Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 873802 - app-editors/neovim-8.0.0: sandbox violation when XDG_STATE_HOME is set, combined with other XDG_* vars (* ACCESS DENIED: mkdir: /home/sicro/.local/state)
Summary: app-editors/neovim-8.0.0: sandbox violation when XDG_STATE_HOME is set, combi...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Vim Maintainers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-10-01 06:54 UTC by ignamartinoli
Modified: 2022-10-04 04:13 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge neovim (emerge neovim,511.25 KB, text/plain)
2022-10-01 06:54 UTC, ignamartinoli
Details
emerge --info (emerge --info,6.65 KB, text/plain)
2022-10-01 06:55 UTC, ignamartinoli
Details
env (env,5.57 KB, text/plain)
2022-10-01 06:55 UTC, ignamartinoli
Details

Note You need to log in before you can comment on or make changes to this bug.
Description ignamartinoli 2022-10-01 06:54:27 UTC
Created attachment 814906 [details]
emerge neovim

The package app-editors/neovim-8.0.0 fails to build. 

From these last lines:

 * ACCESS DENIED:  mkdir:         /home/sicro/.local/state
 * ACCESS DENIED:  mkdir:         /home/sicro/.local/state
[397/400] cd /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/runtime/pack/dist/opt/vimball && /usr/bin/cmake -E copy_directory /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0/runtime/pack/dist/opt/vimball /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/runtime/pack/dist/opt/vimball && /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/bin/nvim -u NONE -i NONE -e --headless -c helptags\ doc -c quit
[398/400] cd /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/runtime/pack/dist/opt/matchit && /usr/bin/cmake -E copy_directory /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0/runtime/pack/dist/opt/matchit /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/runtime/pack/dist/opt/matchit && /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/bin/nvim -u NONE -i NONE -e --headless -c helptags\ doc -c quit
[399/400] cd /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/runtime && luajit /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0/scripts/genvimvim.lua /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0/src/nvim /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/runtime/syntax/vim/generated.vim /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/funcs_data.mpack
 * ACCESS DENIED:  mkdir:         /home/sicro/.local/state
[400/400] cd /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/runtime && /usr/bin/cmake -E remove doc/* && /usr/bin/cmake -E copy_directory /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0/runtime/doc doc &&/var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/bin/nvim -u NONE -i NONE -e --headless -c helptags\++t\ doc -c quit
>>> Source compiled.
 * ----------------------- SANDBOX ACCESS VIOLATION SUMMARY -----------------------
 * LOG FILE: "/var/tmp/portage/app-editors/neovim-0.8.0/temp/sandbox.log"
 *
VERSION 1.0
FORMAT: F - Function called
FORMAT: S - Access Status
FORMAT: P - Path as passed to function
FORMAT: A - Absolute Path (not canonical)
FORMAT: R - Canonical Path
FORMAT: C - Command Line

F: mkdir
S: deny
P: /home/sicro/.local/state
A: /home/sicro/.local/state
R: /home/sicro/.local/state
C: /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/bin/nvim -u NONE -i NONE -e --headless -c helptags doc -c quit

F: mkdir
S: deny
P: /home/sicro/.local/state
A: /home/sicro/.local/state
R: /home/sicro/.local/state
C: /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/bin/nvim -u NONE -i NONE -e --headless -c helptags doc -c quit

F: mkdir
S: deny
P: /home/sicro/.local/state
A: /home/sicro/.local/state
R: /home/sicro/.local/state
C: /var/tmp/portage/app-editors/neovim-0.8.0/work/neovim-0.8.0_build/bin/nvim -u NONE -i NONE -e --headless -c helptags ++t doc -c quit
 * --------------------------------------------------------------------------------

I suspect it's an issue with permission to write on $HOME/.local/state
Comment 1 ignamartinoli 2022-10-01 06:55:42 UTC
Created attachment 814909 [details]
emerge --info
Comment 2 ignamartinoli 2022-10-01 06:55:54 UTC
Created attachment 814912 [details]
env
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-10-01 06:59:40 UTC
Thanks!

I can reproduce if I export:
```
export XDG_DATA_HOME=/home/sicro/.local/share
export XDG_CACHE_HOME=/home/sicro/.cache
export XDG_CONFIG_HOME=/home/sicro/.config
export XDG_STATE_HOME=/home/sicro/.local/state
```

even with my fix from earlier:

commit 737b23a0af4224a9d02d23ede7f41ab6dbd97319
Author: Sam James <sam@gentoo.org>
Date:   Sat Oct 1 07:32:31 2022 +0100

    app-editors/neovim: fix respecting CFLAGS; try avoid sandbox violation

    - RelWithDebInfo sets -Og -g after our flags. (Made a local hook for now
      to try catch these in future, along with -ffast-math, although that wasn't
      being set here.)

    - Use xdg_environment_reset to try avoid sandbox issues (see
      https://forums.gentoo.org/viewtopic-p-8750050.html).

      Also sent a patch to gentoo-dev ML for adding XDG_STATE_HOME to
      the unset/reset list for the eclass.

    Signed-off-by: Sam James <sam@gentoo.org>
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-10-01 07:00:46 UTC
The patch I proposed on gentoo-dev ML works: https://archives.gentoo.org/gentoo-dev/message/037169c03916ba5f07f9d9c8b56a7b76.
Comment 5 ignamartinoli 2022-10-01 07:05:37 UTC
Hey Sam

I had a related problem caused by XDG compatibily when I tried to update dev-lang/rust. I reported it here: https://forums.gentoo.org/viewtopic-t-1156684-highlight-.html
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-10-01 07:13:35 UTC
(In reply to ignamartinoli from comment #5)
> Hey Sam
> 
> I had a related problem caused by XDG compatibily when I tried to update
> dev-lang/rust. I reported it here:
> https://forums.gentoo.org/viewtopic-t-1156684-highlight-.html

Hey!

grknight is right there, but on the other hand, we have these mechanisms like ENV_UNSET for a reason, so we may as well use them ;)

Now, CARGO_HOME is interesting and it's actually already fixed in a way but not for librsvg, because it still uses EAPI 6, and ENV_UNSET is only supported for EAPI 7+.

Also, do you know if we need to unset RUSTUP_HOME? Could you try unsetting CARGO_HOME but keep RUSTUP_HOME set, and see if librsvg breaks?
Comment 7 ignamartinoli 2022-10-01 07:30:47 UTC
I can confirm: is possible to emerge gnome-base/librsvg while having CARGO_HOME unset and RUSTUP_HOME set.
Comment 8 Larry the Git Cow gentoo-dev 2022-10-04 04:13:34 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3fb3a73f31ff39601211278c9d75e1505ca64fac

commit 3fb3a73f31ff39601211278c9d75e1505ca64fac
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-10-01 07:09:51 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-04 04:13:00 +0000

    profiles: add XDG_STATE_DIR to ENV_UNSET
    
    XDG_STATE_HOME is defined in the basedir spec just like XDG_DATA_HOME and
    XDG_CONFIG_HOME, so we should cover it.
    
    Closes: https://bugs.gentoo.org/873802
    Signed-off-by: Sam James <sam@gentoo.org>

 profiles/base/make.defaults     | 2 +-
 profiles/embedded/make.defaults | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=75c077cf32fee0bd5c496487e53c68f460775f12

commit 75c077cf32fee0bd5c496487e53c68f460775f12
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-10-01 06:21:23 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-04 04:12:59 +0000

    xdg-utils.eclass: reset XDG_STATE_HOME
    
    XDG_STATE_HOME is defined in the basedir spec just like XDG_DATA_HOME and
    XDG_CONFIG_HOME, so we should cover it.
    
    We have to set in eclass because we still have < EAPI 7 ebuilds in tree
    (no ENV_UNSET).
    
    Closes: https://bugs.gentoo.org/873802
    Signed-off-by: Sam James <sam@gentoo.org>

 eclass/xdg-utils.eclass | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
Comment 9 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-10-04 04:13:58 UTC
(In reply to ignamartinoli from comment #7)
> I can confirm: is possible to emerge gnome-base/librsvg while having
> CARGO_HOME unset and RUSTUP_HOME set.

Thanks!