From ff16735ca585bd427e4a55ea773d312ef5d9708e Mon Sep 17 00:00:00 2001 From: Emily Date: Fri, 27 Jun 2025 14:42:07 +0100 Subject: [PATCH] libstore: fix Unix sockets in the build directory on sandboxed macOS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We’re already allowing `/tmp` anyway, so this should be harmless, and it fixes a regression in the default configuration caused by moving the build directories out of `temp-dir`. (For instance, that broke the Lix `guessOrInventPath.sockets` test.) Note that removing `/tmp` breaks quite a few builds, so although it may be a good idea in general it would require work on the Nixpkgs side. Fixes: 749afbbe99fd7b45f828b72628252feba9241362 Change-Id: I6a6a69645f429bc50d4cb24283feda3d3091f534 (cherry picked from commit d1db3e5fa3faa43b3d2f2e2e843e9cfc1e6e1b71) --- lix/libstore/build/local-derivation-goal.cc | 2 ++ lix/libstore/build/sandbox-defaults.sb | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc index 1d1d59a31..fac4335fe 100644 --- a/lix/libstore/build/local-derivation-goal.cc +++ b/lix/libstore/build/local-derivation-goal.cc @@ -1511,6 +1511,8 @@ void LocalDerivationGoal::runChild() if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { Strings sandboxArgs; + sandboxArgs.push_back("_NIX_BUILD_TOP"); + sandboxArgs.push_back(tmpDir); sandboxArgs.push_back("_GLOBAL_TMP_DIR"); sandboxArgs.push_back(globalTmpDir); if (allowLocalNetworking) { diff --git a/lix/libstore/build/sandbox-defaults.sb b/lix/libstore/build/sandbox-defaults.sb index 25ec11285..1b1ee2811 100644 --- a/lix/libstore/build/sandbox-defaults.sb +++ b/lix/libstore/build/sandbox-defaults.sb @@ -26,12 +26,14 @@ R""( ; Allow getpwuid. (allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo")) -; Access to /tmp. +; Access to /tmp and the build directory. ; The network-outbound/network-inbound ones are for unix domain sockets, which ; we allow access to in TMPDIR (but if we allow them more broadly, you could in ; theory escape the sandbox) (allow file* process-exec network-outbound network-inbound - (literal "/tmp") (subpath TMPDIR)) + (literal "/tmp") + (subpath TMPDIR) + (subpath (param "_NIX_BUILD_TOP"))) ; Some packages like to read the system version. (allow file-read*