error: access to canonical path is forbidden in restricted mode

[GuillaumeDesforges]

Following the Nix flake instructions, I get

$ nixos-rebuild build --flake path:.
error: access to canonical path '/nix/store/55ayck4pllh4qallb1dbhbkrzwrrl02r-binutils-wrapper-2.35.2/nix-support/dynamic-linker' is forbidden in restricted mode

my diffs are quite simple

 {
+  inputs.nixpkgs.url = "github:nixos/nixpkgs";
   inputs.home-manager = {
     url = "github:rycee/home-manager/master";
     inputs.nixpkgs.follows = "nixpkgs";
   };
+  inputs.nix-ld = {
+    url = "github:Mic92/nix-ld";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };

-  outputs = { self, nixpkgs, home-manager, ... }@inputs:
+  outputs = { self, nixpkgs, nix-ld, home-manager, ... }@inputs:
     let
       system = "x86_64-linux";
       pkgs = import nixpkgs {
@@ -22,6 +25,8 @@
         modules = [
           ./machines/poseideep/configuration.nix

+          nix-ld.nixosModules.nix-ld
+
           home-manager.nixosModules.home-manager

in my home manager config

+    home.sessionVariables =
+      let
+        cc = pkgs.stdenv.cc;
+      in
+      {
+        NIX_LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
+          cc.cc
+        ];
+        NIX_LD = pkgs.lib.fileContents "${cc}/nix-support/dynamic-linker";
+      };

[Mic92]

also in NixOS/nixpkgs#173034

[Alexnortung]

I am experiencing this issue, when trying to use nix-ld with flakes. Is there a solution to this?

I am using a devShell:

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };
  outputs = {
    nixpkgs,
    flake-utils,
    ...
  }:
    flake-utils.lib.eachDefaultSystem (system:
    let
      pkgs = nixpkgs.legacyPackages.${system};
    in {
        devShell = pkgs.mkShell {
            NIX_LD = builtins.readFile "${pkgs.stdenv.cc}/nix-support/dynamic-linker";

            buildInputs = with pkgs; [
                nodePackages.pnpm
            ];
            shellHook = ''
                alias npm="pnpm"
            '';
        };
    });
}

[Mic92]

Try this for NIX_LD to avoid builtins.readFile

  pkgs.runCommand "ld.so" {} ''
    ln -s "$(cat '${pkgs.stdenv.cc}/nix-support/dynamic-linker')" $out
  '');

[Mic92]

also see #31