01:~]# nix run nixpkgs.gnumake
[1 copied (1.1 MiB), 0.2 MiB DL]
error: restoring parent mount namespace: Invalid argument

Nix version is Nix 2.2

And it only happens if you're root it seems.

Could we reopen? Or is this fix not in any tagged release yet? If it isn't. could we tag a new release and get this into 19.03? This is currently blocking me from migrating my servers to 19.03 because I use nix-shell -p in a lot of management scripts

[edolstra]

I've created a 2.2.2 release that contains the fix.

[arianvp]

Great!