Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 770931 - sys-kernel/gentoo-kernel sandbox violation: /dev/null.dwo
Summary: sys-kernel/gentoo-kernel sandbox violation: /dev/null.dwo
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Eclasses (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Distribution Kernel Project
Depends on:
Reported: 2021-02-16 12:55 UTC by pva
Modified: 2021-04-05 16:22 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---

gentoo-kernel-5.4.98_build.log (gentoo-kernel-5.4.98-build.log,78.16 KB, text/x-log)
2021-02-16 12:55 UTC, pva
emerge --info (emerge--info.txt,7.26 KB, text/plain)
2021-02-17 16:18 UTC, pva

Note You need to log in before you can comment on or make changes to this bug.
Description pva 2021-02-16 12:55:56 UTC
Created attachment 686943 [details]

During kernel build I get sandbox violation:

>>> Source configured.
 * --------------------------- ACCESS VIOLATION SUMMARY ---------------------------
 * LOG FILE: "/var/tmp/portage/sys-kernel/gentoo-kernel-5.4.98/temp/sandbox.log"
FORMAT: F - Function called
FORMAT: S - Access Status
FORMAT: P - Path as passed to function
FORMAT: A - Absolute Path (not canonical)
FORMAT: R - Canonical Path
FORMAT: C - Command Line

F: unlink
S: deny
P: /dev/null.dwo
A: /dev/null.dwo
R: /dev/null.dwo
C: x86_64-pc-linux-gnu-gcc -Werror -gsplit-dwarf -S -x c /dev/null -o /dev/null 
 * --------------------------------------------------------------------------------
Comment 1 pva 2021-02-16 13:13:32 UTC
This is really similar to #653286. But still a bit different.
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2021-02-16 13:35:32 UTC
emerge --info, please.
Comment 3 Ionen Wolkens gentoo-dev 2021-02-16 15:15:54 UTC
That line is a test for CONFIG_DEBUG_INFO_SPLIT, but should be working as far as I can tell.

Does this give access errors?
$ sandbox -- x86_64-pc-linux-gnu-gcc -Werror -gsplit-dwarf -S -x c /dev/null -o /dev/null

For me it makes no attempt to write a /dev/null.dwo

And yes, emerge --info might help.
Comment 4 pva 2021-02-17 16:18:17 UTC
Created attachment 687291 [details]
emerge --info
Comment 5 pva 2021-02-17 16:21:01 UTC
This command gives me no error as well:

$ sandbox -- x86_64-pc-linux-gnu-gcc -Werror -gsplit-dwarf -S -x c /dev/null -o /dev/null
Comment 6 Dan Goodliffe 2021-02-19 23:48:20 UTC
Same here on two different machines. I seem to recall having this problem with ccache a while ago, could that have crept back in? I do have ccache enabled for kernel builds.
Comment 7 Dan Goodliffe 2021-02-19 23:53:58 UTC
Set FEATURES=-ccache and it appears to be working fine. (will have to wait a while to be sure it completes, but it is working)

Seems to be a regression in ccache... there should be a related bug somewhere.
Comment 8 Dan Goodliffe 2021-02-19 23:58:05 UTC
Bug #712080 I stand corrected... that was ccache replacing /dev/null with a file... which would have caused a sandbox violation if genkernel ran in a sandbox like gentoo-kernel does.

In the meantime, sys-kernel/gentoo-kernel-5.4.94::gentoo install completed successfully with ccache disabled.
Comment 9 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2021-02-20 08:10:23 UTC
Do I understand correctly that it was caused by out-of-Portage ccache use?  Or does ccache damage your system when run via Portage?
Comment 10 Dan Goodliffe 2021-02-20 14:17:55 UTC
In Bug #712080 it was... sandbox must be protecting the system in this case, as intended. I'm using ccache all day every day without issue though, and it's working just fine for other packages. Not sure what's special about this gentoo-kernel that triggers this behaviour.
Comment 11 pva 2021-02-25 11:09:09 UTC
I confirm that disabling sandbox resolves this issue.
Comment 12 Guillaume Seren 2021-03-28 19:35:07 UTC
just ran into this issue on a server with, gentoo-kernel-5.4.105 and ccache.

 * ACCESS DENIED:  unlink:       /dev/null.dwo

I can confirm that disabling ccache solve the issue.
Comment 13 Grant Nichol 2021-04-05 16:22:00 UTC
I ran into this bug and investigated further. I have reported the bug upstream at

A minimal working example to demonstrate what is caught by the sandbox (ran by user):

$ PATH="/usr/lib/ccache/bin${PATH:+:}$PATH" CCACHE_DIR="$HOME/tmp/" strace x86_64-pc-linux-gnu-gcc -Werror -gsplit-dwarf -S -x c /dev/null -o /dev/null 2>&1 | grep /dev/null.dwo

This happens when building gentoo-kernel because of the similar line at scripts/Kconfig.include:28 of the Linux source, which is called by running emake O="${WORKDIR}"/modprep "${MAKEARGS[@]}" olddefconfig on line 92 of kernel-build.eclass

I verified that the access attempt does not occur when running without ccache:

$ strace x86_64-pc-linux-gnu-gcc -Werror -gsplit-dwarf -S -x c /dev/null -o /dev/null 2>&1 | grep /dev/null.dwo

has no output.