Gimp build fails with this message: >>> Source configured. * --------------------------- ACCESS VIOLATION SUMMARY --------------------------- * LOG FILE: "/var/log/sandbox/sandbox-4.log" * VERSION 1.0 FORMAT: F - Function called FORMAT: S - Access Status FORMAT: P - Path as passed to function FORMAT: A - Absolute Path (not canonical) FORMAT: R - Canonical Path FORMAT: C - Command Line F: open_wr S: deny P: /dev/dri/renderD128 A: /dev/dri/renderD128 R: /dev/dri/renderD128 C: /usr/bin/gegl-0.4 --exists gegl:matting-levin F: open_wr S: deny P: /dev/dri/renderD128 A: /dev/dri/renderD128 R: /dev/dri/renderD128 C: /usr/bin/gegl-0.4 --exists gegl:matting-levin F: open_wr S: deny P: /dev/dri/renderD128 A: /dev/dri/renderD128 R: /dev/dri/renderD128 C: /usr/bin/gegl-0.4 --exists gegl:matting-levin * -------------------------------------------------------------------------------- Additional info: $ /usr/bin/gegl-0.4 --exists gegl:matting-levin $ echo $? 1 $ equery uses gegl [ Legend : U - final flag setting for installation] [ : I - package is installed with flag ] [ Colors : set, unset ] * Found these USE flags for media-libs/gegl-0.4.14: U I + + cairo : Enable support for the cairo graphics library + + cpu_flags_x86_mmx : Use the MMX instruction set + + cpu_flags_x86_sse : Use the SSE instruction set - - debug : Enable extra debug codepaths, like asserts and extra output. If you want to get meaningful backtraces see https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Backtraces + + ffmpeg : Enable ffmpeg/libav-based audio/video codec support + + introspection : Add support for GObject based introspection + + jpeg2k : Support for JPEG 2000, a wavelet-based image compression format + + lcms : Add lcms support (color management engine) - - lensfun : Enable support for media-libs/lensfun. - - libav : Prefer libav over ffmpeg whenever both are supported - - openexr : Support for the OpenEXR graphics file format + + pdf : Add general support for PDF (Portable Document Format), this replaces the pdflib and cpdflib flags + + raw : Add support for raw image formats + + sdl : Add support for Simple Direct Layer (media library) + + svg : Add support for SVG (Scalable Vector Graphics) - - test : Enable dependencies and/or preparations necessary to run tests (usually controlled by FEATURES=test but can be toggled independently) + + tiff : Add support for the TIFF image format - - umfpack : Enable sparse solving via sci-libs/umfpack. - - v4l : Enable support for video4linux (using linux-headers or userspace libv4l libraries) - - vala : Enable bindings for dev-lang/vala + + webp : Add support for the WebP image format + + zlib : Add support for zlib (de)compression $ equery uses gimp [ Legend : U - final flag setting for installation] [ : I - package is installed with flag ] [ Colors : set, unset ] * Found these USE flags for media-gfx/gimp-2.10.8-r1: U I - - aalib : Add support for media-libs/aalib (ASCII-Graphics Library) + + alsa : Add support for media-libs/alsa-lib (Advanced Linux Sound Architecture) + + cpu_flags_x86_mmx : Use the MMX instruction set + + cpu_flags_x86_sse : Use the SSE instruction set - - debug : Enable extra debug codepaths, like asserts and extra output. If you want to get meaningful backtraces see https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Backtraces - - doc : Add extra documentation (API, Javadoc, etc). It is recommended to enable per package instead of globally + + gnome : Add GNOME support - - heif : Enable support for ISO/IEC 23008-12:2017 HEIF files + + jpeg2k : Support for JPEG 2000, a wavelet-based image compression format + + mng : Add support for libmng (MNG images) - - openexr : Support for the OpenEXR graphics file format - - postscript : Enable support for the PostScript language (often with ghostscript-gpl or libspectre) - - python : Add optional support/bindings for the Python language + + python_targets_python2_7 : Build with Python 2.7 - - test : Enable dependencies and/or preparations necessary to run tests (usually controlled by FEATURES=test but can be toggled independently) + + udev : Enable virtual/udev integration (device discovery, power and storage device support, etc) - - unwind : Add support for call stack unwinding and function name resolution - - vector-icons : Enable support for vector icons (experimental) + + webp : Add support for the WebP image format - - wmf : Add support for the Windows Metafile vector image format - - xpm : Add support for XPM graphics format $ sudo emerge --info Heslo: Portage 2.3.62 (python 3.6.5-final-0, default/linux/amd64/17.0/desktop/gnome/systemd, gcc-8.2.0, glibc-2.28-r6, 4.19.27-gentoo-r1 x86_64) ================================================================= System uname: Linux-4.19.27-gentoo-r1-x86_64-Intel-R-_Core-TM-_i7-3770_CPU_@_3.40GHz-with-gentoo-2.6 KiB Mem: 8129884 total, 1290564 free KiB Swap: 23437308 total, 22797356 free Timestamp of repository gentoo: Wed, 01 May 2019 12:30:01 +0000 Head commit of repository gentoo: bb5a6116c359b47de841fcb6947c9aecf4727be0 Head commit of repository steam-overlay: 0b4567c67abb53ec393d0082ea9467c53bcc9e1b sh bash 4.4_p23-r1 ld GNU ld (Gentoo 2.31.1 p5) 2.31.1 app-shells/bash: 4.4_p23-r1::gentoo dev-java/java-config: 2.2.0-r4::gentoo dev-lang/perl: 5.26.2::gentoo dev-lang/python: 2.7.15::gentoo, 3.6.5::gentoo dev-util/cmake: 3.9.6::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.6-r1::gentoo sys-apps/sandbox: 2.13::gentoo sys-devel/autoconf: 2.13-r1::gentoo, 2.69-r4::gentoo sys-devel/automake: 1.11.6-r3::gentoo, 1.16.1-r1::gentoo sys-devel/binutils: 2.31.1-r4::gentoo sys-devel/gcc: 8.2.0-r6::gentoo sys-devel/gcc-config: 2.0::gentoo sys-devel/libtool: 2.4.6-r3::gentoo sys-devel/make: 4.2.1-r4::gentoo sys-kernel/linux-headers: 4.14-r1::gentoo (virtual/os-headers) sys-libs/glibc: 2.28-r6::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.cz.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-max-age: 24 sync-rsync-verify-jobs: 1 sync-rsync-verify-metamanifest: yes sync-rsync-extra-opts: steam-overlay location: /usr/local/portage/steam-overlay sync-type: git sync-uri: https://github.com/anyc/steam-overlay.git masters: gentoo priority: 50 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=native" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O2 -pipe -march=native" DISTDIR="/usr/portage/distfiles" ENV_UNSET="DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://ftp.fi.muni.cz/pub/linux/gentoo/ rsync://ftp6.linux.cz/pub/linux/gentoo/ rsync://ftp.fi.muni.cz/pub/linux/gentoo/ ftp://ftp.fi.muni.cz/pub/linux/gentoo/ http://gentoo.mirror.dkm.cz/pub/gentoo/ ftp://gentoo.mirror.dkm.cz/pub/gentoo/ rsync://gentoo.mirror.dkm.cz/gentoo/ http://gentoo.mirror.web4u.cz/ ftp://gentoo.mirror.web4u.cz/ ftp://de-mirror.org/gentoo/ http://de-mirror.org/gentoo/ rsync://de-mirror.org/gentoo/ ftp://ftp.wh2.tu-dresden.de/pub/mirrors/gentoo http://gentoo.mneisen.org/ http://mirror.netcologne.de/gentoo/ ftp://mirror.netcologne.de/gentoo/ rsync://mirror.netcologne.de/gentoo/ rsync://mirror.opteamax.de/gentoo/ http://mirror.opteamax.de/gentoo/ http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror/ ftp://ftp.halifax.rwth-aachen.de/gentoo/ http://ftp.halifax.rwth-aachen.de/gentoo/ rsync://ftp.halifax.rwth-aachen.de/gentoo/ ftp://sunsite.informatik.rwth-aachen.de/pub/Linux/gentoo ftp://ftp.spline.inf.fu-berlin.de/mirrors/gentoo/ http://ftp.spline.inf.fu-berlin.de/mirrors/gentoo/ ftp://ftp.tu-clausthal.de/pub/linux/gentoo/ ftp://ftp.uni-erlangen.de/pub/mirrors/gentoo http://ftp.uni-erlangen.de/pub/mirrors/gentoo rsync://gentoo.prz.rzeszow.pl/gentoo http://gentoo.prz.rzeszow.pl http://gentoo.po.opole.pl ftp://gentoo.po.opole.pl rsync://ftp.vectranet.pl/gentoo/ http://ftp.vectranet.pl/gentoo/ ftp://ftp.vectranet.pl/gentoo/ http://gentoo.mirror.pw.edu.pl/ http://tux.rainside.sk/gentoo/ ftp://tux.rainside.sk/gentoo/ http://gentoo.wheel.sk/ ftp://gentoo.wheel.sk/pub/linux/gentoo/" LANG="cs_CZ.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LINGUAS="cs_CZ cs en" MAKEOPTS="-j9" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/tmp" USE="X a52 aac acl acpi alsa amd64 berkdb branding bzip2 cairo cdda cli colord crypt cxx dbus dri dri3 dts dvd dvdr eds emboss encode evo exif fam ffmpeg flac fontconfig gdbm gif glamor gnome gnome-keyring gnome-online-accounts gpm gstreamer gtk gtk3 gudev http2 iconv imagemagick introspection jabber jemalloc jpeg jpeg2k lcms ldap libnotify libsecret libtirpc llvm mad matroska mmap mms mng mp3 mp4 mpeg multilib musicbrainz nautilus ncurses networkmanager nls nptl ogg openal opencl opengl openmp pam pango pcre pdf png policykit ppds pulseaudio qt5 readline sdl seccomp sound spell ssl startup-notification svg systemd tcpd threads tiff tracker truetype udev udisks unicode upower usb vaapi vorbis webp wxwidgets x264 xattr xcb xft xinerama xml xmpp xscreensaver xv xvid zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc emu" INPUT_DEVICES="evdev synaptics mouse keyboard" KERNEL="linux" L10N="en cs" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" NETBEANS_MODULES="apisupport cnd groovy gsf harness ide identity j2ee java mobility nb php profiler soa visualweb webcommon websvccommon xml" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-6 php7-1" POSTGRES_TARGETS="postgres9_5 postgres10" PYTHON_SINGLE_TARGET="python3_6" PYTHON_TARGETS="python2_7 python3_6" RUBY_TARGETS="ruby24" USERLAND="GNU" VIDEO_CARDS="intel i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Hi! Is this using the unmodified ebuild from Gentoo? I'm asking because ebuilds already whitelist /dev/dri/ for writing as a fix to bug #574038: # fgrep /dev/dri *.ebuild | sort -V gimp-2.9.8-r1.ebuild: addwrite /dev/dri/ # bug #574038 gimp-2.10.2.ebuild: addwrite /dev/dri/ # bug #574038 gimp-2.10.4.ebuild: addwrite /dev/dri/ # bug #574038 gimp-2.10.6-r1.ebuild: addwrite /dev/dri/ # bug #574038 gimp-2.10.8-r1.ebuild: addwrite /dev/dri/ # bug #574038 gimp-2.10.10.ebuild: addwrite /dev/dri/ # bug #574038 gimp-9999.ebuild: addwrite /dev/dri/ # bug #574038 Inside the sandbox, this is how I verified that /dev/dri/ should do the trick: $ touch /dev/dri/renderD128 ; echo $? * ACCESS DENIED: open_wr: /dev/dri/renderD128 * ACCESS DENIED: utimensat: /dev/dri/renderD128 touch: cannot touch '/dev/dri/renderD128': Permission denied 1 $ export SANDBOX_WRITE="${SANDBOX_WRITE}:/dev/dri/" $ touch /dev/dri/renderD128 ; echo $? 0 The failing call is "open_wr" as in your cases. add_write then extends SANDBOX_WRITE (in ebuild.sh). I'm a bit clueless right now why you would still run into this situation. Any ideas?
(In reply to Sebastian Pipping from comment #1) > Hi! > > Is this using the unmodified ebuild from Gentoo? I'm asking because ebuilds > already whitelist /dev/dri/ for writing as a fix to bug #574038: > > # fgrep /dev/dri *.ebuild | sort -V > gimp-2.9.8-r1.ebuild: addwrite /dev/dri/ # bug #574038 > gimp-2.10.2.ebuild: addwrite /dev/dri/ # bug #574038 > gimp-2.10.4.ebuild: addwrite /dev/dri/ # bug #574038 > gimp-2.10.6-r1.ebuild: addwrite /dev/dri/ # bug #574038 > gimp-2.10.8-r1.ebuild: addwrite /dev/dri/ # bug #574038 > gimp-2.10.10.ebuild: addwrite /dev/dri/ # bug #574038 > gimp-9999.ebuild: addwrite /dev/dri/ # bug #574038 > > Inside the sandbox, this is how I verified that /dev/dri/ should do the > trick: > > $ touch /dev/dri/renderD128 ; echo $? > * ACCESS DENIED: open_wr: /dev/dri/renderD128 > * ACCESS DENIED: utimensat: /dev/dri/renderD128 > touch: cannot touch '/dev/dri/renderD128': Permission denied > 1 > > $ export SANDBOX_WRITE="${SANDBOX_WRITE}:/dev/dri/" > > $ touch /dev/dri/renderD128 ; echo $? > 0 > > The failing call is "open_wr" as in your cases. add_write then > extends SANDBOX_WRITE (in ebuild.sh). I'm a bit clueless right now > why you would still run into this situation. Any ideas? I do not know how to enter sandbox, but your command returned this: $ fgrep /dev/dri *.ebuild | sort -V /bin/grep: *.ebuild: No such file or directory I do not use any custom ebuilds.
$ tree /dev/dri/ /dev/dri/ ├── by-path │ ├── pci-0000:00:02.0-card -> ../card0 │ └── pci-0000:00:02.0-render -> ../renderD128 ├── card0 └── renderD128
(In reply to Michal Špondr from comment #2) > I do not know how to enter sandbox The sandbox is /usr/bin/sandbox but I only used it for demonstration, you don't need to run it on your side. > I do not use any custom ebuilds. Okay. I only notice now: The sandbox violation you get is from the "configure" stage of the ebuild while the sandbox is adjusted later, in stage "compile", i.e. too late. Let me fix that, I'll push 2.10.10-r1 with a proposed fix in a minute. Please report back if that makes things work for you. @pacho I have a feeling we might want to copy that fix over to 2.10.8-r1 for stabilization if it proves working. What do you think?
Created attachment 574916 [details, diff] Proposed git commit (from `git format-patch -1`) It seems like the server does not allow me to push right now :( Attached you find what I was about to push. Maybe another Gentoo dev can `git-am` it while I try to get SSH push access back to function (..).
PS: I should mention that sandbox variable SANDBOX_WRITE is carried over (and sorted) from src_compile to src_configure. Hence I chose to not call _adjust_sandbox in src_compile once again...
(In reply to Sebastian Pipping from comment #4) [...] > @pacho I have a feeling we might want to copy that fix over to 2.10.8-r1 for > stabilization if it proves working. What do you think? Sure, I would apply it to 2.10.8-r1.ebuild too Are you still having issues to commit?
(In reply to Pacho Ramos from comment #7) > Sure, I would apply it to 2.10.8-r1.ebuild too Okay cool > Are you still having issues to commit? Still cannot push again, no, sorry
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f2016a230d28bbc09d40116343742544c19ecc91 commit f2016a230d28bbc09d40116343742544c19ecc91 Author: Pacho Ramos <pacho@gentoo.org> AuthorDate: 2019-05-06 10:59:05 +0000 Commit: Pacho Ramos <pacho@gentoo.org> CommitDate: 2019-05-06 11:04:55 +0000 media-gfx/gimp: Apply sandbox fixes to stable ebuild too Closes: https://bugs.gentoo.org/684886 Package-Manager: Portage-2.3.64, Repoman-2.3.12 Signed-off-by: Pacho Ramos <pacho@gentoo.org> media-gfx/gimp/gimp-2.10.8-r1.ebuild | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) Additionally, it has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=04f33a597c41dbb22b483fcbff1d9a2b2cfefb95 commit 04f33a597c41dbb22b483fcbff1d9a2b2cfefb95 Author: Sebastian Pipping <sping@gentoo.org> AuthorDate: 2019-05-01 22:00:41 +0000 Commit: Pacho Ramos <pacho@gentoo.org> CommitDate: 2019-05-06 11:04:04 +0000 media-gfx/gimp: Move sandbox fixes from src_compile to src_configure The configure script is accessing graphics hardware already. Bug: https://bugs.gentoo.org/684886 Signed-off-by: Pacho Ramos <pacho@gentoo.org> Package-Manager: Portage-2.3.65, Repoman-2.3.12 media-gfx/gimp/gimp-2.10.10-r1.ebuild | 222 ++++++++++++++++++++++++++++++++++ media-gfx/gimp/gimp-9999.ebuild | 27 +++-- 2 files changed, 238 insertions(+), 11 deletions(-)
(In reply to Pacho Ramos from comment #7) > Are you still having issues to commit? Pushing now works again, thanks for taking over!
