libstore: generate darwin sandbox profile outside of sandbox process

Change-Id: I1a82e1dfa3709e1513d7acbdff50dc594cbc2323

lix/libstore/platform/darwin.cc

@@ -254,10 +254,10 @@ try {
     co_return result::current_exception();
 }
 
-void DarwinLocalDerivationGoal::finishChildSetup()
+void DarwinLocalDerivationGoal::prepareSandbox()
 {
     /* This has to appear before import statements. */
-    std::string sandboxProfile = "(version 1)\n";
+    sandboxProfile = "(version 1)\n";
 
     if (useChroot) {
 
@@ -369,7 +369,10 @@ void DarwinLocalDerivationGoal::finishChildSetup()
     }
 
     debug("Generated sandbox profile: %1%", sandboxProfile);
+}
 
+void DarwinLocalDerivationGoal::finishChildSetup()
+{
     bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");
 
     /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try

lix/libstore/platform/darwin.hh

@@ -37,11 +37,12 @@ public:
     using LocalDerivationGoal::LocalDerivationGoal;
 
 private:
+    std::string sandboxProfile;
+
     /**
-     * Prepare the sandbox: This is empty on Darwin since sandbox setup happens in
-     * enterSandbox
+     * Prepare the sandbox: generate the sandboxProfile
      */
-    void prepareSandbox() override{};
+    void prepareSandbox() override;
 
     void finishChildSetup() override;