wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-06-25 14:51:16 +02:00
Code Activity

fix: Run all derivation builders inside the sandbox on macOS

Browse source
This commit is contained in:
Puck Meerburg 2024-03-01 11:42:24 -05:00 • committed by Robert Hensing
parent d7eaeaffd3
commit ae8a38d29c
3 changed files with 122 additions and 121 deletions
Download patch file Download diff file Expand all files Collapse all files

6
configure.ac
View file

@ -62,13 +62,17 @@ AC_CHECK_TOOL([AR], [ar])
AC_SYS_LARGEFILE AC_SYS_LARGEFILE
# Solaris-specific stuff. # OS-specific stuff.
AC_STRUCT_DIRENT_D_TYPE AC_STRUCT_DIRENT_D_TYPE
case "$host_os" in case "$host_os" in
solaris*) solaris*)
# Solaris requires -lsocket -lnsl for network functions # Solaris requires -lsocket -lnsl for network functions
LDFLAGS="-lsocket -lnsl $LDFLAGS" LDFLAGS="-lsocket -lnsl $LDFLAGS"
;; ;;
darwin*)
# Need to link to libsandbox.
LDFLAGS="-lsandbox $LDFLAGS"
;;
esac esac

2
package.nix
View file

@ -25,6 +25,7 @@
, libseccomp , libseccomp
, libsodium , libsodium
, man , man
, darwin
, lowdown , lowdown
, mdbook , mdbook
, mdbook-linkcheck , mdbook-linkcheck
@ -239,6 +240,7 @@ in {
gtest gtest
rapidcheck rapidcheck
] ++ lib.optional stdenv.isLinux libseccomp ] ++ lib.optional stdenv.isLinux libseccomp
++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox
++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid
# There have been issues building these dependencies # There have been issues building these dependencies
++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)) ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

37
src/libstore/build/local-derivation-goal.cc
View file

@ -58,6 +58,10 @@
#if __APPLE__ #if __APPLE__
#include <spawn.h> #include <spawn.h>
#include <sys/sysctl.h> #include <sys/sysctl.h>
#include <sandbox.h>
/* This definition is undocumented but depended upon by all major browsers. */
extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);
#endif #endif
#include <pwd.h> #include <pwd.h>
@ -2018,11 +2022,7 @@ void LocalDerivationGoal::runChild()
std::string builder = "invalid"; std::string builder = "invalid";
if (drv->isBuiltin()) {
;
}
#if __APPLE__ #if __APPLE__
else {
/* This has to appear before import statements. */ /* This has to appear before import statements. */
std::string sandboxProfile = "(version 1)\n"; std::string sandboxProfile = "(version 1)\n";
@ -2120,10 +2120,6 @@ void LocalDerivationGoal::runChild()
debug("Generated sandbox profile:"); debug("Generated sandbox profile:");
debug(sandboxProfile); debug(sandboxProfile);
Path sandboxFile = tmpDir + "/.sandbox.sb";
writeFile(sandboxFile, sandboxProfile);
bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");
/* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
@ -2134,24 +2130,23 @@ void LocalDerivationGoal::runChild()
if (globalTmpDir.back() == '/') globalTmpDir.pop_back(); if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {
builder = "/usr/bin/sandbox-exec"; Strings sandboxArgs;
args.push_back("sandbox-exec"); sandboxArgs.push_back("_GLOBAL_TMP_DIR");
args.push_back("-f"); sandboxArgs.push_back(globalTmpDir);
args.push_back(sandboxFile);
args.push_back("-D");
args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
if (allowLocalNetworking) { if (allowLocalNetworking) {
args.push_back("-D"); sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");
args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); sandboxArgs.push_back("1");
} }
args.push_back(drv->builder); if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {
} else { writeFull(STDERR_FILENO, "failed to configure sandbox\n");
_exit(1);
}
}
builder = drv->builder; builder = drv->builder;
args.push_back(std::string(baseNameOf(drv->builder))); args.push_back(std::string(baseNameOf(drv->builder)));
}
}
#else #else
else { if (!drv->isBuiltin()) {
builder = drv->builder; builder = drv->builder;
args.push_back(std::string(baseNameOf(drv->builder))); args.push_back(std::string(baseNameOf(drv->builder)));
} }