Merge "fix: split macos sandbox profile to avoid size errors" into main

doc/manual/change-authors.yml

@@ -155,6 +155,10 @@ midnightveil:
 ncfavier:
   github: ncfavier
 
+p-e-meunier:
+  display_name: Pierre-Etienne Meunier
+  github: P-E-Meunier
+
 pamplemousse:
   display_name: Xavier Maso
   github: pamplemousse
@@ -164,6 +168,10 @@ piegames:
   forgejo: piegames
   github: piegamesde
 
+poliorcetics:
+  display_name: Poliorcetics
+  github: poliorcetics
+
 puck:
   display_name: puck
   forgejo: puck

doc/manual/rl-next/macos-sandbox-fix.md

@@ -0,0 +1,17 @@
+---
+synopsis: "Fix macOS sandbox profile size errors"
+issues: [fj#752, fj#718]
+cls: [2861]
+category: Fixes
+credits: ["p-e-meunier", "poliorcetics"]
+---
+
+Fixed an issue on macOS where the sandbox profile could exceed size limits when building derivations with many dependencies. The profile is now split into multiple allowed sections to stay under the interpreter's limits.
+
+This resolves errors like
+
+```
+error: (failed with exit code 1, previous messages: sandbox initialization failed: data object length 65730 exceeds maximum (65535)|failed to configure sandbox)
+
+       error: unexpected EOF reading a line
+```

lix/libstore/build/local-derivation-goal.cc

@@ -25,6 +25,7 @@
 #include "lix/libutil/strings.hh"
 #include "lix/libutil/thread-name.hh"
 
+#include <cstddef>
 #include <regex>
 #include <queue>
 
@@ -1847,7 +1848,16 @@ void LocalDerivationGoal::runChild()
                without file-write* allowed, access() incorrectly returns EPERM
              */
             sandboxProfile += "(allow file-read* file-write* process-exec\n";
+
+            // We create multiple allow lists, to avoid exceeding a limit in the darwin sandbox interpreter.
+            // See https://github.com/NixOS/nix/issues/4119
+            // We split our allow groups approximately at half the actual limit, 1 << 16
+            const size_t breakpoint = sandboxProfile.length() + (1 << 14);
             for (auto & i : pathsInChroot) {
+                if (sandboxProfile.length() >= breakpoint) {
+                    debug("Sandbox break: %d %d", sandboxProfile.length(), breakpoint);
+                    sandboxProfile += ")\n(allow file-read* file-write* process-exec\n";
+                }
                 if (i.first != i.second.source)
                     throw Error(
                         "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",