fix: split macos sandbox profile to avoid size errors

Fixes: https://git.lix.systems/lix-project/lix/issues/752
Fixes: https://git.lix.systems/lix-project/lix/issues/718

Co-authored-by: Poliorcetics <poliorcetics@users.noreply.github.com>
Change-Id: Icfa95ffd40f5a60f67e14148924bc77b42232e19

doc/manual/change-authors.yml

@@ -155,6 +155,10 @@ midnightveil:
 ncfavier:
   github: ncfavier
 
+p-e-meunier:
+  display_name: Pierre-Etienne Meunier
+  github: P-E-Meunier
+
 pamplemousse:
   display_name: Xavier Maso
   github: pamplemousse
@@ -164,6 +168,10 @@ piegames:
   forgejo: piegames
   github: piegamesde
 
+poliorcetics:
+  display_name: Poliorcetics
+  github: poliorcetics
+
 puck:
   display_name: puck
   forgejo: puck

doc/manual/rl-next/macos-sandbox-fix.md

@@ -0,0 +1,17 @@
+---
+synopsis: "Fix macOS sandbox profile size errors"
+issues: [fj#752, fj#718]
+cls: [2861]
+category: Fixes
+credits: ["p-e-meunier", "poliorcetics"]
+---
+
+Fixed an issue on macOS where the sandbox profile could exceed size limits when building derivations with many dependencies. The profile is now split into multiple allowed sections to stay under the interpreter's limits.
+
+This resolves errors like
+
+```
+error: (failed with exit code 1, previous messages: sandbox initialization failed: data object length 65730 exceeds maximum (65535)|failed to configure sandbox)
+
+       error: unexpected EOF reading a line
+```

lix/libstore/build/local-derivation-goal.cc

@@ -25,6 +25,7 @@
 #include "lix/libutil/strings.hh"
 #include "lix/libutil/thread-name.hh"
 
+#include <cstddef>
 #include <regex>
 #include <queue>
 
@@ -1847,7 +1848,16 @@ void LocalDerivationGoal::runChild()
                without file-write* allowed, access() incorrectly returns EPERM
              */
             sandboxProfile += "(allow file-read* file-write* process-exec\n";
+
+            // We create multiple allow lists, to avoid exceeding a limit in the darwin sandbox interpreter.
+            // See https://github.com/NixOS/nix/issues/4119
+            // We split our allow groups approximately at half the actual limit, 1 << 16
+            const size_t breakpoint = sandboxProfile.length() + (1 << 14);
             for (auto & i : pathsInChroot) {
+                if (sandboxProfile.length() >= breakpoint) {
+                    debug("Sandbox break: %d %d", sandboxProfile.length(), breakpoint);
+                    sandboxProfile += ")\n(allow file-read* file-write* process-exec\n";
+                }
                 if (i.first != i.second.source)
                     throw Error(
                         "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",