Default planner does not use macOS planner defaults when installing on macOS

[stephan-koenig]

Hi,

Thanks, I love your product! It makes it so much easier to get started on Nix!

When using the default planner with

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install

on macOS, the planner defaults to encrypting the volume Nix Store, preventing it from simply being managed (i.e. encrypted) by FileVault (and by extension, other admin platforms like Sophos Endpoints). In contrast, the macOS planner with

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install macos

defaults to not encrypt the Nix Store volume (and FileVault, if activated, just encrypts it automatically).

Suggestion: The default planner on macOS should reflect the macOS planner for consistency and a more sensible default.

[cognivore]

Agreed! Really hoping to hear official opinion from DS. 👀

[Enzime]

When I don't specify a planner, nix-installer outputs:

$ ./nix-installer-aarch64-darwin install
Planner: macos (with default settings)

Whereas explicitly specifying the macos planner, I get the following output:

$ ./nix-installer-aarch64-darwin install macos
Planner: macos

Configured settings:
* root_disk: null
* volume_encrypt: false

From the following code, it looks like encryption is meant to always be on if FileVault is on:

nix-installer/src/planner/macos/mod.rs

Lines 170 to 218 in 2fbb17c

	(_, Some(choice)) => {
	if let Some(diskutil_info) =
	crate::action::macos::get_disk_info_for_label(&self.volume_label)
	.await
	.ok()
	.flatten()
	{
	if diskutil_info.file_vault {
	tracing::warn!("Existing volume was encrypted with FileVault, forcing `encrypt` to true");
	true
	} else {
	choice
	}
	} else {
	choice
	}
	},
	(_, None) => {
	let root_disk_is_encrypted = {
	let output = Command::new("/usr/bin/fdesetup")
	.arg("isactive")
	.stdout(std::process::Stdio::null())
	.stderr(std::process::Stdio::null())
	.process_group(0)
	.output()
	.await
	.map_err(|e| PlannerError::Custom(Box::new(e)))?;
	let stdout = String::from_utf8_lossy(&output.stdout);
	let stdout_trimmed = stdout.trim();
	stdout_trimmed == "true"
	};
	let existing_store_volume_is_encrypted = {
	if let Some(diskutil_info) =
	crate::action::macos::get_disk_info_for_label(&self.volume_label)
	.await
	.ok()
	.flatten()
	{
	diskutil_info.file_vault
	} else {
	false
	}
	};
	root_disk_is_encrypted || existing_store_volume_is_encrypted
	},

However, if I use explicitly set the macos planner it overrides that logic which seems like a bug.

I'm currently running a machine with FileVault and installed by explicitly specifying the macos planner so in Disk Utility the Nix Store volume is listed as Is Encrypted No (Encrypted at Rest) and everything seems to work fine. One thing to note is inside VMs, if you have FileVault enabled and you create an unencrypted APFS volume, it won't be listed as Encrypted at Rest.

I wonder if we should switch the default now to not encrypt the volume if FileVault is going to do encryption at rest. It might be the better default as users won't ever run into the Unlock Nix Store prompt which we ended up having to workaround in nix-darwin, see: nix-darwin/nix-darwin#1052

cc @abathur I skimmed your PR NixOS/nix#4289 and wasn't able to find out the reason we want to encrypt our Nix Store by default if FileVault is enabled (I suspect the way FileVault and encryption at rest works has changed since that PR was merged)

[abathur]

Catalina was a long bleed, so the story is broken up over hundreds of comments in a handful of issues and PRs.

The shortish answer is that, iirc, there was decent community consensus at the time of the original catalina issue/pr that there are some real risks filevault mitigates and that it is "surprising" to leave the nix store with less protection than the primary volume (i.e., less security than existing nix+fv users were used to.

There were some sharp corners on making that actually happen initially, so until 4289 darwin installs were left with a big long scare flag.

If memory serves, from most to least nutrition-dense, you can review:

• Darwin 10.15 install golden path LnL7/nix#1
• install: configure and bootstrap synthetic.conf on darwin NixOS/nix#3212
• /nix will not be writable on macOS Catalina NixOS/nix#2925

[Enzime]

After thinking about it further, I think by default we should encrypt Nix Store if FileVault is enabled not just rely on encryption at rest.

Otherwise someone could just boot your machine and read potentially sensitive data in your Nix Store or manipulate some of the programs which would later get executed without needing to know your password.

I think the bug here that needs to be fixed is that the macos planner when explicitly set should not configure any settings