Merge pull request #13455 from DeterminateSystems/gustavderdrache/fix-sandbox-ifdef

Address ifdef problem with macOS/BSD sandboxing

.github/workflows/ci.yml

@@ -14,6 +14,8 @@ jobs:
       with:
         fetch-depth: 0
     - uses: cachix/install-nix-action@v31
+      with:
+        install_url: "https://releases.nixos.org/nix/nix-2.29.1/install"
     - run: nix --experimental-features 'nix-command flakes' flake show --all-systems --json
 
   tests:
@@ -36,6 +38,7 @@ jobs:
         fetch-depth: 0
     - uses: cachix/install-nix-action@v31
       with:
+        install_url: "https://releases.nixos.org/nix/nix-2.29.1/install"
         # The sandbox would otherwise be disabled by default on Darwin
         extra_nix_config: |
           sandbox = true

src/libstore/unix/user-lock.cc

@@ -197,7 +197,7 @@ bool useBuildUsers()
     #ifdef __linux__
     static bool b = (settings.buildUsersGroup != "" || settings.autoAllocateUids) && isRootUser();
     return b;
-    #elif defined(__APPLE__) && defined(__FreeBSD__)
+    #elif defined(__APPLE__) || defined(__FreeBSD__)
     static bool b = settings.buildUsersGroup != "" && isRootUser();
     return b;
     #else