lix-project/lix
18
37
Fork 14
Code Issues 286 Code Review (Gerrit) Projects 1 Releases Wiki Activity

[Nix#9625] aarch64-darwin: sandbox issue with /private/etc/ssl/openssl.cnf #83

New issue
Open
opened 2024-03-16 06:44:49 +00:00 by lix-bot · 0 comments
lix-bot commented 2024-03-16 06:44:49 +00:00
Member
Copy link

Upstream-Issue: NixOS/nix#9625

Describe the bug

Migrating from https://github.com/oxalica/rust-overlay/issues/148

In short, I'm having a new build failure for rust packages using oxalica/rust-overlay that seems to be related to a sandboxing issue (as it is giving a permissions error for /private/etc/ssl/openssl.cnf but succeeds with --option sandbox false. An identical flake was building without issue previously, so my guess is that it's related to the recently installed MacOS Sonoma 14.2 update.

I've been following https://github.com/NixOS/nix/issues/4119 with great interest, so I thought this ?sandbox issue belonged in nixos/nix but would be happy to move elsewhere.

Steps To Reproduce

Run the following with the below flake.nix:

$ nix develop
$ cargo init --name foo
$ cargo update
$ exit
$ git add .
$
$ nix build
error: builder for '/nix/store/s76i74llg2dbd49hc013y58zxmcbcry1-foo.drv' failed with exit code 1;
       last 10 log lines:
       > Finished cargoSetupPostPatchHook
       > Running phase: updateAutotoolsGnuConfigScriptsPhase
       > Running phase: configurePhase
       > Running phase: buildPhase
       > Executing cargoBuildHook
       > ++ env CC_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CXX_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CC_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CXX_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CARGO_BUILD_TARGET=aarch64-apple-darwin HOST_CC=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc HOST_CXX=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ cargo build -j 8 --target aarch64-apple-darwin --frozen --profile release
       > Auto configuration failed
       > 8082083840:error:02FFF001:system library:func(4095):Operation not permitted:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:122:fopen('/private/etc/ssl/openssl.cnf', 'rb')
       > 8082083840:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:127:
       > 8082083840:error:0EFFF002:configuration file routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/conf/conf_def.c:202:
       For full logs, run 'nix log /nix/store/s76i74llg2dbd49hc013y58zxmcbcry1-foo.drv'. 
$
$ nix build --option sandbox false
$ result/bin/foo
Hello, world!

{
  description = "Basic template for nix + rust";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = {
    self,
    nixpkgs,
    rust-overlay,
  }: let
    system = "aarch64-darwin";
    pkgs = import nixpkgs {
      inherit system;
      overlays = [
        (import rust-overlay)
      ];
    };
    toolchain = pkgs.rust-bin.stable.latest.default;
    rustPlatform = pkgs.makeRustPlatform {
      rustc = toolchain;
      cargo = toolchain;
    };
    name = "foo";
  in {
    packages.${system} = {
      default = self.packages.${system}.${name};
      ${name} = rustPlatform.buildRustPackage {
        inherit name;
        version = "0.0.1";
        src = ./.;
        cargoLock.lockFile = ./Cargo.lock;
      };
    };

    apps.${system}.default = {
      type = "app";
      program = "${self.packages.${system}.${name}}/bin/${name}";
    };

    devShells.${system}.default = pkgs.mkShell {
      buildInputs = [toolchain];
    };
  };
}

Expected behavior

Successful build

nix-env --version output

$ nix-env --version
nix-env (Nix) 2.18.1

Additional context

I'm not finding any relevant issues googling or searching nixpkgs issues for "/private/etc/ssl/openssl.cnf" or "Auto configuration failed".

$ stat /private/etc/ssl/openssl.cnf
  File: /private/etc/ssl/openssl.cnf
  Size: 745             Blocks: 8          IO Block: 4096   regular file
Device: 1,25    Inode: 463498578   Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/   wheel)
Access: 2023-12-05 00:37:15.000000000 -0700
Modify: 2023-12-05 00:37:15.000000000 -0700
Change: 2023-12-12 12:15:52.130035727 -0700
 Birth: 2023-12-05 00:37:15.000000000 -0700

Full log:

$ nix log /nix/store/s76i74llg2dbd49hc013y58zxmcbcry1-foo.drv
@nix { "action": "setPhase", "phase": "unpackPhase" }
Running phase: unpackPhase
unpacking source archive /nix/store/8m5mxx9kjp334f38ww1mv65ivfamajnd-2h89izhgqg0vhmpwd913vgiplglql24l-source
source root is 2h89izhgqg0vhmpwd913vgiplglql24l-source
Executing cargoSetupPostUnpackHook
Finished cargoSetupPostUnpackHook
@nix { "action": "setPhase", "phase": "patchPhase" }
Running phase: patchPhase
Executing cargoSetupPostPatchHook
Validating consistency between /private/tmp/nix-build-foo.drv-0/2h89izhgqg0vhmpwd913vgiplglql24l-source/Cargo.lock and /private/tmp/nix-build-foo.drv-0/cargo-vendor-dir/Cargo.lock
Finished cargoSetupPostPatchHook
@nix { "action": "setPhase", "phase": "updateAutotoolsGnuConfigScriptsPhase" }
Running phase: updateAutotoolsGnuConfigScriptsPhase
@nix { "action": "setPhase", "phase": "configurePhase" }
Running phase: configurePhase
@nix { "action": "setPhase", "phase": "buildPhase" }
Running phase: buildPhase
Executing cargoBuildHook
++ env CC_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CXX_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CC_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CXX_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CARGO_BUILD_TARGET=aarch64-apple-darwin HOST_CC=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc HOST_CXX=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ cargo build -j 8 --target aarch64-apple-darwin --frozen --profile release
Auto configuration failed
8082083840:error:02FFF001:system library:func(4095):Operation not permitted:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:122:fopen('/private/etc/ssl/openssl.cnf', 'rb')
8082083840:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:127:
8082083840:error:0EFFF002:configuration file routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/conf/conf_def.c:202:

Priorities

Add 👍 to issues you find important.

Upstream-Issue: https://git.lix.systems/NixOS/nix/issues/9625 **Describe the bug** Migrating from https://github.com/oxalica/rust-overlay/issues/148 In short, I'm having a new build failure for rust packages using `oxalica/rust-overlay` that seems to be related to a sandboxing issue (as it is giving a permissions error for `/private/etc/ssl/openssl.cnf` but succeeds with `--option sandbox false`. An identical flake was building without issue previously, so my guess is that it's related to the recently installed MacOS Sonoma 14.2 update. I've been following https://github.com/NixOS/nix/issues/4119 with great interest, so I thought this ?sandbox issue belonged in nixos/nix but would be happy to move elsewhere. **Steps To Reproduce** Run the following with the below `flake.nix`: ```console $ nix develop $ cargo init --name foo $ cargo update $ exit $ git add . $ $ nix build error: builder for '/nix/store/s76i74llg2dbd49hc013y58zxmcbcry1-foo.drv' failed with exit code 1; last 10 log lines: > Finished cargoSetupPostPatchHook > Running phase: updateAutotoolsGnuConfigScriptsPhase > Running phase: configurePhase > Running phase: buildPhase > Executing cargoBuildHook > ++ env CC_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CXX_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CC_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CXX_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CARGO_BUILD_TARGET=aarch64-apple-darwin HOST_CC=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc HOST_CXX=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ cargo build -j 8 --target aarch64-apple-darwin --frozen --profile release > Auto configuration failed > 8082083840:error:02FFF001:system library:func(4095):Operation not permitted:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:122:fopen('/private/etc/ssl/openssl.cnf', 'rb') > 8082083840:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:127: > 8082083840:error:0EFFF002:configuration file routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/conf/conf_def.c:202: For full logs, run 'nix log /nix/store/s76i74llg2dbd49hc013y58zxmcbcry1-foo.drv'. $ $ nix build --option sandbox false $ result/bin/foo Hello, world! ``` ```nix { description = "Basic template for nix + rust"; inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; rust-overlay = { url = "github:oxalica/rust-overlay"; inputs.nixpkgs.follows = "nixpkgs"; }; }; outputs = { self, nixpkgs, rust-overlay, }: let system = "aarch64-darwin"; pkgs = import nixpkgs { inherit system; overlays = [ (import rust-overlay) ]; }; toolchain = pkgs.rust-bin.stable.latest.default; rustPlatform = pkgs.makeRustPlatform { rustc = toolchain; cargo = toolchain; }; name = "foo"; in { packages.${system} = { default = self.packages.${system}.${name}; ${name} = rustPlatform.buildRustPackage { inherit name; version = "0.0.1"; src = ./.; cargoLock.lockFile = ./Cargo.lock; }; }; apps.${system}.default = { type = "app"; program = "${self.packages.${system}.${name}}/bin/${name}"; }; devShells.${system}.default = pkgs.mkShell { buildInputs = [toolchain]; }; }; } ``` **Expected behavior** Successful build **`nix-env --version` output** ```console $ nix-env --version nix-env (Nix) 2.18.1 ``` **Additional context** I'm not finding any relevant issues googling or searching nixpkgs issues for "/private/etc/ssl/openssl.cnf" or "Auto configuration failed". ```console $ stat /private/etc/ssl/openssl.cnf File: /private/etc/ssl/openssl.cnf Size: 745 Blocks: 8 IO Block: 4096 regular file Device: 1,25 Inode: 463498578 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ wheel) Access: 2023-12-05 00:37:15.000000000 -0700 Modify: 2023-12-05 00:37:15.000000000 -0700 Change: 2023-12-12 12:15:52.130035727 -0700 Birth: 2023-12-05 00:37:15.000000000 -0700 ``` Full log: ```console $ nix log /nix/store/s76i74llg2dbd49hc013y58zxmcbcry1-foo.drv @nix { "action": "setPhase", "phase": "unpackPhase" } Running phase: unpackPhase unpacking source archive /nix/store/8m5mxx9kjp334f38ww1mv65ivfamajnd-2h89izhgqg0vhmpwd913vgiplglql24l-source source root is 2h89izhgqg0vhmpwd913vgiplglql24l-source Executing cargoSetupPostUnpackHook Finished cargoSetupPostUnpackHook @nix { "action": "setPhase", "phase": "patchPhase" } Running phase: patchPhase Executing cargoSetupPostPatchHook Validating consistency between /private/tmp/nix-build-foo.drv-0/2h89izhgqg0vhmpwd913vgiplglql24l-source/Cargo.lock and /private/tmp/nix-build-foo.drv-0/cargo-vendor-dir/Cargo.lock Finished cargoSetupPostPatchHook @nix { "action": "setPhase", "phase": "updateAutotoolsGnuConfigScriptsPhase" } Running phase: updateAutotoolsGnuConfigScriptsPhase @nix { "action": "setPhase", "phase": "configurePhase" } Running phase: configurePhase @nix { "action": "setPhase", "phase": "buildPhase" } Running phase: buildPhase Executing cargoBuildHook ++ env CC_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CXX_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CC_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CXX_AARCH64_APPLE_DARWIN=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc CARGO_BUILD_TARGET=aarch64-apple-darwin HOST_CC=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/cc HOST_CXX=/nix/store/vwh2qqal1q101wv4jy40giavp73q0msd-clang-wrapper-16.0.6/bin/c++ cargo build -j 8 --target aarch64-apple-darwin --frozen --profile release Auto configuration failed 8082083840:error:02FFF001:system library:func(4095):Operation not permitted:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:122:fopen('/private/etc/ssl/openssl.cnf', 'rb') 8082083840:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:127: 8082083840:error:0EFFF002:configuration file routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/0032d1ee-80fd-11ee-8227-6aecfccc70fe/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/conf/conf_def.c:202: ``` **Priorities** Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).
lix-bot added the
bug
imported
 labels 2024-03-16 06:44:49 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
git-series/activity-cleanup
release-2.90
sb/tom-hubrecht/primops.cc-v2
sb/bacchanalia/cache-strlen%topic=substr-perf
sb/arcuru/commit-msg
sb/qyriad/beta-1
sb/qyriad/2.90-beta.0
rbt/pre-commit-update
sb/rbt/test-branch
sb/rbt/justfile
sb/rbt/repl-overlays
sb/fuck/what
sb/rbt/pre-commit
sb/rbt/makeflags
sb/pennae/io-rewrite
sb/qyriad/maint-meson
sb/qyriad/maint/meson
sb/puck/meson-c-api
sb/pennae/parser-rewrite
sb/jade/burn-it-all
dependabot/github_actions/zeebe-io/backport-action-2.4.1
dependabot/github_actions/cachix/install-nix-action-25
dependabot/github_actions/actions/labeler-5
dependabot/github_actions/cachix/cachix-action-14
2.90.0-rc1
2.90-beta.1
2.90-beta.0
Labels
Clear labels   
Area/build-packaging

regarding the building or packaging of Lix itself

  
Area/evaluator

libexpr and anything else related to the evaluation of Nix expressions

  
Area/flakes

   
Area/profiles

profiles: nix-env, nix profile, and installer flavors all alike

  
Area/remote-builds

remote builds

  
Area/repl

nix repl

  
Area/store

libstore and anything else relating to the Nix store

  
bug

it's a bug

  
Cross Compilation

   
devx

development experience issues

  
docs

   
Downstream Dependents

regarding an external tool's usage with Lix (e.g. nix-eval-jobs)

  
E/easy

bug is relatively simple and could simply be fixed with some minor effort

  
E/hard

this issue should probably be solved with close involvement of an expert

  
E/help wanted

maintainers may not get to this soon, but we want it fixed

  
E/reproducible

This bug is reproducible and obvious.

  
E/requires rearchitecture

this bug cannot be fixed properly without fixing a known architectural flaw

  
imported

Issue imported from upstream nix (please do not remove this label, it will cause dupes if import is rerun)

  
Needs Langver

We can't get to this until we implement language versioning

  
OS/Linux

Affects specifically Lix on Linux

  
OS/macOS

Affects specifically Lix on macOS

  
performance

make lix go faster

  
regression

This is a regression since some previous version of Lix

  
release-blocker

Blocks public release

  
RFD

Request for discussion

  
stability

Fixing this makes the software more stable

  
Status
blocked
Blocked on something

  
Status
invalid
not our bug, duplicate, similar

  
Status
postponed
closed but should maybe look at later (generally with S-wontfix)

  
Status
wontfix
We chose not to change this (see issue comments for more detail).

  
testing

Tests that should be added

  
ux

makes the user experience better :)

No labels
Area/build-packaging
Area/evaluator
Area/flakes
Area/profiles
Area/remote-builds
Area/repl
Area/store
bug
Cross Compilation
devx
docs
Downstream Dependents
E/easy
E/hard
E/help wanted
E/reproducible
E/requires rearchitecture
imported
Needs Langver
OS/Linux
OS/macOS
performance
regression
release-blocker
RFD
stability
Status
blocked
Status
invalid
Status
postponed
Status
wontfix
testing
ux
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: lix-project/lix#83
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?