From 589da451e44bcf68e59c1ae6ad514de6066f8470 Mon Sep 17 00:00:00 2001
From: Pierre-Etienne Meunier <pe@pijul.org>
Date: Wed, 26 Feb 2025 12:02:53 +0100
Subject: [PATCH] Fix macos sandbox issue
Co-authored-by: John Ericson <git@JohnEricson.me>
Co-authored-by: Poliorcetics <poliorcetics@users.noreply.github.com>
(cherry picked from commit 300465c7b852fb4934cd862305573c902b7d5ac9)
---
src/libstore/unix/build/local-derivation-goal.cc | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 0f51f58e8..f8824e9ce 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -2100,7 +2100,18 @@ void LocalDerivationGoal::runChild()
without file-write* allowed, access() incorrectly returns EPERM
*/
sandboxProfile += "(allow file-read* file-write* process-exec\n";
+
+ // We create multiple allow lists, to avoid exceeding a limit in the darwin sandbox interpreter.
+ // See https://github.com/NixOS/nix/issues/4119
+ // We split our allow groups approximately at half the actual limit, 1 << 16
+ const int breakpoint = sandboxProfile.length() + (1 << 14);
for (auto & i : pathsInChroot) {
+
+ if (sandboxProfile.length() >= breakpoint) {
+ debug("Sandbox break: %d %d", sandboxProfile.length(), breakpoint);
+ sandboxProfile += ")\n(allow file-read* file-write* process-exec\n";
+ }
+
if (i.first != i.second.source)
throw Error(
"can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",