It turns out that on darwin our stdenv sandbox includes
/bin/sh (not sure how this is dealt with on linux, maybe
/bin/sh is exposed to the chroot? I haven’t dug into that). It also turns out that on macOS 10.15,
/bin/sh is observed to be roughly equivalent to the following shelllscript:
shell=$(readlink /private/var/select/sh) || shell=/bin/bash exec "$shell" "$@"
What this means is that allowing access to
/bin/sh isn’t sufficient on macOS, we need to allow access to
/bin/bash (but denying access to
/private/var/select/sh is fine and will ensure
/bin/sh resolves to
/bin/bash instead of another shell).
Unfortunately we don’t allow access to
/bin/bash by default, and Nix doesn’t allow that as an impure host dep prefix either.
I’ve filed https://github.com/NixOS/nix/issues/3223 regarding adding
/bin/bash to the default set of allowed impure host prefixes on darwin, but we also need to fix it so
/bin/bash actually gets into the sandbox profile. As explained in that issue, there are two approaches that could work:
- Tweak Nix itself when constructing the sandbox to look for
/bin/bashas well if it’s found.
The former means rebuilding the entire darwin world as every stdenv derivation will change. The latter doesn’t rebuild anything, and can be targeted to macOS 10.15 as well. It’s not clear to me which is actually better.
Technically with the second approach we don’t actually need to modify
DEFAULT_ALLOWED_IMPURE_PREFIXES but we should do it anyway in case someone explicitly lists
/bin/bash in their impure host deps due to knowing about this macOS 10.15 quirk.
I’d love to get some feedback as to which approach is preferable.