# Secrets in Nix Suck (and how to fix them)

**URL:** https://discourse.nixos.org/t/secrets-in-nix-suck-and-how-to-fix-them/43822
**Category:** Nix
**Created:** [April 21, 2024, 2:46pm UTC](https://discourse.nixos.org/t/secrets-in-nix-suck-and-how-to-fix-them/43822 "2024-04-21T14:46:28Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![Infinisil](https://discourse.nixos.org/user_avatar/discourse.nixos.org/infinisil/32/26523_2.png) [@Infinisil](https://discourse.nixos.org/u/Infinisil)
#### Post date: [April 21, 2024, 7:59pm UTC](https://discourse.nixos.org/t/secrets-in-nix-suck-and-how-to-fix-them/43822/5 "2024-04-21T19:59:50Z")

</div>

Related RFC:

> <https://github.com/NixOS/rfcs/pull/143>
>
> \# Summary
> 
> This RFC proposes a system of Access Control Lists in the Nix Store…, allowing multiple users to share software in a single store without exposing it to each other.
> 
> \[Rendered\](https://github.com/tweag/rfcs/blob/acls/rfcs/0143-nix-store-acls.md)

And implementation PR:

> <https://github.com/NixOS/nix/pull/9287>
>
> \# Motivation
> 
> 
> Add functionality to manage POSIX ACLs (access control lists) on …Nix store paths (including \`.drv\` files) and derivation build logs.
> 
> In particular:
> 
> + Adds a \`nix store access\` command with the following subcommands:
> - \`info\`
> - \`protect\` / \`unprotect\`
> - \`grant\` / \`revoke\`
> + Adds a \`--protect\` flag to \`nix build\` and \`nix store add-\*\`
> + Adds \`\_\_permissions\` argument to \`builtins.derivation\`, and \`permissions\` argument to \`builtins.path\`, which allow to control the permissions on corresponding store objects.
> 
> For now, all of these are hidden behind \`--experimental-flags acls\`
> 
> \# Context
> 
> 
> https://github.com/NixOS/rfcs/pull/143
> 
> 
> 
> \## Implementation strategy
> 
> \- Add a C++ interface for POSIX ACLs
> \- Add a Nix data structure to describe ACLs of a store path (\`AccessStatus\`), which can be 
> + \`protected\` (if NOT protected, readable and executable by everyone; else readable and executable only by entities)
> + \`entities\` (list of entities (users and groups) that have access to a path if it is protected)
> \- Implement setting and getting \`AccessStatus\` on a local store and remote daemon store
> + If the path/derivation does not exist yet, apply the AccessStatus as soon as the path appears
> \- Add CLI subcommands and language primitives to manage \`AccessStatus\`-es
> 
> 
> 
> 
> 
> \# Priorities
> 
> Add :+1: to \[pull requests you find important\](https://github.com/NixOS/nix/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc).

---

_[View the full topic](https://discourse.nixos.org/t/secrets-in-nix-suck-and-how-to-fix-them/43822)._