From 5cd94436f526976950fef72c4d856347107162dc Mon Sep 17 00:00:00 2001 From: Emily Date: Fri, 27 Jun 2025 14:42:07 +0100 Subject: [PATCH] libstore: fix Unix sockets in the build directory on sandboxed macOS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We’re already allowing `/tmp` anyway, so this should be harmless, and it fixes a regression in the default configuration caused by moving the build directories out of `temp-dir`. (For instance, that broke the Lix `guessOrInventPath.sockets` test.) Note that removing `/tmp` breaks quite a few builds, so although it may be a good idea in general it would require work on the Nixpkgs side. Fixes: 749afbbe99fd7b45f828b72628252feba9241362 Change-Id: I6a6a69645f429bc50d4cb24283feda3d3091f534 (This is a cherry-pick of commit d1db3e5fa3faa43b3d2f2e2e843e9cfc1e6e1b71) Lix patch: https://gerrit.lix.systems/c/lix/+/3500 --- src/libstore/unix/build/darwin-derivation-builder.cc | 2 ++ src/libstore/unix/build/sandbox-defaults.sb | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/libstore/unix/build/darwin-derivation-builder.cc b/src/libstore/unix/build/darwin-derivation-builder.cc index 5e06dbe55..3985498c1 100644 --- a/src/libstore/unix/build/darwin-derivation-builder.cc +++ b/src/libstore/unix/build/darwin-derivation-builder.cc @@ -160,6 +160,8 @@ struct DarwinDerivationBuilder : DerivationBuilderImpl if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { Strings sandboxArgs; + sandboxArgs.push_back("_NIX_BUILD_TOP"); + sandboxArgs.push_back(tmpDir); sandboxArgs.push_back("_GLOBAL_TMP_DIR"); sandboxArgs.push_back(globalTmpDir); if (drvOptions.allowLocalNetworking) { diff --git a/src/libstore/unix/build/sandbox-defaults.sb b/src/libstore/unix/build/sandbox-defaults.sb index 15cd6daf5..dd6a064c1 100644 --- a/src/libstore/unix/build/sandbox-defaults.sb +++ b/src/libstore/unix/build/sandbox-defaults.sb @@ -29,12 +29,14 @@ R""( ; Allow getpwuid. (allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo")) -; Access to /tmp. +; Access to /tmp and the build directory. ; The network-outbound/network-inbound ones are for unix domain sockets, which ; we allow access to in TMPDIR (but if we allow them more broadly, you could in ; theory escape the sandbox) (allow file* process-exec network-outbound network-inbound - (literal "/tmp") (subpath TMPDIR)) + (literal "/tmp") + (subpath TMPDIR) + (subpath (param "_NIX_BUILD_TOP"))) ; Some packages like to read the system version. (allow file-read*