Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 949958 - sys-apps/sandbox-2.43: does not allow to write to /proc/<pid>/clear_refs
Summary: sys-apps/sandbox-2.43: does not allow to write to /proc/<pid>/clear_refs
Status: RESOLVED OBSOLETE
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Sandbox Maintainers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-02-19 06:55 UTC by Andrey Grozin
Modified: 2025-03-23 11:46 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andrey Grozin gentoo-dev 2025-02-19 06:55:21 UTC
I'm trying to bump media-gfx/asymptote to 3.00. This version bundles a modified source of dev-libs/boehm-gc-8.2.8. When building asymptote-3.00/gc I get sandbox violations like

F: open_wr
S: deny
P: /proc/4643/clear_refs
A: /proc/4643/clear_refs
R: /proc/4643/clear_refs
C: ./cordtest

for the programs cordtest, gctest, staticrootstest, disclaim_test, disclaim_weakmap_test. I can successfully run these test programs by hand, and, indeed, they write to /proc/<pid>/clear_refs:

# strace -e trace=file ./cordtest
...
openat(AT_FDCWD, "/proc/3702/clear_refs", O_WRONLY) = 3
...
+++ exited with 0 +++

It is absolutely legal for the owner of a process to write to /proc/<pid>/clear_refs. Why does sandbox forbids it?

I've tried to add

addwrite /proc

at the beginning of src_compile. Result: all these tests programs run without sandbox errors, and after that the build hangs. No messages, the load level 0, emerge is running forever. So, this simple solution does not work.
Comment 1 Mike Gilbert gentoo-dev 2025-02-20 01:51:00 UTC
So there seems to be two separate issues here:

1. You want to allow write access to /proc/PID/clear_refs by default.

2. Even when write access is allowed, something is hanging your process.

For the second issue, does it work with FEATURES="-usersandbox -sandbox"?
Comment 2 Andrey Grozin gentoo-dev 2025-02-20 11:36:28 UTC
(In reply to Mike Gilbert from comment #1)
> So there seems to be two separate issues here:
> 
> 1. You want to allow write access to /proc/PID/clear_refs by default.
> 
> 2. Even when write access is allowed, something is hanging your process.
> 
> For the second issue, does it work with FEATURES="-usersandbox -sandbox"?
Yes. emerge succeeds, the resulting asymptote works. With USE=doc, the manual is successfully generated (this process includes running >80 asy scripts, many of them are highly non-trivial)
Comment 3 Mike Gilbert gentoo-dev 2025-02-20 16:13:47 UTC
Ok, please file a separate bug for the hanging process issue and include more details.
Comment 4 Andrey Grozin gentoo-dev 2025-03-23 11:46:59 UTC
Running these boehm-gc test programs is absolutely unnecessary for building asymptote. I've patched it out of the relevant Makefile.in. So, my immediate problem is solved.