max/nix-super
1
0
Fork 0
mirror of https://github.com/privatevoid-net/nix-super.git synced 2024-11-10 08:16:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

local-derivation-goal.cc: improve error messages when sandboxing fails

Browse source 
The failure modes for nix's sandboxing setup are pretty complicated.
When nix is unable to set up the sandbox, let's provide more detail
about what went wrong.  Specifically:

* Make sure the error message includes the word "sandbox" so the user
  knows that the failure was related to sandboxing.

* If `--option sandbox-fallback false` was provided, and removing it
  would have allowed further attempts to make progress, let the user
  know.
This commit is contained in:
Adam Joseph 2022-07-16 14:39:22 -07:00
parent 59764eb842
commit 8ea3a911aa
1 changed files with 17 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
src/libstore/build/local-derivation-goal.cc
View file

@ -850,13 +850,23 @@ void LocalDerivationGoal::startBuilder()
flags &= ~CLONE_NEWUSER; flags &= ~CLONE_NEWUSER;
child = clone(childEntry, stack + stackSize, flags, this); child = clone(childEntry, stack + stackSize, flags, this);
} }
/* Otherwise exit with EPERM so we can handle this in the if (child == -1)
parent. This is only done when sandbox-fallback is set switch(errno) {
to true (the default). */ case EPERM:
if (child == -1 && (errno == EPERM || errno == EINVAL) && settings.sandboxFallback) case EINVAL: {
_exit(1); /* Otherwise exit with EPERM so we can handle this in the
if (child == -1) throw SysError("cloning builder process"); parent. This is only done when sandbox-fallback is set
to true (the default). */
if (settings.sandboxFallback)
_exit(1);
/* Mention sandbox-fallback in the error message so the user
knows that having it disabled contributed to the
unrecoverability of this failure */
throw SysError("creating sandboxed builder process using clone(), without sandbox-fallback");
}
default:
throw SysError("creating sandboxed builder process using clone()");
}
writeFull(builderOut.writeSide.get(), writeFull(builderOut.writeSide.get(),
fmt("%d %d\n", usingUserNamespace, child)); fmt("%d %d\n", usingUserNamespace, child));
_exit(0); _exit(0);