Always use the Darwin sandbox

Even with "build-use-sandbox = false", we now use sandboxing with a
permissive profile that allows everything except the creation of
setuid/setgid binaries.

.gitignore

@@ -48,9 +48,7 @@ perl/Makefile.config
 /src/libexpr/nix.tbl
 
 # /src/libstore/
-/src/libstore/schema.sql.gen.hh
-/src/libstore/sandbox-defaults.sb.gen.hh
-/src/libstore/sandbox-network.sb.gen.hh
+/src/libstore/*.gen.hh
 
 /src/nix/nix
 

src/libstore/build.cc

@@ -2611,12 +2611,16 @@ void DerivationGoal::runChild()
 
         const char *builder = "invalid";
 
-        string sandboxProfile;
         if (drv->isBuiltin()) {
             ;
         }
 #if __APPLE__
-        else if (useChroot) {
+        else {
+            /* This has to appear before import statements. */
+            std::string sandboxProfile = "(version 1)\n";
+
+            if (useChroot) {
+
                 /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */
                 PathSet ancestry;
 
@@ -2643,9 +2647,6 @@ void DerivationGoal::runChild()
                 for (auto & i : inputPaths)
                     dirsInChroot[i] = i;
 
-            /* This has to appear before import statements */
-            sandboxProfile += "(version 1)\n";
-
                 /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */
                 if (settings.darwinLogSandboxViolations) {
                     sandboxProfile += "(deny default)\n";
@@ -2662,13 +2663,6 @@ void DerivationGoal::runChild()
                         #include "sandbox-network.sb.gen.hh"
                         ;
 
-            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
-               to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */
-            Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);
-
-            /* They don't like trailing slashes on subpath directives */
-            if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
-
                 /* Our rwx outputs */
                 sandboxProfile += "(allow file-read* file-write* process-exec\n";
                 for (auto & i : missingPaths) {
@@ -2709,6 +2703,10 @@ void DerivationGoal::runChild()
                 sandboxProfile += ")\n";
 
                 sandboxProfile += additionalSandboxProfile;
+            } else
+                sandboxProfile +=
+                    #include "sandbox-minimal.sb.gen.hh"
+                    ;
 
             debug("Generated sandbox profile:");
             debug(sandboxProfile);
@@ -2717,6 +2715,13 @@ void DerivationGoal::runChild()
 
             writeFile(sandboxFile, sandboxProfile);
 
+            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms
+               to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */
+            Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);
+
+            /* They don't like trailing slashes on subpath directives */
+            if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
+
             builder = "/usr/bin/sandbox-exec";
             args.push_back("sandbox-exec");
             args.push_back("-f");
@@ -2725,12 +2730,13 @@ void DerivationGoal::runChild()
             args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
             args.push_back(drv->builder);
         }
-#endif
+#else
         else {
             builder = drv->builder.c_str();
             string builderBasename = baseNameOf(drv->builder);
             args.push_back(builderBasename);
         }
+#endif
 
         for (auto & i : drv->args)
             args.push_back(rewriteStrings(i, inputRewrites));

src/libstore/local.mk

@@ -36,7 +36,9 @@ libstore_CXXFLAGS = \
 
 $(d)/local-store.cc: $(d)/schema.sql.gen.hh
 
-$(d)/build.cc: $(d)/sandbox-defaults.sb.gen.hh $(d)/sandbox-network.sb.gen.hh
+sandbox-headers = $(d)/sandbox-defaults.sb.gen.hh $(d)/sandbox-network.sb.gen.hh $(d)/sandbox-minimal.sb.gen.hh
+
+$(d)/build.cc: $(sandbox-headers)
 
 %.gen.hh: %
 	@echo 'R"foo(' >> $@.tmp
@@ -44,6 +46,6 @@ $(d)/build.cc: $(d)/sandbox-defaults.sb.gen.hh $(d)/sandbox-network.sb.gen.hh
 	@echo ')foo"' >> $@.tmp
 	@mv $@.tmp $@
 
-clean-files += $(d)/schema.sql.gen.hh $(d)/sandbox-defaults.sb.gen.hh $(d)/sandbox-network.sb.gen.hh
+clean-files += $(d)/schema.sql.gen.hh $(sandbox-headers)
 
 $(eval $(call install-file-in, $(d)/nix-store.pc, $(prefix)/lib/pkgconfig, 0644))

src/libstore/sandbox-defaults.sb

@@ -1,5 +1,7 @@
 (define TMPDIR (param "_GLOBAL_TMP_DIR"))
 
+(deny default)
+
 ; Disallow creating setuid/setgid binaries, since that
 ; would allow breaking build user isolation.
 (deny file-write-setugid)

src/libstore/sandbox-minimal.sb

@@ -0,0 +1,5 @@
+(allow default)
+
+; Disallow creating setuid/setgid binaries, since that
+; would allow breaking build user isolation.
+(deny file-write-setugid)