From 7d46e9db7ec1fa02f3b1b9a7dc24fbc43e7b821d Mon Sep 17 00:00:00 2001 From: WeetHet Date: Mon, 17 Nov 2025 21:30:43 +0200 Subject: [PATCH] libstore/build: extend DNS configuration access in network sandbox https://github.com/NixOS/nixpkgs/pull/451579 PR enabled c-aresSupport for curl on darwin which ended up breaking DNS resolution in FOD sandboxes: ``` nix-run> exporting https://tangled.org/@weethet.bsky.social/nix-run (rev 73d7bf6b58848fb8f42e3a69816e0847f041c689) into /nix/store/m4m951648wmipxgwrgsml9gzjwfpfhm7-nix-run-73d7bf6 nix-run> Initialized empty Git repository in /nix/store/m4m951648wmipxgwrgsml9gzjwfpfhm7-nix-run-73d7bf6/.git/ nix-run> fatal: unable to access 'https://tangled.org/@weethet.bsky.social/nix-run/': Could not resolve host: tangled.org (Could not contact DNS servers) nix-run> fatal: unable to access 'https://tangled.org/@weethet.bsky.social/nix-run/': Could not resolve host: tangled.org (Could not contact DNS servers) nix-run> fatal: unable to access 'https://tangled.org/@weethet.bsky.social/nix-run/': Could not resolve host: tangled.org (Could not contact DNS servers) nix-run> Unable to checkout 73d7bf6b58848fb8f42e3a69816e0847f041c689 from https://tangled.org/@weethet.bsky.social/nix-run. ``` with these sandbox failures: ``` deny mach-lookup com.apple.SystemConfiguration.DNSConfiguration deny file-read-metadata /private/etc/hosts deny file-read-data /private/etc/hosts ``` We allow those so that DNS resolution work fine Change-Id: I9102293691972feb085adf8e9b1ad915bb3a36ab --- lix/libstore/build/sandbox-network.sb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lix/libstore/build/sandbox-network.sb b/lix/libstore/build/sandbox-network.sb index 335edbaed..52ee2d761 100644 --- a/lix/libstore/build/sandbox-network.sb +++ b/lix/libstore/build/sandbox-network.sb @@ -16,6 +16,8 @@ R""( ; Allow DNS lookups. (allow network-outbound (remote unix-socket (path-literal "/private/var/run/mDNSResponder"))) +(allow mach-lookup (global-name "com.apple.SystemConfiguration.DNSConfiguration")) +(allow file-read* (literal "/private/etc/hosts")) ; Allow access to trustd. (allow mach-lookup (global-name "com.apple.trustd"))