Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 908746 - sys-apps/sandbox-2.31: sandbox is denying all requests
Summary: sys-apps/sandbox-2.31: sandbox is denying all requests
Status: RESOLVED WORKSFORME
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: AMD64 Linux
: Normal normal
Assignee: Sandbox Maintainers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-18 06:00 UTC by Alan Grimes
Modified: 2023-06-22 21:54 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
output from emerge --info (emerge-info,6.14 KB, text/plain)
2023-06-18 08:14 UTC, tt_1
Details
sandbox.conf (sandbox.conf,3.20 KB, text/plain)
2023-06-19 17:34 UTC, Alan Grimes
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alan Grimes 2023-06-18 06:00:08 UTC
Sandbox was denying writes to /dev/null so this __MUST__ be a bug irrespective of any other factor.

Machine cannot be updated at this point as all builds pass through sandbox. 

(also machine forgot what a dvorak was so i'm having to type qwerty which I haven't had to use since the 20th century...) 


I was trying to update my system to clear another critical issue (system updated within last week). Updating quickly started to trigger these: 

 * Messages for package dev-python/pypy-7.3.12:

 * The ebuild phase 'unpack' has exited unexpectedly. This type of behavior
 * is known to be triggered by things such as failed variable assignments
 * (bug #190128) or bad substitution errors (bug #200313). Normally, before
 * exiting, bash should have displayed an error message above. If bash did
 * not produce an error message above, it's possible that the ebuild has
 * called `exit` when it should have called `die` instead. This behavior
 * may also be triggered by a corrupt bash binary or a hardware problem
 * such as memory or cpu malfunction. If the problem is not reproducible or
 * it appears to occur randomly, then it is likely to be triggered by a
 * hardware problem. If you suspect a hardware problem then you should try
 * some basic hardware diagnostics such as memtest. Please do not report
 * this as a bug unless it is consistently reproducible and you are sure
 * that your bash binary and hardware are functioning properly.
 * 
 * The following 2 packages have failed to build, install, or execute
 * postinst:
 * 
 *  (dev-python/pypy3_10-exe-7.3.12:7.3.12/7.3.12::gentoo, ebuild scheduled for merge), Log file:
 *   '/var/tmp/portage/dev-python/pypy3_10-exe-7.3.12/temp/build.log'
 *  (dev-python/pypy-7.3.12:0/73::gentoo, ebuild scheduled for merge), Log file:
 *   '/var/tmp/portage/dev-python/pypy-7.3.12/temp/build.log'
 * 

Looking deeper (similar package, all same) 

tortoise /var/tmp/portage/dev-libs/libevent-2.1.12-r1/temp # cat sandbox.log 
VERSION 1.0
FORMAT: F - Function called
FORMAT: S - Access Status
FORMAT: P - Path as passed to function
FORMAT: A - Absolute Path (not canonical)
FORMAT: R - Canonical Path
FORMAT: C - Command Line

F: open_wr
S: deny
P: /dev/null
A: /dev/null
R: /dev/null
C: bash /var/tmp/portage/._portage_reinstall_.v1qi_ff4/bin/ebuild.sh unpack 

F: open_wr
S: deny
P: /dev/null
A: /dev/null
R: /dev/null
C: bash /var/tmp/portage/._portage_reinstall_.v1qi_ff4/bin/ebuild.sh unpack 

F: open_wr
S: deny
P: /dev/null
A: /dev/null
R: /dev/null
C: bash /var/tmp/portage/._portage_reinstall_.v1qi_ff4/bin/ebuild.sh unpack 
 
etc etc....





tortoise /var/tmp/portage/dev-libs/libevent-2.1.12-r1/temp # sandbox --version
Gentoo path sandbox
 version: 2.31
 C lib:   libc.so.6 (/lib64/libc.so.6)
 build:   Jun 15 2023 15:44:02
 contact: sandbox@gentoo.org via https://bugs.gentoo.org/
 rtld:    next is OK! :D
 schizo:  x86_64:-m64 x86:-m32

configured with these options:
--prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --disable-dependency-tracking --disable-silent-rules --docdir=/usr/share/doc/sandbox-2.31 --htmldir=/usr/share/doc/sandbox-2.31/html --with-sysroot=/ --libdir=/usr/lib64 build_alias=x86_64-pc-linux-gnu host_alias=x86_64-pc-linux-gnu 'CFLAGS=-march=native -pipe -O3' 'LDFLAGS=-Wl,-O1 -Wl,--as-needed' CPPFLAGS=
tortoise /var/tmp/portage/dev-libs/libevent-2.1.12-r1/temp #
Comment 1 Ionen Wolkens gentoo-dev 2023-06-18 06:13:11 UTC
Is your /etc/sandbox.conf still there and looking normal? It's what grants access to /dev/null

aka should have:

    # Common device nodes
    SANDBOX_WRITE="/dev/zero:/dev/null:/dev/full"

If you're also having other problems, I imagine something is broken on your system (lost configs, corruption, etc...)
Comment 2 Ionen Wolkens gentoo-dev 2023-06-18 06:18:39 UTC
May also want to verify permissions, perhaps things are failing to open configuration files or leading directories.

# namei -mo /etc/sandbox.conf 
f: /etc/sandbox.conf
 drwxr-xr-x root root /
 drwxr-xr-x root root etc
 -rw-r--r-- root root sandbox.conf
Comment 3 tt_1 2023-06-18 08:13:02 UTC Comment hidden (obsolete)
Comment 4 tt_1 2023-06-18 08:14:23 UTC Comment hidden (obsolete)
Comment 5 tt_1 2023-06-18 10:53:06 UTC Comment hidden (obsolete)
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-06-18 15:01:39 UTC
(In reply to tt_1 from comment #5)
> this is my error, when trying to emerge anything with the new

This is almost certainly unrelated (bug 908765).
Comment 7 Mike Gilbert gentoo-dev 2023-06-18 18:14:51 UTC
Please check your sandbox config files per comment 1 and report back.
Comment 8 Alan Grimes 2023-06-19 17:34:35 UTC
Created attachment 864224 [details]
sandbox.conf

I don't think I've ever even looked at this file before this...
Comment 9 Mike Gilbert gentoo-dev 2023-06-19 21:16:48 UTC
That config looks normal. How about the permissions on /etc and /etc/sandbox.conf?
Comment 10 Alan Grimes 2023-06-19 23:22:19 UTC
(In reply to Mike Gilbert from comment #9)
> That config looks normal. How about the permissions on /etc and
> /etc/sandbox.conf?

should be golden, all can read. No issues reading form user account without any escelation. (iirc emerge uses user PORTAGE while building...)
Comment 11 Mike Gilbert gentoo-dev 2023-06-20 01:07:11 UTC
You might try reinstalling sys-apps/sandbox using the following command:

FEATURES="-usersandbox -sandbox" emerge --oneshot sys-apps/sandbox

If that does not resolve the issue, I really have no idea what is wrong with your system.
Comment 12 Mike Gilbert gentoo-dev 2023-06-21 17:35:41 UTC
I'm unable to reproduce the issue, and it seems like you have bigger issues going on with your system. Closing as WORKSFORME.
Comment 13 Larry the Git Cow gentoo-dev 2023-06-22 06:11:14 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=161b4e469a0ef4ff533091bf8c820e0371f61f19

commit 161b4e469a0ef4ff533091bf8c820e0371f61f19
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-06-22 06:07:07 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-06-22 06:10:39 +0000

    dev-libs/openssl: use preserve-libs.eclass
    
    coreutils[openssl] will make e.g. sort use openssl for acceleration. For
    users with FEATURES="-preserve-libs" (non-default, pretty rare), we need to
    use preserve-libs.eclass to force preservation as it'll result in a bricked
    system otherwise.
    
    Reported on the forums at https://forums.gentoo.org/viewtopic-t-1163916.html too.
    
    If you've hit this:
    * you'll likely need to use a rescue environment to install a binary package
      of coreutils built without openssl, or downgrade openssl instead.
    
      See https://wiki.gentoo.org/wiki/Fix_my_Gentoo.
    
    * you may want to (although it's not required) set FEATURES="preserved-libs"
      in make.conf.
    
    Bug: https://bugs.gentoo.org/908746
    Bug: https://bugs.gentoo.org/908849
    Fixes: 842c8893492294933fc5527af41c3c9ab16d0efd
    Signed-off-by: Sam James <sam@gentoo.org>

 .../openssl/{openssl-3.0.9.ebuild => openssl-3.0.9-r1.ebuild}    | 9 ++++++++-
 .../openssl/{openssl-3.1.1.ebuild => openssl-3.1.1-r1.ebuild}    | 9 ++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)
Comment 14 Alan Grimes 2023-06-22 21:54:51 UTC
ADDENDUM: cannot emerge anything because it requires libcrypto 3, which is not in the current stage 3 archive that I colud use to bootstrap myself back into fully functional. 

install ./include/openssl/x509v3.h -> /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/include/openssl/x509v3.h
install libcrypto.a -> /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/libcrypto.a
install libssl.a -> /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/libssl.a
link /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/libcrypto.so -> /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/libcrypto.so.3
link /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/libssl.so -> /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/libssl.so.3
created directory `/var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/pkgconfig'
install libcrypto.pc -> /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/pkgconfig/libcrypto.pc
install libssl.pc -> /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/pkgconfig/libssl.pc
install openssl.pc -> /var/tmp/portage/dev-libs/openssl-3.0.9-r1/image/usr/lib/pkgconfig/openssl.pc
sort: error while loading shared libraries: libcrypto.so.3: cannot open shared object file: No such file or directory
cksum: error while loading shared libraries: libcrypto.so.3: cannot open shared object file: No such file or directory
 * ERROR: dev-libs/openssl-3.0.9-r1::gentoo failed (install phase):
 *   (no error message)
 * 
 * Call stack:
 *     ebuild.sh, line  136:  Called src_install
 *   environment, line 2811:  Called multilib-minimal_src_install
 *   environment, line 2006:  Called multilib_foreach_abi 'multilib-minimal_abi_src_install'
 *   environment, line 2236:  Called multibuild_foreach_variant '_multilib_multibuild_wrapper' 'multilib-minimal_abi_src_install'
 *   environment, line 1918:  Called _multibuild_run '_multilib_multibuild_wrapper' 'multilib-minimal_abi_src_install'
 *   environment, line 1916:  Called _multilib_multibuild_wrapper 'multilib-minimal_abi_src_install'
 *   environment, line  457:  Called multilib-minimal_abi_src_install
 *   environment, line 2003:  Called multilib_check_headers
 *   environment, line 2041:  Called die
 * The specific snippet of code:
 *       cksum=$(_multilib_header_cksum) || die;