Bug 498232 – Merging various python packages fails with sandbox violation in /usr/local/

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Hanno Böck 2014-01-16 09:13:41 UTC]

Created attachment 367940 [details]
notmuch compile log

I'm currently upgrading a system, various python packages fail with access violation errors in /usr/local/. The system has some local python scripts installed in /usr/local (but that obviously shouldn't break things).

Affected packages are e.g. (all I found up until now distutils-r1 eclass):
net-mail/notmuch-0.16-r1,
sys-apps:file-5.15

I'll attach build logs. This might be related to the python 3.3 upgrade, but I'm not sure about that (last upgrade was before the python 3.3 stabilization).

Arfrever in #gentoo-python suggested that an addpredict for /usr/local might be missing in the distutils-r1 eclass.

emerge --info:
Portage 2.2.7 (hardened/linux/amd64/no-multilib, gcc-4.7.3, glibc-2.17, 3.11.3-grsec x86_64)
=================================================================
System uname: Linux-3.11.3-grsec-x86_64-Intel-R-_Core-TM-2_Duo_CPU_T7700_@_2.40GHz-with-gentoo-2.2
KiB Mem:     1024060 total,    164612 free
KiB Swap:    2097148 total,   1674520 free
Timestamp of tree: Thu, 16 Jan 2014 00:45:01 +0000
ld GNU ld (GNU Binutils) 2.23.1
ccache version 3.1.9 [enabled]
app-shells/bash:          4.2_p45
dev-lang/python:          2.7.5-r3, 3.2.5-r3, 3.3.2-r2
dev-util/ccache:          3.1.9-r3
dev-util/cmake:           2.8.11.2
dev-util/pkgconfig:       0.28
sys-apps/baselayout:      2.2
sys-apps/openrc:          0.12.4
sys-apps/sandbox:         2.6-r1
sys-devel/autoconf:       2.69
sys-devel/automake:       1.11.6, 1.12.6, 1.13.4
sys-devel/binutils:       2.23.1
sys-devel/gcc:            4.7.3-r1
sys-devel/gcc-config:     1.7.3
sys-devel/libtool:        2.4.2
sys-devel/make:           3.82-r4
sys-kernel/linux-headers: 3.9 (virtual/os-headers)
sys-libs/glibc:           2.17
Repositories: gentoo keks
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="@FREE"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -march=core2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt /var/bind /var/spool/munin-async/.ssh"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.3/ext-active/ /etc/php/apache2-php5.4/ext-active/ /etc/php/apache2-php5.5/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cgi-php5.4/ext-active/ /etc/php/cgi-php5.5/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/php/cli-php5.4/ext-active/ /etc/php/cli-php5.5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -march=core2 -pipe"
DISTDIR="/usr/portage/distfiles"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs ccache config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync multilib-strict news parallel-fetch preserve-libs protect-owned sandbox sfperms strict suidctl unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://gentoo.mneisen.org/"
LANG="de_DE.UTF-8"
LC_ALL="de_DE.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j1"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/overlays/keks"
SYNC="rsync://rsync7.de.gentoo.org/gentoo-portage"
USE="7zip acl amd64 apache2 bash-completion bzip2 calendar cgi city cli cracklib crypt ctype curl cxx dri exif fam fastcgi filter fontconfig force-cgi-redirect ftp gd geoip gif glibc-omitfp gmp gpg gpgme hardened hash httpbind iconv idn imagemagick imap intl iproute2 ipv6 irc jpeg json justify leim logrotate mailwrapper managesieve mhash mmap mmx mod_irc mod_muc mod_proxy65 mod_pubsub modules muc mudflap mutt mysql mysqli ncurses nls nptl ocamlopt openmp openssl otr pam pax_kernel pcre pdf pdo perl php pic png pop proxy pubsub python qdbm readline reflection ruby s3 sasl sensord session sidebar sieve silvercity simplexml slang smime smtp soap spell spl sqlite sqlite3 sse sse2 ssl static-modules subversion suexec suhosin svg tiff tokenizer tools truetype unicode urandom web xattr xml xmlrpc xsl xtended zip zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_file authn_anon authn_default authz_host authz_groupfile authz_user authz_owner authz_default auth_basic auth_digest cache include deflate log_config logio env mime_magic unique_id setenvif mime dav status autoindex info suexec cgi dav dav_fs dav_lock vhost_alias negotiation dir actions alias rewrite so charset_lite filter headers expires reqtimeout authn_core authz_core cache_disk unixd socache_shmcb access_compat proxy proxy_http ext_filter" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="de en" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-3 php5-4 php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3" RUBY_TARGETS="ruby19 ruby18" USERLAND="GNU" VIDEO_CARDS="fbdev glint intel mach64 mga nouveau nv r128 radeon savage sis tdfx trident vesa via vmware dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON

[Comment 1 Hanno Böck 2014-01-16 09:13:53 UTC]

Created attachment 367942 [details]
file compile log

[Comment 2 Mike Gilbert 2014-01-16 15:36:05 UTC]

Arfrever also indicated that this occurs because we are re-enabling bytecode generation in distutils-r1_python_install by setting PYTHONDONTWRITEBYTECODE to the empty string.

[Comment 3 Mike Gilbert 2014-01-18 15:09:38 UTC]

+  18 Jan 2014; Mike Gilbert <[e-mail]> distutils-r1.eclass:
+  Silence sandbox for /usr/local, bug 498232.

Moving forward, I think we will need to evaluate these on a case-by-case basis. This may pop up again if users have set PYTHONPATH in their environment; I'm not sure if we do anything to clear that in the ebuild environment.