Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 675478 - =sys-apps/man-db-2.8.5 causes sandbox violation in mkstemp /var/cache/man/cat2/catXXXXXX (and others)
Summary: =sys-apps/man-db-2.8.5 causes sandbox violation in mkstemp /var/cache/man/cat...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
: 675272 676252 678352 678726 679750 681810 681910 683782 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-01-15 11:03 UTC by Reuben Farrelly
Modified: 2019-04-19 08:52 UTC (History)
17 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
app-editors/vim full build log (app-editors-vim-build-log.txt,18.38 KB, text/plain)
2019-01-15 11:55 UTC, Reuben Farrelly
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Reuben Farrelly 2019-01-15 11:03:08 UTC
Running an up-to-date amd64 17.1 system; I've seen in the last few days on multiple systems, that Vim fails to build.  It fails configure with:

config.status: creating auto/config.h
>>> Source configured.
 * --------------------------- ACCESS VIOLATION SUMMARY ---------------------------
 * LOG FILE: "/var/log/sandbox/sandbox-14743.log"
 * 
VERSION 1.0
FORMAT: F - Function called
FORMAT: S - Access Status
FORMAT: P - Path as passed to function
FORMAT: A - Absolute Path (not canonical)
FORMAT: R - Canonical Path
FORMAT: C - Command Line

F: mkstemp
S: deny
P: /var/cache/man/cat2/catXXXXXX
A: /var/cache/man/cat2/catXXXXXX
R: /var/cache/man/cat2/catXXXXXX
C: man -s 2 read 
 * --------------------------------------------------------------------------------

All versions in portage fail in the same way and at the same place.  This package has built successfully until recently so I suspect a change to some other system has triggered this issue.  Possibly the portage/sandbox packages?


The full output of the emerge:

thunderstorm ~ # emerge --ask --verbose vim

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] app-editors/vim-8.1.0648::gentoo  USE="acl nls -X -cscope -debug -gpm -lua -luajit -minimal -perl -python -racket -ruby (-selinux) -tcl -terminal -vim-pager" PYTHON_SINGLE_TARGET="python3_7* -python2_7 -python3_4 -python3_5 -python3_6*" PYTHON_TARGETS="python2_7 python3_7 -python3_4 -python3_5 -python3_6*" 0 KiB

Total: 1 package (1 reinstall), Size of downloads: 0 KiB

Would you like to merge these packages? [Yes/No] 

>>> Verifying ebuild manifests

>>> Emerging (1 of 1) app-editors/vim-8.1.0648::gentoo
 * vim-8.1.0648.tar.gz BLAKE2B SHA512 size ;-) ...                       [ ok ]
 * vim-8.0.0938-gentoo-patches.tar.bz2 BLAKE2B SHA512 size ;-) ...       [ ok ]
>>> Unpacking source...
>>> Unpacking vim-8.1.0648.tar.gz to /var/tmp/portage/app-editors/vim-8.1.0648/work
>>> Unpacking vim-8.0.0938-gentoo-patches.tar.bz2 to /var/tmp/portage/app-editors/vim-8.1.0648/work
>>> Source unpacked in /var/tmp/portage/app-editors/vim-8.1.0648/work
>>> Preparing source in /var/tmp/portage/app-editors/vim-8.1.0648/work/vim-8.1.0648 ...
 * Applying patches from /var/tmp/portage/app-editors/vim-8.1.0648/work/patches/ ...
 *   001_all_vim-6.3-xorg-75816.patch ...                                [ ok ]
 *   002_all_vim-7.3-apache-83565.patch ...                              [ ok ]
 *   003_all_vim-7.0-automake-substitutions-93378.patch ...              [ ok ]
 *   004_all_vim-7.0-grub-splash-96155.patch ...                         [ ok ]
 *   005_all_vim_7.1-ada-default-compiler.patch ...                      [ ok ]
 *   006-vim-8.0.0617-crosscompile.patch ...                             [ ok ]
'/var/tmp/portage/app-editors/vim-8.1.0648/work/vim-8.1.0648/src/config.mk.dist' -> '/var/tmp/portage/app-editors/vim-8.1.0648/work/vim-8.1.0648/src/auto/config.mk'
>>> Source prepared.
>>> Configuring source in /var/tmp/portage/app-editors/vim-8.1.0648/work/vim-8.1.0648 ...
make -j4 -j1 -C src autoconf 
make: Entering directory '/var/tmp/portage/app-editors/vim-8.1.0648/work/vim-8.1.0648/src'
if test ! -f configure.save; then mv configure configure.save; fi
autoconf
sed -e 's+>config.log+>auto/config.log+' -e 's+\./config.log+auto/config.log+' configure > auto/configure
chmod 755 auto/configure
mv -f configure.save configure
rm -rf autom4te.cache
rm -f auto/config.status auto/config.cache
make: Leaving directory '/var/tmp/portage/app-editors/vim-8.1.0648/work/vim-8.1.0648/src'
./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --docdir=/usr/share/doc/vim-8.1.0648 --htmldir=/usr/share/doc/vim-8.1.0648/html --libdir=/usr/lib64 --with-modified-by=Gentoo-8.1.0648 --with-features=huge --enable-multibyte --enable-acl --disable-cscope --disable-gpm --disable-luainterp --without-luajit --enable-nls --disable-perlinterp --disable-pythoninterp --disable-python3interp --disable-mzschemeinterp --disable-rubyinterp --disable-selinux --disable-tclinterp --disable-terminal --enable-gui=no --disable-darwin --without-x
configure: creating cache auto/config.cache
checking whether make sets $(MAKE)... yes
checking for x86_64-pc-linux-gnu-gcc... x86_64-pc-linux-gnu-gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
..
..
checking size of int... 4
checking size of long... 8
checking size of time_t... 8
checking size of off_t... 8
checking uint32_t is 32 bits... ok
checking whether memmove handles overlaps... yes
checking for _xpg4_setrunelocale in -lxpg4... no
checking how to create tags... exuberant-ctags -I INIT+ --fields=+S
checking how to run man with a section nr...  * ACCESS DENIED:  mkstemp:      /var/cache/man/cat2/catXXXXXX
man -s
checking --disable-nls argument... no
checking for msgfmt... msgfmt
checking for NLS... gettext() works
checking for bind_textdomain_codeset... yes
checking for _nl_msg_cat_cntr... yes
checking dlfcn.h usability... yes
checking dlfcn.h presence... yes
checking for dlfcn.h... yes
checking for dlopen()... no
checking for dlopen() in -ldl... yes
checking for dlsym()... yes
checking setjmp.h usability... yes
checking setjmp.h presence... yes
checking for setjmp.h... yes
checking for GCC 3 or later... yes
checking whether we need -D_FORTIFY_SOURCE=1... yes
checking whether we need to force -D_FILE_OFFSET_BITS=64... no
checking linker --as-needed support... yes
configure: updating cache auto/config.cache
configure: creating auto/config.status
config.status: creating auto/config.mk
config.status: creating auto/config.h
>>> Source configured.
 * --------------------------- ACCESS VIOLATION SUMMARY ---------------------------
 * LOG FILE: "/var/log/sandbox/sandbox-14743.log"
 * 
VERSION 1.0
FORMAT: F - Function called
FORMAT: S - Access Status
FORMAT: P - Path as passed to function
FORMAT: A - Absolute Path (not canonical)
FORMAT: R - Canonical Path
FORMAT: C - Command Line

F: mkstemp
S: deny
P: /var/cache/man/cat2/catXXXXXX
A: /var/cache/man/cat2/catXXXXXX
R: /var/cache/man/cat2/catXXXXXX
C: man -s 2 read 
 * --------------------------------------------------------------------------------

>>> Failed to emerge app-editors/vim-8.1.0648, Log file:

>>>  '/var/tmp/portage/app-editors/vim-8.1.0648/temp/build.log'
thunderstorm ~ # 

emerge --info:

thunderstorm ~ # emerge --info
Portage 2.3.56 (python 3.7.0-final-0, default/linux/amd64/17.1/no-multilib, gcc-8.2.0, glibc-2.28-r5, 4.20.2-gentoo x86_64)
=================================================================
System uname: Linux-4.20.2-gentoo-x86_64-Intel-R-_Xeon-R-_CPU_E5-2680_v2_@_2.80GHz-with-gentoo-2.6
KiB Mem:     8180792 total,   1166400 free
KiB Swap:    2096104 total,   2096104 free
Head commit of repository gentoo: 4c7debeccab9d1ea546ffbd6cbb9ff352aba8f63

sh bash 5.0
ld GNU ld (Gentoo 2.31.1 p5) 2.31.1
app-shells/bash:          5.0::gentoo
dev-lang/perl:            5.28.0::gentoo
dev-lang/python:          2.7.15::gentoo, 3.7.0::gentoo
dev-util/cmake:           3.13.3::gentoo
dev-util/pkgconfig:       0.29.2::gentoo
sys-apps/baselayout:      2.6-r1::gentoo
sys-apps/openrc:          0.40.3::gentoo
sys-apps/sandbox:         2.15::gentoo
sys-devel/autoconf:       2.69-r4::gentoo
sys-devel/automake:       1.13.4-r2::gentoo, 1.16.1-r1::gentoo
sys-devel/binutils:       2.31.1-r3::gentoo
sys-devel/gcc:            8.2.0-r6::gentoo
sys-devel/gcc-config:     2.0::gentoo
sys-devel/libtool:        2.4.6-r5::gentoo
sys-devel/make:           4.2.1-r4::gentoo
sys-kernel/linux-headers: 4.20::gentoo (virtual/os-headers)
sys-libs/glibc:           2.28-r5::gentoo
Repositories:

gentoo
    location: /usr/portage
    sync-type: git
    sync-uri: git://anongit.gentoo.org/repo/gentoo.git
    priority: -1000

reub-Local-Overlay
    location: /usr/local/portage
    masters: gentoo

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="* -@EULA"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=native -mtune=native"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt /var/bind /var/rancid/.cloginrc"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php7.2/ext-active/ /etc/php/apache2-php7.3/ext-active/ /etc/php/cgi-php7.2/ext-active/ /etc/php/cgi-php7.3/ext-active/ /etc/php/cli-php7.2/ext-active/ /etc/php/cli-php7.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-O2 -pipe -march=native -mtune=native"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--autounmask=n --quiet-build=n --with-bdeps=y"
ENV_UNSET="DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync metadata-transfer multilib-strict network-sandbox news parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://mirror.ipv6.internode.on.net/pub/gentoo http://distfiles.gentoo.org"
LANG="en_AU.utf8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
USE="acl amd64 apache2 bash-completion berkdb bzip2 cairo cgi cli crypt curl cxx dri fortran gd gdbm geoip gif gmp hardened iconv ipv6 jpeg libressl libtirpc logrotate mariadb mysql mysqli ncurses nls nptl openmp pam pcre php png readline samba savedconfig snmp spell sqlite3 ssl tcpd threads tiff truetype vhosts xattr xinetd zip zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias http2 remoteip" CALLIGRA_FEATURES="karbon plan sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx f16c mmx mmxext pclmul popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc efi-64" INPUT_DEVICES="libinput keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-2 php7-3" POSTGRES_TARGETS="postgres9_5 postgres10" PYTHON_SINGLE_TARGET="python3_7" PYTHON_TARGETS="python2_7 python3_7" RUBY_TARGETS="ruby24" USERLAND="GNU" VIDEO_CARDS="amdgpu fbdev intel nouveau radeon radeonsi vesa dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, LINGUAS, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2019-01-15 11:46:05 UTC
Please attach the entire build log to this bug report.
Comment 2 Reuben Farrelly 2019-01-15 11:55:51 UTC
Created attachment 561188 [details]
app-editors/vim full build log

Sure.  Cropped initially because of the character limit in the text box but here's the full version.
Comment 3 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-01-15 12:33:20 UTC
CCing base-system as this is most likely a bug cause by =sys-apps/man-db-2.8.5
Comment 4 Kobboi 2019-01-21 19:54:59 UTC
I don't seem to have the problem falling back to {vim,vim-core,gvim}-8.1.0412
Comment 5 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-01-22 12:05:09 UTC
*** Bug 675272 has been marked as a duplicate of this bug. ***
Comment 6 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-01-22 12:08:13 UTC
Quick and dirty workaround until we found a working fix: 

Re-emerge sys-apps/man-db and the error should be temporarily gone until the man-db cron job is executed again. After that the error will re-appear.
Comment 7 Reuben Farrelly 2019-01-22 12:13:43 UTC
Indeed - quick and dirty but I can confirm that it is an effective workaround for me.
Comment 8 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-01-25 22:48:38 UTC
*** Bug 676252 has been marked as a duplicate of this bug. ***
Comment 9 Ben Kohler gentoo-dev 2019-02-19 18:38:07 UTC
*** Bug 678352 has been marked as a duplicate of this bug. ***
Comment 10 Kai Krakow 2019-02-23 11:56:29 UTC
I cannot confirm that it helps my problem https://bugs.gentoo.org/678352: Re-emerging man-db doesn't enable installation of the game. So I'm not sure if the "resolve as duplicate" is correct, it may be a different problem.

Take note that the work-around helps people having access violation in /var/cache. But my report (and another report) shows the violation in /usr/lib/llvm. The work-around doesn't help here. Maybe the real problem is in llvm instead for that case?
Comment 11 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-02-23 12:57:10 UTC
(In reply to Kai Krakow from comment #10)
> I cannot confirm that it helps my problem https://bugs.gentoo.org/678352:
> Re-emerging man-db doesn't enable installation of the game. So I'm not sure
> if the "resolve as duplicate" is correct, it may be a different problem.
> 
> Take note that the work-around helps people having access violation in
> /var/cache. But my report (and another report) shows the violation in
> /usr/lib/llvm. The work-around doesn't help here. Maybe the real problem is
> in llvm instead for that case?

Downgrade to =sys-apps/man-db-2.8.4 and try again. If the error is gone, it's this bug.
Comment 12 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-02-25 06:57:08 UTC
*** Bug 678726 has been marked as a duplicate of this bug. ***
Comment 13 Kai Krakow 2019-02-25 09:21:33 UTC
(In reply to Lars Wendler (Polynomial-C) from comment #11)
> (In reply to Kai Krakow from comment #10)
> > I cannot confirm that it helps my problem https://bugs.gentoo.org/678352:
> > Re-emerging man-db doesn't enable installation of the game. So I'm not sure
> > if the "resolve as duplicate" is correct, it may be a different problem.
> > 
> > Take note that the work-around helps people having access violation in
> > /var/cache. But my report (and another report) shows the violation in
> > /usr/lib/llvm. The work-around doesn't help here. Maybe the real problem is
> > in llvm instead for that case?
> 
> Downgrade to =sys-apps/man-db-2.8.4 and try again. If the error is gone,
> it's this bug.

Confirmed: After downgrading and re-emerging keepassxc directly after that, the latter installs successfully.
Comment 14 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-03-08 13:29:24 UTC
*** Bug 679766 has been marked as a duplicate of this bug. ***
Comment 15 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-03-08 13:31:13 UTC
*** Bug 679750 has been marked as a duplicate of this bug. ***
Comment 16 Helmut Jarausch 2019-03-08 14:35:24 UTC
Downgrading app-shells/bash  from 5.0.2_p2-r1 to 5.0.2_p2 help here, as well.
Comment 17 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-03-08 15:03:24 UTC
(In reply to Helmut Jarausch from comment #16)
> Downgrading app-shells/bash  from 5.0.2_p2-r1 to 5.0.2_p2 help here, as well.

That is not fixing the underlying issue. We had reports of this issue when there was no bash-5.0_p2-r1 in our tree.
Comment 18 Helmut Jarausch 2019-03-08 16:39:19 UTC
(In reply to Lars Wendler (Polynomial-C) from comment #17)
> (In reply to Helmut Jarausch from comment #16)
> > Downgrading app-shells/bash  from 5.0.2_p2-r1 to 5.0.2_p2 help here, as well.
> 
> That is not fixing the underlying issue. We had reports of this issue when
> there was no bash-5.0_p2-r1 in our tree.

But why did it fix the problems here, then?
Is it a new bug.
I had no such problems until I upgraded bash today.
Perhaps this shades some light on this bug or this is a new bug.
Comment 19 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-03-28 09:38:21 UTC
*** Bug 681910 has been marked as a duplicate of this bug. ***
Comment 20 Patrice Clement gentoo-dev 2019-03-29 09:11:01 UTC
*** Bug 681810 has been marked as a duplicate of this bug. ***
Comment 21 Mike Gilbert gentoo-dev 2019-03-31 04:07:22 UTC
Any objection to adding "--disable-cats" to the man-db configure options?

That should prevent the "man" command from attempting to write to /var/cache/man/catN.
Comment 22 Mike Gilbert gentoo-dev 2019-03-31 04:13:14 UTC
Possible alternatives:

- Patch man-db to disable cat pages via some environment variable.

- Update the default config for sys-apps/sandbox to allow writes to /var/cache/man. This should be fairly safe.
Comment 23 Ulrich Müller gentoo-dev 2019-04-13 12:02:58 UTC
(In reply to Mike Gilbert from comment #21)
> Any objection to adding "--disable-cats" to the man-db configure options?
> 
> That should prevent the "man" command from attempting to write to
> /var/cache/man/catN.

Like generally disabling the cache? That doesn't look right.


(In reply to Mike Gilbert from comment #22)
> Possible alternatives:
> 
> - Patch man-db to disable cat pages via some environment variable.

That can be done already now, e.g. by setting MANWIDTH to 1 (or another nonsensical value). Not very elegant, so maybe patching the code to honour a dedicated variable like NOCACHE would be cleaner indeed.

> - Update the default config for sys-apps/sandbox to allow writes to
> /var/cache/man. This should be fairly safe.

That looks wrong, too. We don't want to have src_* phases writing to the live system.
Comment 24 Mike Gilbert gentoo-dev 2019-04-13 12:38:23 UTC
(In reply to Ulrich Müller from comment #23)
> > - Update the default config for sys-apps/sandbox to allow writes to
> > /var/cache/man. This should be fairly safe.
> 
> That looks wrong, too. We don't want to have src_* phases writing to the
> live system.

That wouldn't really be a regression though.

Previous to man-db-2.8.5, the man binary was owned by the man user and had the suid bit set, which both bypassed the sandbox (LD_PRELOAD doesn't work with suid set) and allowed write access to /var/cache/man.

With man-db-2.8.5, we no longer have suid set, and the cache directory can only be written to by root or the man user. Assuming FEATURES="userpriv" is enabled, man would be running as the portage user in most of the src phases, so the cache writes would fail due to filesystem permissions.

If we are actually worried about writes to /var/cache/man when the ebuild is running as root, we could add the directory to SANDBOX_PREDICT instead of SANDBOX_WRITE.
Comment 25 Ulrich Müller gentoo-dev 2019-04-13 13:19:11 UTC
(In reply to Mike Gilbert from comment #24)
> If we are actually worried about writes to /var/cache/man when the ebuild is
> running as root, we could add the directory to SANDBOX_PREDICT instead of
> SANDBOX_WRITE.

AFAICS, the default SANDBOX_PREDICT already contains /var/cache/fontconfig which seems to be a similar case.
Comment 26 Mike Gilbert gentoo-dev 2019-04-13 13:32:41 UTC
Oh, I always forget that /etc/sandbox.d is a thing. I guess we can just install a snipped there and not have to touch the sys-apps/sandbox package at all.
Comment 27 Larry the Git Cow gentoo-dev 2019-04-13 14:17:23 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9830c2263498a6c9c4beabbefeb3533b372e9fc0

commit 9830c2263498a6c9c4beabbefeb3533b372e9fc0
Author:     Mike Gilbert <floppym@gentoo.org>
AuthorDate: 2019-04-13 14:02:39 +0000
Commit:     Mike Gilbert <floppym@gentoo.org>
CommitDate: 2019-04-13 14:17:16 +0000

    sys-apps/man-db: add /var/cache/man to SANDBOX_PREDICT
    
    Closes: https://bugs.gentoo.org/675478
    Package-Manager: Portage-2.3.62_p4, Repoman-2.3.12_p87
    Signed-off-by: Mike Gilbert <floppym@gentoo.org>

 sys-apps/man-db/{man-db-2.8.5.ebuild => man-db-2.8.5-r1.ebuild} | 7 +++++++
 sys-apps/man-db/man-db-9999.ebuild                              | 7 +++++++
 2 files changed, 14 insertions(+)
Comment 28 Patrice Clement gentoo-dev 2019-04-19 08:52:45 UTC
*** Bug 683782 has been marked as a duplicate of this bug. ***