can't bind to "localhost" with sandboxing on OS X

[talya]

Description of the problem / feature request:

new InetSocketAddress("localhost", 0).bind()
fails on OS X when ran with sandboxing
it passes without sandboxing or with sandboxing on docker-on-mac

Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

https://github.com/talya/bazel-localhost-resolving

Environment info

• OS X Sierra (10.12)
• bazel 0.13.0

Have you found anything relevant by searching the web?

related to #2669 and seems that relevant code is DarwinSandboxedSpawnRunner (which was last changed to allow the unix-socket in #3444):

        out.println("(deny network*)");
        out.println("(allow network* (local ip \"localhost:*\"))");
        out.println("(allow network* (remote ip \"localhost:*\"))");
        out.println("(allow network* (remote unix-socket))");
      }```

[talya]

@buchgr , could you take a look?

@ittaiz fyi

[buchgr]

I am not sure I understand. You added the block-network tag to your target. So it's expected that the network doesn't work?

[talya]

external network shouldn't work yes, but binding to local host (INetAddress 'localhost/127.0.0.1:0') (with 'block-network'):
works on linux
works on docker-on-mac
does NOT work on mac

[buchgr]

oh i see. does it work to bind to an arbitrary free port?

[talya]

iiuc using port 0 does what you mean?
this is the code from the sample repo:

String host = "localhost";
InetSocketAddress address = new InetSocketAddress(host, 0);

[buchgr]

What I meant was what if you try to bind to a free port that you specify explicitly. I have just tried it out myself and that doesn't work either. Seems like a legit bug - thanks for reporting it and providing a reproducer!

[talya]

ping
any update on this?

also, possibly the fix for this older issue is relevant - "The behavior of the Linux sandbox was changed to not hide the local hostname by default."
but no matching Darwin code was changed to match.

[talya]

I tried locally changing bazel to fix this, summarizing my attempts:

trying to change these lines

out.println("(allow network* (local ip \"localhost:*\"))");
out.println("(allow network* (remote ip \"localhost:*\"))");

It's not possible to change this to be localhost/127.0.0.1:* or localhost/*:* since Apple's .sb format doesn't support this (results in this error: host must be * or localhost in network address)
Also tried using out.println("(allow network* (local ip))"); but that completely breaks the sandboxing since even external addresses are accessible.
I Added the shouldNotBindToNonLoopbackAddress test to the sample repo guard against this.

[ittaiz]

Hi, Any news?

…

On Tue, 19 Jun 2018 at 16:46 Talya Gendler ***@***.***> wrote: I tried locally changing bazel to fix this, summarizing my attempts: trying to change these lines out.println("(allow network* (local ip \"localhost:*\"))"); out.println("(allow network* (remote ip \"localhost:*\"))"); It's not possible to change this to be localhost/127.0.0.1:* or localhost/*:* since Apple's .sb format doesn't support this (results in this error: host must be * or localhost in network address) Also tried using out.println("(allow network* (local ip))"); but that completely breaks the sandboxing since even external addresses are accessible. I Added the shouldNotBindToNonLoopbackAddress test to the sample repo guard against this. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5206 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABUIF-7yXHtEcckkNDO-TKk5nIv8CnQEks5t-QDOgaJpZM4UA1Y5> .

[buchgr]

@philwo is back tomorrow. He should be able to sort this out quickly.

[philwo]

Hi,

unfortunately this is nothing that Bazel can fix. It's an issue in macOS's sandbox implementation.

As you have found out, the only valid values for the "allow/deny network" settings are "*" and "localhost". We are already setting this to "localhost". The fact that macOS's sandbox then still forbids binding to "localhost" is a bug in the sandbox, not in Bazel.

However, as we hit the same issue in Bazel, luckily I can share a workaround with you that you can apply to your own code:

https://source.bazel.build/bazel/+/6b8c7ca48e9e48a9906c031346dc4a924b7ef559:src/main/java/com/google/devtools/build/lib/server/GrpcServerImpl.java;l=691

I'd also recommend reporting this issue to Apple.

Hope this helps,
Philipp

[talya]

Thanks, the comment in the referenced code is quite detailed:)