From 5339ffb23499662e8afe4719f24740b35e1cc784 Mon Sep 17 00:00:00 2001 From: Pierre-Etienne Meunier Date: Wed, 19 Mar 2025 17:54:01 +0200 Subject: [PATCH] fix: split macos sandbox profile to avoid size errors Fixes: https://git.lix.systems/lix-project/lix/issues/752 Fixes: https://git.lix.systems/lix-project/lix/issues/718 Co-authored-by: Poliorcetics Change-Id: Icfa95ffd40f5a60f67e14148924bc77b42232e19 --- doc/manual/change-authors.yml | 8 ++++++++ doc/manual/rl-next/macos-sandbox-fix.md | 17 +++++++++++++++++ lix/libstore/build/local-derivation-goal.cc | 10 ++++++++++ 3 files changed, 35 insertions(+) create mode 100644 doc/manual/rl-next/macos-sandbox-fix.md diff --git a/doc/manual/change-authors.yml b/doc/manual/change-authors.yml index 308366bd1..2f9fddf33 100644 --- a/doc/manual/change-authors.yml +++ b/doc/manual/change-authors.yml @@ -155,6 +155,10 @@ midnightveil: ncfavier: github: ncfavier +p-e-meunier: + display_name: Pierre-Etienne Meunier + github: P-E-Meunier + pamplemousse: display_name: Xavier Maso github: pamplemousse @@ -164,6 +168,10 @@ piegames: forgejo: piegames github: piegamesde +poliorcetics: + display_name: Poliorcetics + github: poliorcetics + puck: display_name: puck forgejo: puck diff --git a/doc/manual/rl-next/macos-sandbox-fix.md b/doc/manual/rl-next/macos-sandbox-fix.md new file mode 100644 index 000000000..80aeb1344 --- /dev/null +++ b/doc/manual/rl-next/macos-sandbox-fix.md @@ -0,0 +1,17 @@ +--- +synopsis: "Fix macOS sandbox profile size errors" +issues: [fj#752, fj#718] +cls: [2861] +category: Fixes +credits: ["p-e-meunier", "poliorcetics"] +--- + +Fixed an issue on macOS where the sandbox profile could exceed size limits when building derivations with many dependencies. The profile is now split into multiple allowed sections to stay under the interpreter's limits. + +This resolves errors like + +``` +error: (failed with exit code 1, previous messages: sandbox initialization failed: data object length 65730 exceeds maximum (65535)|failed to configure sandbox) + + error: unexpected EOF reading a line +``` diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc index ab066790b..869cecec3 100644 --- a/lix/libstore/build/local-derivation-goal.cc +++ b/lix/libstore/build/local-derivation-goal.cc @@ -25,6 +25,7 @@ #include "lix/libutil/strings.hh" #include "lix/libutil/thread-name.hh" +#include #include #include @@ -1847,7 +1848,16 @@ void LocalDerivationGoal::runChild() without file-write* allowed, access() incorrectly returns EPERM */ sandboxProfile += "(allow file-read* file-write* process-exec\n"; + + // We create multiple allow lists, to avoid exceeding a limit in the darwin sandbox interpreter. + // See https://github.com/NixOS/nix/issues/4119 + // We split our allow groups approximately at half the actual limit, 1 << 16 + const size_t breakpoint = sandboxProfile.length() + (1 << 14); for (auto & i : pathsInChroot) { + if (sandboxProfile.length() >= breakpoint) { + debug("Sandbox break: %d %d", sandboxProfile.length(), breakpoint); + sandboxProfile += ")\n(allow file-read* file-write* process-exec\n"; + } if (i.first != i.second.source) throw Error( "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",