security.sudo.extraRules: allowing user to sudo systemd-nspawn command without password

Help
1

Hi all, I’m trying to allow my regular user to type:
sudo systemd-nspawn
without having to input a password.
This used to work:

security.sudo.extraRules = [
{
users = [ “${mainUser}” ];
runAs = “root”;
commands = [
{ command = “${pkgs.system-path}/bin/systemd-nspawn”; options = [ “NOPASSWD” ]; }
];
}
Recently, typing sudo systemd-nspawn started asking the password. Upon further inspection, the systemd-nspawn executable is not in
${pkgs.systemd}/bin/systemd-nspawn but in:

$ whereis systemd-nspawn
systemd-nspawn: /nix/store/8rddkd5q2h58vv1sixra1nw0ix3v4ykg-system-path/bin/systemd-nspawn

So the path variable ${pkgs.systemd} is wrong, but when I try $pkgs.systemd-nspawn} or $pkgs.systemd-system-path} instead, the nixos-build fails.

Any help?

2

Found a way:
$ which systemd-nspawn
/run/current-system/sw/bin/systemd-nspawn

so:
{ command = “/run/current-system/sw/bin/systemd-nspawn”; options = [ “NOPASSWD” ]; }
works

1 Like