# \`sudo\` does not work from within vscode-fhs
**URL:** https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227
**Category:** Help
**Created:** [July 23, 2021, 4:32pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227 "2021-07-23T16:32:19Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@schlichtanders](https://discourse.nixos.org/u/schlichtanders)
#### Post date: [July 23, 2021, 4:32pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/1 "2021-07-23T16:32:20Z")
I am just trying vscode-fhs, however it seems I cannot run `nixos-rebuild`.
**Can someone help?**
I would really like to run this from vscode and the fhs version is just so much more comfortable.
```bash
$ sudo nixos-rebuild switch
sudo: /nix/store/yx5zifiwsc7zbd54zs7l8i4a6nrrg6wf-wrapper.c:195: main: Assertion `!(st.st_mode & S_ISUID) || (st.st_uid == geteuid())' failed.
[1] 315 IOT instruction (core dumped) sudo nixos-rebuild switch
```
EDIT:
it seems like I cannot run any `sudo` command…
```bash
$ sudo ls
sudo: /nix/store/yx5zifiwsc7zbd54zs7l8i4a6nrrg6wf-wrapper.c:195: main: Assertion `!(st.st_mode & S_ISUID) || (st.st_uid == geteuid())' failed.
[1] 342 IOT instruction (core dumped) sudo ls
```
---
### Author:  [@jonringer](https://discourse.nixos.org/u/jonringer)
#### Post date: [July 24, 2021, 2:15pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/2 "2021-07-24T14:15:49Z")
This is because the nix store doesn’t allow for setuid. This is handled by wrappers in /run/wrappers on NixOS:
```auto
$ ls -l /run/wrappers/bin/sudo*
.r-s--x--x 18k root 24 Jul 06:51 /run/wrappers/bin/sudo
.rw-r--r-- 63 root 24 Jul 06:51 /run/wrappers/bin/sudo.real
.r-s--x--x 18k root 24 Jul 06:51 /run/wrappers/bin/sudoedit
.rw-r--r-- 67 root 24 Jul 06:51 /run/wrappers/bin/sudoedit.real
```
and your PATH just has it listed first:
```auto
$ echo $PATH
/run/wrappers/bin:/home/jon//.nix-profile/bin:/etc/profiles/per-user/jon/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/home/jon//.cargo/bin:/home/jon//.config/nixpkgs/bin
```
Unfortunately, the `/run/wrappers` isn’t currently mounted inside of the fhs sandbox, so it’s not available.
---
### Author:  [@schlichtanders](https://discourse.nixos.org/u/schlichtanders)
#### Post date: [July 24, 2021, 8:39pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/3 "2021-07-24T20:39:16Z")
thank you very much for explaining.
is it possible to fix `buildFHSUserEnv` in order to fix this? How would you do it?
---
### Author:  [@jonringer](https://discourse.nixos.org/u/jonringer)
#### Post date: [July 25, 2021, 1:36am UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/4 "2021-07-25T01:36:08Z")
looks like I lied a bit, /run/wrappers is still available. However, I would assume some of the unshared kernel namespaces are affecting sudo from working correctly.
If someone wants to figure out, then… god’s speed. But I think the need to run commands with sudo are pretty low, should just be able to run the commands in a normal terminal until someone figures it out with bubblewrap (if it’s even possible).
---
### Author:  [@hmenke](https://discourse.nixos.org/u/hmenke)
#### Post date: [July 25, 2021, 12:19pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/5 "2021-07-25T12:19:31Z")
It is impossible to use SUID applications from within user namespaces for good reason. Otherwise an unprivileged user could simply bind a crafted `/etc/sudoers` and become root.
---
### Author:  [@schlichtanders](https://discourse.nixos.org/u/schlichtanders)
#### Post date: [July 25, 2021, 4:27pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/6 "2021-07-25T16:27:03Z")
hi @hmenke it sounds like you understand what is going on. Maybe you could share some
As a user I am authenticating with `sudo` to use admin priveleges. Mind with me, of course I don’t know all the details of buildFHSUserEnv, but intuitively this could be done within it as well, couldn’t it? I am my user and can authenticate with my user id I thought.
* * *
Considering `vscode-fhs`, what are the concrete option available to run `sudo` in the terminal?
---
### Author:  [@jonringer](https://discourse.nixos.org/u/jonringer)
#### Post date: [July 25, 2021, 5:33pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/7 "2021-07-25T17:33:41Z")
> As a user I am authenticating with `sudo` to use admin priveleges. Mind with me, of course I don’t know all the details of buildFHSUserEnv, but intuitively this could be done within it as well, couldn’t it? I am my user and can authenticate with my user id I thought.
The intention of buildFHSUserEnv is to provide some isolation from the host machine, in that regard, this is working as intended.
> Considering `vscode-fhs` , what are the concrete option available to run `sudo` in the terminal?
If I come off as condescending, I don’t mean to. But you can open any other terminal or terminal emulator which isn’t sandboxed, and use it.
---
### Author:  [@hmenke](https://discourse.nixos.org/u/hmenke)
#### Post date: [July 26, 2021, 8:15am UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/8 "2021-07-26T08:15:13Z")
Consider the file `/tmp/evil_sudoers` with the content
```plaintext
ALL ALL=(ALL) NOPASSWD:ALL
```
Now I can create a user namespace with bubblewrap à la
```plaintext
$ bwrap --bind /nix /nix --bind /run /run --bind /tmp/evil_sudoers /etc/sudoers bash
bash-4.4$ cat /etc/sudoers
ALL ALL=(ALL) NOPASSWD:ALL
```
and if sudo was working inside the user namespace I would have just successfully elevated my privileges by allowing anyone to invoke sudo without password.
---
### Author:  [@schlichtanders](https://discourse.nixos.org/u/schlichtanders)
#### Post date: [October 5, 2021, 12:19pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/9 "2021-10-05T12:19:48Z")
as I stumble upon this issue on daily basis a little followup question (still using vscode-fhs because of its better support for installing extensions via vscode itself)
@hmenke
- would it be possible to build a safe restricted version of bubblewrap which makes sure that you cannot circumvent user rights, e.g. by hardcoding that /etc/sudoers stays the same?
- could we then enable sudo for these custom fhs?
thank you a lot for your help and input
---
### Author:  [@hmenke](https://discourse.nixos.org/u/hmenke)
#### Post date: [October 5, 2021, 1:03pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/10 "2021-10-05T13:03:51Z")
> [@schlichtanders](#):
>
> would it be possible to build a safe restricted version of bubblewrap
It might be possible if you are willing to run bubblewrap as root, but that is probably not an acceptable solution and is also very susceptible to catastrophic security vulnerabilities.
A more useful solution would be to have a client-server model where you communicate with sudo via a pipe. However, if the pipe is unauthenticated, everyone else can just snoop the root password from the pipe, so there is also a tradeoff to be made there.
EDIT: Another possible solution might be a `buildFHSEnv` based on PRoot. However, this will require ptrace and comes at a quite substantial performance cost. All the Linux namespace wrappers (bubblewrap, NixOS user chroot, firejail, etc.) seem to enforce [`PR_SET_NO_NEW_PRIVS`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) which means suid binaries cannot be executed. Rightfully so, in my opinion, because suid binaries allow the jailed application to break out and elevate its privileges.
EDIT2: Turns out that PRoot also sets `PR_SET_NO_NEW_PRIVS`, so the only remaining possibility I can think of is an actual chroot with bind mounts. This will require superuser privileges to set up, but before starting the nested application privileges can be dropped again.
---
### Author:  [@woile](https://discourse.nixos.org/u/woile)
#### Post date: [January 30, 2025, 10:18pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/11 "2025-01-30T22:18:37Z")
Has anyone been able to solve this? I’m having the same issue with `vscode-fhs` and I don’t know how to fix it.
Thanks!
---
### Author:  [@TLATER](https://discourse.nixos.org/u/TLATER)
#### Post date: [January 31, 2025, 4:34am UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/12 "2025-01-31T04:34:56Z")
The answer is pretty clear:
> All the Linux namespace wrappers (bubblewrap, NixOS user chroot, firejail, etc.) seem to enforce PR\_SET\_NO\_NEW\_PRIVS 5 which means suid binaries cannot be executed. Rightfully so, in my opinion, because suid binaries allow the jailed application to break out and elevate its privileges.
I.e., for security reasons, this is not possible. If you want to run a command as root, you have to do it in a terminal not launched by vscode.
Alternatively, you could use the vscode (or vscodium) versions that are not inside an fhs env. Those cannot use extensions that aren’t specifically tweaked to run on NixOS, though - such extensions _do_ live inside nixpkgs, so it’s viable (and I’d argue preferable), just less convenient.
---
### Author:  [@woile](https://discourse.nixos.org/u/woile)
#### Post date: [January 31, 2025, 9:45am UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/13 "2025-01-31T09:45:04Z")
It was not clear to me at all 😅 thanks for the clear explanation 👍
I think I’ll eventually move to the `programs.vscode`, not sure how much I trust the vscode sync mechanism anyways
---
### Author:  [@Echo51](https://discourse.nixos.org/u/Echo51)
#### Post date: [January 31, 2025, 10:33am UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/14 "2025-01-31T10:33:45Z")
I had to fix this for 1password agents, but it by extension allows you to use setuid binaries as well!
I changed the default shell to use systemd-run to spawn it outside the FHS sandbox and from there all commands work as expected! (there may be some side effects but other than the command name being incorrect in the UI I haven’t noticed anything)
>
---
### Author:  [@TLATER](https://discourse.nixos.org/u/TLATER)
#### Post date: [January 31, 2025, 11:31am UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/15 "2025-01-31T11:31:33Z")
That’s a fun solution! I guess the systemd socket remains available in the fhs, and `systemd-run` is a nice way to invoke stuff through it without being bound to the current process’ settings. Kinda makes me wonder how easy it is to escape more security-critical sandboxes this way.
You _may_ be able to change the process name with the `@` prefix:
> If the executable path is prefixed with “`@`”, the second specified token will be passed as `argv[0]` to the executed process (instead of the actual filename), followed by the further arguments specified.
I’m not 100% sure the `ExecStart` syntax fully carries over to systemd-run though.
---
### Author:  [@SamLukeYes](https://discourse.nixos.org/u/SamLukeYes)
#### Post date: [February 6, 2025, 3:18pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/16 "2025-02-06T15:18:03Z")
`run0` can be used instead of `sudo` in `vscode-fhs`
---
### Author:  [@Malix](https://discourse.nixos.org/u/Malix)
#### Post date: [June 2, 2025, 10:37pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/17 "2025-06-02T22:37:38Z")
I am currently running into a problem that I think is related to this one _(else, please move this message to a new topic)_
I want to edit `/etc/nixos` files from within `vscode.fhs`,
But the “retry as sudo” modal doesn’t work
I also tested `zed-editor.fhs`, but [it doesn’t have a modal to allow editing root files](https://github.com/zed-industries/zed/issues/13259)
Do you guys have any idea about how to make it work?
_I don’t know if `sudoedit` / `sudo -e` would be relevant for such issue_
---
### Author:  [@NobbZ](https://discourse.nixos.org/u/NobbZ)
#### Post date: [June 3, 2025, 6:39am UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/18 "2025-06-03T06:39:49Z")
Don’t use `vscode-fhs`, but regular `vscode`, or don’t use vscode to edit files that require elevation, but instead use `sudoedit` from a terminal with an `EDITOR` set to something you know well enough to do your edits, save and exit again.
---
### Author:  [@anon23399578](https://discourse.nixos.org/u/anon23399578)
#### Post date: [June 3, 2025, 11:44am UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/19 "2025-06-03T11:44:28Z")
In addition to this, consider moving your NixOS configuration out of `/etc/nixos` and into a directory you have write permissions in, you can then pass `-I nixos-config=./path/to/configuration.nix` to `nixos-rebuild` and similar tools.
---
### Author:  [@Malix](https://discourse.nixos.org/u/Malix)
#### Post date: [June 4, 2025, 4:08pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/20 "2025-06-04T16:08:26Z")
> Don’t use `vscode-fhs` , but regular `vscode` , or don’t use vscode to edit files that require elevation
So should we conclude it is impossible to make `.fhs` variants of editors be able to edit root files?
> instead use `sudoedit` from a terminal with an `EDITOR` set to something you know well enough to do your edits, save and exit again.
Well, in my case the only three editors I know well enough are VSCode, Zed, and Helix;
but I need VSCode to be able to use its sync mechanism (so `.fhs` and Zed can be a pain to use without `.fhs` too), and Helix has not the best experience working with Nix, but I’ll try with it
> In addition to this, consider moving your NixOS configuration out of `/etc/nixos` and into a directory you have write permissions in, you can then pass `-I nixos-config=./path/to/configuration.nix` to `nixos-rebuild` and similar tools.
This is interesting, is it documented somewhere as a best practice?
[Next page](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227.md?page=2)