libstore: fix sandboxed builds on macOS

[emilazy]

Motivation

Sandboxed builds are completely broken on macOS on every release branch right now.

Context

The recent fix for CVE-2024-38531 broke the sandbox on macOS completely. As it’s not practical to use chroot(2) on macOS, the build takes place in the main filesystem tree, and the world‐unreadable wrapper directory prevents the build from accessing its $TMPDIR at all.

The macOS sandbox probably shouldn’t be treated as any kind of a security boundary in its current state, but this specific vulnerability wasn’t possible to exploit on macOS anyway, as creating set{u,g}id binaries is blocked by sandbox policy.

Locking down the build sandbox further may be a good idea in future, but it already has significant compatibility issues. For now, restore the previous status quo on macOS.

Thanks to @alois31 for helping me come to a better understanding of the vulnerability.

Fixes: 1d3696f
Closes: #11002

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

[emilazy]

I’ve been testing builds and I think expunging /tmp references is tractable, although it’ll certainly be a bit of a game of whack‐a‐mole. (Nix’s own gtest dependency does it, despite having an abstraction elsewhere in its codebase for getting the right temporary directory.)

I got this error after failing to build Nix after having earlier done some testing involving aws-sdk-cpp; strange, as the Nix build didn’t rebuild the package:

error (ignored): error: cannot unlink '"/private/tmp/nix-build-aws-sdk-cpp-1.11.336.drv-0/source/generated/src"': Directory not empty

Not sure what’s going on there, but it wasn’t fatal at least.

[emilazy]

Oh, it actually is fatal for the Nix build. I’ll look into it…

[emilazy]

I can’t really reproduce that issue properly and it was coupled with other issues that seem like they couldn’t possibly be related to my changes here, so I’m going to chalk it up to gremlins.

[emilazy]

Force‐pushed to simply restore the previous status quo on macOS in order to maintain compatibility, after further discussion with @alois31 convinced me that the vulnerability isn’t relevant on macOS.

[Mic92]

• tested on aarch64-darwin:
  • single-user
  • nix-daemon

[roberth]

I don't know if topTmpDir could be confused for NIX_BUILD_TOP, but that's very a minor concern for a fix PR.

[roberth]

Thank you @emilazy!

[github-actions]

Backport failed for 2.18-maintenance, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin 2.18-maintenance
git worktree add -d .worktree/backport-11031-to-2.18-maintenance origin/2.18-maintenance
cd .worktree/backport-11031-to-2.18-maintenance
git switch --create backport-11031-to-2.18-maintenance
git cherry-pick -x 76e4adfaac3083056e79b518ccc197a7645a0f2d af2e1142b17dadf24a0b66d8973033dce6efa32b

[github-actions]

Backport failed for 2.19-maintenance, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin 2.19-maintenance
git worktree add -d .worktree/backport-11031-to-2.19-maintenance origin/2.19-maintenance
cd .worktree/backport-11031-to-2.19-maintenance
git switch --create backport-11031-to-2.19-maintenance
git cherry-pick -x 76e4adfaac3083056e79b518ccc197a7645a0f2d af2e1142b17dadf24a0b66d8973033dce6efa32b

[github-actions]

Backport failed for 2.20-maintenance, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin 2.20-maintenance
git worktree add -d .worktree/backport-11031-to-2.20-maintenance origin/2.20-maintenance
cd .worktree/backport-11031-to-2.20-maintenance
git switch --create backport-11031-to-2.20-maintenance
git cherry-pick -x 76e4adfaac3083056e79b518ccc197a7645a0f2d af2e1142b17dadf24a0b66d8973033dce6efa32b

[github-actions]

Backport failed for 2.21-maintenance, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin 2.21-maintenance
git worktree add -d .worktree/backport-11031-to-2.21-maintenance origin/2.21-maintenance
cd .worktree/backport-11031-to-2.21-maintenance
git switch --create backport-11031-to-2.21-maintenance
git cherry-pick -x 76e4adfaac3083056e79b518ccc197a7645a0f2d af2e1142b17dadf24a0b66d8973033dce6efa32b

[github-actions]

Successfully created backport PR for 2.22-maintenance:

• [Backport 2.22-maintenance] libstore: fix sandboxed builds on macOS #11044

[github-actions]

Successfully created backport PR for 2.23-maintenance:

• [Backport 2.23-maintenance] libstore: fix sandboxed builds on macOS #11045

[emilazy]

Thank you for the merge! I can do manual backports for the other branches if it’ll be possible to get releases out. If you can think of a better name for the variable I could rename it in the backports to save additional work?

[emilazy]

Ah, I see you already manually handled the backports; thank you!