nik-nox
February 16, 2026, 5:38am
1
Hello! I want to try this sudo clone called please:
Project’s homepage:
please, a sudo clone
This is what I’m using in my NixOS config (no flakes):
security.please = {
enable = true;
settings = {
nik_run_any_as_root = {
name = "nik";
require_pass = true;
rule = ".*";
target = "root";
type = "run";
permit_env = "NIX_PATH";
};
};
};
Everything else works as expected but I can’t rebuild my system, it shows:
error: file 'nixpkgs/nixos' was not found in the Nix search path (add it using $NIX_PATH or -I)
Command 'nix-build '<nixpkgs/nixos>' --attr config.system.build.nixos-rebuild --no-out-link' returned non-zero exit status 1.
Can someone help me fix this? I can’t seem to figure out what am I doing wrong. Thanks.
TLATER
February 16, 2026, 6:57am
2
Can you share the rest of your configuration, as well as nix-channel --list and - I guess - please nix-channel list? Maybe also env and please env?
I suspect please cleans up your environment and you’re missing stuff in NIX_PATH or something along those lines.
NobbZ
February 16, 2026, 8:09am
3
Or it doesn’t adhere to PAM controlled env, and is therefore doing the wrong thing, similar to the issues we have with doas.
Also dear nik-nox, please do not crosspost.
You received the very same questions in the discord as well. Basically increasing in doing 2 poeple the same work for no reaason.
nik-nox
February 16, 2026, 10:42am
5
Discourse doesn’t seem to be as active so I thought posting on unofficial communities would be a good idea. Sorry about that.
So there’s no solution for it yet unless upstream project makes the desired changes right?
NobbZ
February 16, 2026, 10:44am
6
So far we do not know what the issue is, but only do have some assumption. And I do not know what requested changes you are talking about.
TLATER
February 16, 2026, 11:52am
7
Almost every post gets a reply within 24 hours. The ones that don’t are seen, but too niche or open-ended. Your issue is quite simple, if you’d actually give us the info we ask for.
If discord seems more active, that’s likely because it’s a chat platform that some people abuse as a help forum; yes, there will be lots of chatter, that’s the exact point of a chat platform. That by itself won’t help you get answers faster; people aren’t there primarily to help you out.
4 Likes
nik-nox
February 16, 2026, 3:31pm
8
That was my observation from very little time here so you might be right.
Here’s my config: paaster
nix-channel –list gives no output, with please:
nixos https://channels.nixos.org/nixos-25.11
nixos-unstable https://nixos.org/channels/nixos-unstable
env
SHELL=/run/current-system/sw/bin/zsh.7z=01;31: .ace=01;31:.alz=01;31: .apk=01;31:.arc=01;31: .arj=01;31:.bz=01;31: .bz2=01;31:.cab=01;31: .cpio=01;31:.crate=01;31: .deb=01;31:.drpm=01;31: .dwm=01;31:.dz=01;31: .ear=01;31:.egg=01;31: .esd=01;31:.gz=01;31: .jar=01;31:.lha=01;31: .lrz=01;31:.lz=01;31: .lz4=01;31:.lzh=01;31: .lzma=01;31:.lzo=01;31: .pyz=01;31:.rar=01;31: .rpm=01;31:.rz=01;31: .sar=01;31:.swm=01;31: .t7z=01;31:.tar=01;31: .taz=01;31:.tbz=01;31: .tbz2=01;31:.tgz=01;31: .tlz=01;31:.txz=01;31: .tz=01;31:.tzo=01;31: .tzst=01;31:.udeb=01;31: .war=01;31:.whl=01;31: .wim=01;31:.xz=01;31: .z=01;31:.zip=01;31: .zoo=01;31:.zst=01;31: .avif=01;35:.jpg=01;35: .jpeg=01;35:.jxl=01;35: .mjpg=01;35:.mjpeg=01;35: .gif=01;35:.bmp=01;35: .pbm=01;35:.pgm=01;35: .ppm=01;35:.tga=01;35: .xbm=01;35:.xpm=01;35: .tif=01;35:.tiff=01;35: .png=01;35:.svg=01;35: .svgz=01;35:.mng=01;35: .pcx=01;35:.mov=01;35: .mpg=01;35:.mpeg=01;35: .m2v=01;35:.mkv=01;35: .webm=01;35:.webp=01;35: .ogm=01;35:.mp4=01;35: .m4v=01;35:.mp4v=01;35: .vob=01;35:.qt=01;35: .nuv=01;35:.wmv=01;35: .asf=01;35:.rm=01;35: .rmvb=01;35:.flc=01;35: .avi=01;35:.fli=01;35: .flv=01;35:.gl=01;35: .dl=01;35:.xcf=01;35: .xwd=01;35:.yuv=01;35: .cgm=01;35:.emf=01;35: .ogv=01;35:.ogx=01;35: .aac=00;36:.au=00;36: .flac=00;36:.m4a=00;36: .mid=00;36:.midi=00;36: .mka=00;36:.mp3=00;36: .mpc=00;36:.ogg=00;36: .ra=00;36:.wav=00;36: .oga=00;36:.opus=00;36: .spx=00;36:.xspf=00;36: ~=00;90:#=00;90: .bak=00;90:.crdownload=00;90: .dpkg-dist=00;90:.dpkg-new=00;90: .dpkg-old=00;90:.dpkg-tmp=00;90: .old=00;90:.orig=00;90: .part=00;90:.rej=00;90: .rpmnew=00;90:.rpmorig=00;90: .rpmsave=00;90:.swp=00;90: .tmp=00;90:.ucf-dist=00;90: .ucf-new=00;90:*.ucf-old=00;90:
please env
LOGNAME=root.7z=01;31: .ace=01;31:.alz=01;31: .apk=01;31:.arc=01;31: .arj=01;31:.bz=01;31: .bz2=01;31:.cab=01;31: .cpio=01;31:.crate=01;31: .deb=01;31:.drpm=01;31: .dwm=01;31:.dz=01;31: .ear=01;31:.egg=01;31: .esd=01;31:.gz=01;31: .jar=01;31:.lha=01;31: .lrz=01;31:.lz=01;31: .lz4=01;31:.lzh=01;31: .lzma=01;31:.lzo=01;31: .pyz=01;31:.rar=01;31: .rpm=01;31:.rz=01;31: .sar=01;31:.swm=01;31: .t7z=01;31:.tar=01;31: .taz=01;31:.tbz=01;31: .tbz2=01;31:.tgz=01;31: .tlz=01;31:.txz=01;31: .tz=01;31:.tzo=01;31: .tzst=01;31:.udeb=01;31: .war=01;31:.whl=01;31: .wim=01;31:.xz=01;31: .z=01;31:.zip=01;31: .zoo=01;31:.zst=01;31: .avif=01;35:.jpg=01;35: .jpeg=01;35:.jxl=01;35: .mjpg=01;35:.mjpeg=01;35: .gif=01;35:.bmp=01;35: .pbm=01;35:.pgm=01;35: .ppm=01;35:.tga=01;35: .xbm=01;35:.xpm=01;35: .tif=01;35:.tiff=01;35: .png=01;35:.svg=01;35: .svgz=01;35:.mng=01;35: .pcx=01;35:.mov=01;35: .mpg=01;35:.mpeg=01;35: .m2v=01;35:.mkv=01;35: .webm=01;35:.webp=01;35: .ogm=01;35:.mp4=01;35: .m4v=01;35:.mp4v=01;35: .vob=01;35:.qt=01;35: .nuv=01;35:.wmv=01;35: .asf=01;35:.rm=01;35: .rmvb=01;35:.flc=01;35: .avi=01;35:.fli=01;35: .flv=01;35:.gl=01;35: .dl=01;35:.xcf=01;35: .xwd=01;35:.yuv=01;35: .cgm=01;35:.emf=01;35: .ogv=01;35:.ogx=01;35: .aac=00;36:.au=00;36: .flac=00;36:.m4a=00;36: .mid=00;36:.midi=00;36: .mka=00;36:.mp3=00;36: .mpc=00;36:.ogg=00;36: .ra=00;36:.wav=00;36: .oga=00;36:.opus=00;36: .spx=00;36:.xspf=00;36: ~=00;90:#=00;90: .bak=00;90:.crdownload=00;90: .dpkg-dist=00;90:.dpkg-new=00;90: .dpkg-old=00;90:.dpkg-tmp=00;90: .old=00;90:.orig=00;90: .part=00;90:.rej=00;90: .rpmnew=00;90:.rpmorig=00;90: .rpmsave=00;90:.swp=00;90: .tmp=00;90:.ucf-dist=00;90: .ucf-new=00;90:*.ucf-old=00;90:
TLATER
February 16, 2026, 5:53pm
9
Yep, looks like the $NIX_PATH isn’t inherited, and since you’re using nixos rather than nixpkgs the fallback isn’t used (I believe, I forgot once again exactly how those fit together). @NobbZ is likely right that this has to do with PAM env setting, which I’d wager is deliberately not implemented by please.
AFAICT, the short term fix is to use:
please -a NIX_PATH nixos-rebuild
Since the setting in please.ini only allows passing through the variable, it doesn’t do so by default.
Longer term you’d need to convince either upstream to support the other. Perhaps please could get a wrapper that adds the NIX_PATH, but technically that’s unclean since the root user’s NIX_PATH can differ.
Personally, I’d just go with sudo-rs or run0, you should have fewer integration problems with those.
1 Like
nik-nox
February 17, 2026, 7:29am
10
Got it. Thanks so much for your assistance.
run0 is annoying because it doesn’t have persistence and calls for polkit agent. I’ll give sudo-rs a try.