Devenv + nix_ld throws "access to canonical path" " is forbidden in restricted mode"

Help
1

I am trying to use devenv to build an eclipse-oomph .
I use the following flake.nix

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    devenv.url = "github:cachix/devenv";
  };

  outputs = { self, nixpkgs, devenv, ... } @ inputs:
    let
      systems = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
      forAllSystems = f: builtins.listToAttrs (map (name: { inherit name; value = f name; }) systems);
    in
    {
      devShells = forAllSystems
        (system:
          let
            pkgs = import nixpkgs {
              inherit system;
            };
            neededPkgs = [
              pkgs.openjdk11
              pkgs.stdenv.cc
            ];
          in
          {
            default = devenv.lib.mkShell {
              inherit inputs pkgs ;
              modules = [
                {
                  env.NIX_LD = pkgs.lib.fileContents "${pkgs.stdenv.cc}/nix-support/dynamic-linker";
                  packages = neededPkgs;
                  env.NIX_LD_LIBRARY_PATH="${pkgs.lib.makeLibraryPath neededPkgs}";
                  enterShell = ''
                    echo path to dll "${pkgs.stdenv.cc}/nix-support/dynamic-linker"                    
                    java -version
                  '';
                }
              ];
            };
          });
    };
}

Calling nix develop throws the following error:

warning: Git tree '/opt/src/elexis-ide' is dirty
error: access to canonical path '/nix/store/7xs3mva2z3z4hf48mh6d5alcin52qbm9-binutils-wrapper-2.39/nix-support/dynamic-linker' is forbidden in restricted mode
(use '--show-trace' to show detailed location information)

I am lost and any help would be appreciated

1 Like
2

Hey,

What you’re trying to do is something called import-from-derivation that’s restricted by defaults, that’s why devenv command passes --impure flag to nix develop.

1 Like
3

Thanks a lot. Yes, calling nix develop --impure works.