{"action":"opened","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/7329","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/7329/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/7329/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/7329/events","html_url":"https://github.com/NixOS/nixpkgs/issues/7329","id":67848509,"number":7329,"title":"Programs run via systemd [user] services see substantially different environment","user":{"login":"anderspapitto","id":1388690,"avatar_url":"https://avatars.githubusercontent.com/u/1388690?v=3","gravatar_id":"","url":"https://api.github.com/users/anderspapitto","html_url":"https://github.com/anderspapitto","followers_url":"https://api.github.com/users/anderspapitto/followers","following_url":"https://api.github.com/users/anderspapitto/following{/other_user}","gists_url":"https://api.github.com/users/anderspapitto/gists{/gist_id}","starred_url":"https://api.github.com/users/anderspapitto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anderspapitto/subscriptions","organizations_url":"https://api.github.com/users/anderspapitto/orgs","repos_url":"https://api.github.com/users/anderspapitto/repos","events_url":"https://api.github.com/users/anderspapitto/events{/privacy}","received_events_url":"https://api.github.com/users/anderspapitto/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-12T00:05:42Z","updated_at":"2015-04-12T00:05:42Z","closed_at":null,"body":"A particular manifestation of this is that when emacs is launched in daemon mode, use of TRAMP mode to edit local files as root will fail, because emacs can see the `su`/`sudo` programs. A service description that generates this problem is\r\n```\r\n  systemd.user.services = {\r\n    emacs = {\r\n      description = \"Emacs: the extensible, self-documenting text editor\";\r\n      environment = {\r\n        GTK_DATA_PREFIX = config.system.path;\r\n        SSH_AUTH_SOCK = \"%t/ssh-agent\";\r\n        GTK_PATH = \"${config.system.path}/lib/gtk-3.0:${config.system.path}/lib/gtk-2.0\";\r\n      };\r\n      serviceConfig = {\r\n        Type = \"forking\";\r\n        ExecStart = \"${pkgs.emacs}/bin/emacs --daemon\";\r\n        ExecStop = \"${pkgs.emacs}/bin/emacsclient --eval (kill-emacs)\";\r\n        Restart = \"always\";\r\n      };\r\n      wantedBy = [ \"default.target\" ];\r\n    };\r\n};\r\nsystemd.services.emacs.enable = true;\r\n```\r\n\r\nafter activating this service with `systemctl --user daemon-reload; systemctl --user restart emacs`,\r\nwe can inspect the path with `emacsclient --eval exec-path`. Note that it includes the direct dependencies of emacs, and does not include components like `/run/current-system/sw/bin` or `/var/setuid-wrappers` (which is where `sudo` lives). Also note that when emacs (daemon or otherwise) is launched after logging in, this issue does not occur, as the path will have been inherited from the login shell.\r\n\r\nI grepped around in nixpkgs to find out where those path components are normally added, and then came up with this service description. Only the `ExecStart` line is different.\r\n\r\n```\r\n  systemd.user.services = {\r\n    emacs = {\r\n      description = \"Emacs: the extensible, self-documenting text editor\";\r\n      environment = {\r\n        GTK_DATA_PREFIX = config.system.path;\r\n        SSH_AUTH_SOCK = \"%t/ssh-agent\";\r\n        GTK_PATH = \"${config.system.path}/lib/gtk-3.0:${config.system.path}/lib/gtk-2.0\";\r\n      };\r\n      serviceConfig = {\r\n        Type = \"forking\";\r\n        ExecStart = \"${pkgs.bash}/bin/bash -c 'source ${config.system.build.setEnvironment}; exec emacs --daemon'\";\r\n        ExecStop = \"${pkgs.emacs}/bin/emacsclient --eval (kill-emacs)\";\r\n        Restart = \"always\";\r\n      };\r\n      wantedBy = [ \"default.target\" ];\r\n    };\r\n};\r\nsystemd.services.emacs.enable = true;\r\n```\r\n\r\nwhich works. However, I think cases like this could be much better supported (though I'm not sure how). Also, note that this does not address more advanced cases which I expect to run into in the future, like giving the emacs daemon access to a nix-shell environment (e.g. to provide compilation feedback on a project)."}}