alex
c08c444a39
CI / check (push) Has been cancelled
The lib suite failed in the Nix sandbox:
harness::sandbox::tests::test_internal_sandbox_exec_dev_null_and_dns
harness::sandbox::tests::test_internal_sandbox_cross_directory_rename
Failed to exec shell in sandbox: Permission denied (os error 13)
apply_landlock_linux() allow-lists FHS paths only, and Landlock matches
inodes rather than symlinked views, so nothing under /nix/store can be
executed once the ruleset is applied; /bin/sh here is a store path. The
build sandbox also drops the /usr, /lib, /run and /var rules, since those
paths do not exist there, and has no /etc/resolv.conf without network, so
neither test can pass however the package is written. 342 of 344 tests run,
all green.
The same denial applies at runtime: every shell tool call goes through
marmel --internal-sandbox-exec and fails on NixOS. Tracked as
nix-overlay-5ml. Upstream main still carries the FHS-only list.