daemon: Consider the current user as trusted.

This allows use of ‘guix gc --verify=repair’ when running guix-daemon as
an unprivileged user.

* nix/nix-daemon/nix-daemon.cc (acceptConnection): Consider the current
user as trusted.

Reported-by: David Elsing <david.elsing@posteo.net>
Change-Id: I559e56cf0640e8dc9bbc510317aa2bdc024ff681

1 files changed, 4 insertions, 1 deletions

diff --git a/nix/nix-daemon/nix-daemon.cc b/nix/nix-daemon/nix-daemon.cc
index 9fff31a587c..f2ffe8fa6f8 100644
--- a/nix/nix-daemon/nix-daemon.cc
+++ b/nix/nix-daemon/nix-daemon.cc
@@ -963,7 +963,10 @@ static void acceptConnection(int fdSocket)
             clientPid = cred.pid;
             clientUid = cred.uid;
             clientGid = cred.gid;
-            trusted = clientUid == 0;
+
+            /* The root user is always trusted; additionally, when running as
+               an unprivileged user, that user is also trusted.  */
+            trusted = (clientUid == 0) || (clientUid == getuid());
 
             struct passwd * pw = getpwuid(cred.uid);
             string user = pw ? pw->pw_name : std::to_string(cred.uid);