[solved] sandbox issue when updating gettext

Message

STreen · Post by **STreen** » Thu Jun 03, 2021 6:39 pm

Hi,

there is a problem during the config phase for sys-devel/gettext-0.21-r1:

checking for Java compiler...  * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
javac -target 1.6 -source 1.6

and then

Code: Select all

F: mkdir
S: deny
P: /var/lib/portage/home/.oracle_jre_usage
A: /var/lib/portage/home/.oracle_jre_usage
R: /var/lib/portage/home/.oracle_jre_usage
C: java -version

emerge info

Code: Select all

# emerge --info
Portage 3.0.18 (python 3.9.4-final-0, default/linux/amd64/17.1, gcc-10.3.0, glibc-2.33, 5.7.8 x86_64)
=================================================================
System uname: Linux-5.7.8-x86_64-Intel-R-_Core-TM-_i7-4790K_CPU_@_4.00GHz-with-glibc2.33
KiB Mem:    16304896 total,  10024920 free
KiB Swap:  104864156 total, 104864156 free
Head commit of repository gentoo: 3dde3e2aa0d86be305acd90cdff45b22a43c669c

sh bash 5.1_p8
ld GNU ld (Gentoo 2.34 p6) 2.34.0
ccache version 4.2.1 [enabled]
app-shells/bash:          5.1_p8::gentoo
dev-lang/perl:            5.32.1::gentoo
dev-lang/python:          3.7.10_p3::gentoo, 3.8.9_p2::gentoo, 3.9.4_p1::gentoo
dev-lang/rust-bin:        1.51.0::gentoo
dev-util/ccache:          4.2.1::gentoo
dev-util/cmake:           3.18.5::gentoo
sys-apps/baselayout:      2.7::gentoo
sys-apps/openrc:          0.42.1-r1::gentoo
sys-apps/sandbox:         2.23::gentoo
sys-devel/autoconf:       2.13-r1::gentoo, 2.69-r5::gentoo
sys-devel/automake:       1.16.3-r1::gentoo
sys-devel/binutils:       2.34-r2::gentoo, 2.35.2::gentoo
sys-devel/gcc:            10.3.0::gentoo, 11.1.0::gentoo
sys-devel/gcc-config:     2.4::gentoo
sys-devel/libtool:        2.4.6-r6::gentoo
sys-devel/make:           4.3::gentoo
sys-kernel/linux-headers: 5.10::gentoo (virtual/os-headers)
sys-libs/glibc:           2.33::gentoo
Repositories:

gentoo
    location: /usr/portage
    sync-type: git
    sync-uri: https://anongit.gentoo.org/git/repo/gentoo.git
    priority: -1000

ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="@FREE"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=haswell -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=haswell -O2 -pipe"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--jobs=8 --load-average=8"
ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs ccache config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="ftp://ftp-stud.hs-esslingen.de/pub/Mirrors/gentoo/ ftp://ftp.dei.uc.pt/pub/linux/gentoo/ ftp://ftp.fau.de/gentoo ftp://ftp.fi.muni.cz/pub/linux/gentoo/ ftp://ftp.free.fr/mirrors/ftp.gentoo.org/ ftp://ftp.halifax.rwth-aachen.de/gentoo/ ftp://ftp.iij.ad.jp/pub/linux/gentoo/ ftp://ftp.jaist.ac.jp/pub/Linux/Gentoo/ ftp://ftp.kaist.ac.kr/gentoo/ ftp://ftp.lanet.kr/pub/gentoo/ ftp://ftp.mirrorservice.org/sites/distfiles.gentoo.org/ ftp://ftp.ntua.gr/pub/linux/gentoo/ ftp://ftp.rnl.tecnico.ulisboa.pt/pub/gentoo/gentoo-distfiles/ ftp://ftp.snt.utwente.nl/pub/os/linux/gentoo ftp://ftp.swin.edu.au/gentoo ftp://ftp.twaren.net/Linux/Gentoo/ ftp://ftp.ussg.iu.edu/pub/linux/gentoo ftp://ftp.vectranet.pl/gentoo/ ftp://ftp.wh2.tu-dresden.de/pub/mirrors/gentoo ftp://gentoo.bloodhost.ru/ ftp://gentoo.mirror.web4u.cz/ ftp://gentoo.wheel.sk/pub/linux/gentoo/ ftp://mirror.bytemark.co.uk/gentoo/ ftp://mirror.csclub.uwaterloo.ca/gentoo-distfiles/ ftp://mirror.dkm.cz/gentoo/ ftp://mirror.mdfnet.se/gentoo ftp://mirror.netcologne.de/gentoo/ ftp://mirror.ps.kz/gentoo/pub ftp://mirror.rise.ph/gentoo ftp://mirror.yandex.ru/gentoo-distfiles/ ftp://mirrors.rit.edu/gentoo/ ftp://mirrors.soeasyto.com/distfiles.gentoo.org/ ftp://mirrors.tera-byte.com/pub/gentoo ftp://tux.rainside.sk/gentoo/ http://ftp-stud.hs-esslingen.de/pub/Mirrors/gentoo/ http://ftp.daum.net/gentoo/ http://ftp.dei.uc.pt/pub/linux/gentoo/ http://ftp.fau.de/gentoo http://ftp.fi.muni.cz/pub/linux/gentoo/ http://ftp.free.fr/mirrors/ftp.gentoo.org/ http://ftp.halifax.rwth-aachen.de/gentoo/ http://ftp.iij.ad.jp/pub/linux/gentoo/ http://ftp.jaist.ac.jp/pub/Linux/Gentoo/ http://ftp.kaist.ac.kr/pub/gentoo/ http://ftp.lanet.kr/pub/gentoo/ http://ftp.ntua.gr/pub/linux/gentoo/ http://ftp.rnl.tecnico.ulisboa.pt/pub/gentoo/gentoo-distfiles/ http://ftp.romnet.org/gentoo/ http://ftp.snt.utwente.nl/pub/os/linux/gentoo http://ftp.swin.edu.au/gentoo http://ftp.twaren.net/Linux/Gentoo/ http://ftp.vectranet.pl/gentoo/ http://gentoo-mirror.alexxy.name/ http://gentoo.aditsu.net:8000/ http://gentoo.bloodhost.ru/ http://gentoo.c3sl.ufpr.br/ http://gentoo.cs.utah.edu/ http://gentoo.gossamerhost.com http://gentoo.mirror.web4u.cz/ http://gentoo.mirrors.easynews.com/linux/gentoo/ http://gentoo.mirrors.ovh.net/gentoo-distfiles/ http://gentoo.mirrors.pair.com/ http://gentoo.mirrors.tds.net/gentoo http://gentoo.mirrors.tera-byte.com/ http://gentoo.modulix.net/gentoo/ http://gentoo.osuosl.org/ http://gentoo.ussg.indiana.edu/ http://gentoo.wheel.sk/ http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror/ http://mirror.bytemark.co.uk/gentoo/ http://mirror.csclub.uwaterloo.ca/gentoo-distfiles/ http://mirror.dkm.cz/gentoo/ http://mirror.eu.oneandone.net/linux/distributions/gentoo/gentoo/ http://mirror.isoc.org.il/pub/gentoo/ http://mirror.leaseweb.com/gentoo/ http://mirror.netcologne.de/gentoo/ http://mirror.ps.kz/gentoo/pub http://mirror.rise.ph/gentoo http://mirror.sjc02.svwh.net/gentoo/ http://mirror.yandex.ru/gentoo-distfiles/ http://mirrors.163.com/gentoo/ http://mirrors.evowise.com/gentoo/ http://mirrors.rit.edu/gentoo/ http://mirrors.soeasyto.com/distfiles.gentoo.org/ http://mirrors.xservers.ro/gentoo/ http://tux.rainside.sk/gentoo/ http://www.gtlib.gatech.edu/pub/gentoo http://www.mirrorservice.org/sites/distfiles.gentoo.org/ https://ftp-stud.hs-esslingen.de/pub/Mirrors/gentoo/ https://ftp.fau.de/gentoo https://ftp.halifax.rwth-aachen.de/gentoo/ https://ftp.jaist.ac.jp/pub/Linux/Gentoo/ https://ftp.lanet.kr/pub/gentoo/ https://ftp.linux.org.tr/gentoo/ https://ftp.rnl.tecnico.ulisboa.pt/pub/gentoo/gentoo-distfiles/ https://ftp.snt.utwente.nl/pub/os/linux/gentoo https://gentoo-mirror.alexxy.name/ https://gentoo.c3sl.ufpr.br/ https://gentoo.osuosl.org/ https://gentoo.ussg.indiana.edu/ https://gentoo.wheel.sk/ https://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror/ https://mirror.bytemark.co.uk/gentoo/ https://mirror.csclub.uwaterloo.ca/gentoo-distfiles/ https://mirror.dkm.cz/gentoo/ https://mirror.eu.oneandone.net/linux/distributions/gentoo/gentoo/ https://mirror.isoc.org.il/pub/gentoo/ https://mirror.leaseweb.com/gentoo/ https://mirror.mdfnet.se/gentoo https://mirror.netcologne.de/gentoo/ https://mirror.ps.kz/gentoo/pub https://mirror.sjc02.svwh.net/gentoo/ https://mirror.yandex.ru/gentoo-distfiles/ https://mirrors.163.com/gentoo/ https://mirrors.evowise.com/gentoo/ https://mirrors.rit.edu/gentoo/ https://mirrors.soeasyto.com/distfiles.gentoo.org/ https://mirrors.tuna.tsinghua.edu.cn/gentoo https://www.mirrorservice.org/sites/distfiles.gentoo.org/ rsync://ftp-stud.hs-esslingen.de/gentoo/ rsync://ftp.fau.de/gentoo rsync://ftp.fi.muni.cz/pub/linux/gentoo/ rsync://ftp.halifax.rwth-aachen.de/gentoo/ rsync://ftp.iij.ad.jp/pub/linux/gentoo/ rsync://ftp.jaist.ac.jp/pub/Linux/Gentoo/ rsync://ftp.linux.org.tr/gentoo-distfiles/ rsync://ftp.rnl.tecnico.ulisboa.pt/pub/gentoo/gentoo-distfiles/ rsync://ftp.snt.utwente.nl/gentoo rsync://ftp.vectranet.pl/gentoo/ rsync://gentoo.bloodhost.ru/gentoo-distfiles rsync://gentoo.c3sl.ufpr.br/gentoo/ rsync://gentoo.gossamerhost.com/gentoo-distfiles/ rsync://mirror.bytemark.co.uk/gentoo/ rsync://mirror.dkm.cz/gentoo/ rsync://mirror.eu.oneandone.net/gentoo/ rsync://mirror.leaseweb.com/gentoo/ rsync://mirror.netcologne.de/gentoo/ rsync://mirror.ps.kz/gentoo rsync://mirrors.rit.edu/gentoo/ rsync://mirrors.tera-byte.com/gentoo rsync://rsync.gtlib.gatech.edu/gentoo rsync://rsync.mirrorservice.org/distfiles.gentoo.org/"
LANG="en_US.utf8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j9 -l8"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
USE="X acl acpi amd64 bash-completion berkdb bzip2 cli crypt dbus dri elogind fortran gdbm gif iconv ipv6 jpeg libglvnd libtirpc mp3 multilib ncurses nls nptl openmp pam pcre posix pulseaudio readline seccomp split-usr ssl syslog tcpd threads truetype unicode xattr zlib" ABI_X86="64 32" ADA_TARGET="gnat_2018" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 f16c fma3 mmx mmxext pclmul popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="libinput" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-3 php7-4" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_9" PYTHON_TARGETS="python3_7 python3_8 python3_9" RUBY_TARGETS="ruby26" USERLAND="GNU" VIDEO_CARDS="nvidia" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, LINGUAS, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, RUSTFLAGS

I already read it could be a sandbox problem. I have no jdk or jre installed via portage.
Any ideas what could be the problem?

Thank you[/quote][/code]

alamahant · Post by **alamahant** » Thu Jun 03, 2021 6:46 pm

Do you need java support for gettext?
its off by default.
You can try

Code: Select all

USE="-java" emerge -1av gettext

STreen · Post by **STreen** » Thu Jun 03, 2021 6:52 pm

I forgot to mention that I tried that

Code: Select all

USE="-java" emerge =sys-devel/gettext-0.21-r1 --jobs=1 -1
[...]
hecking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for Java compiler...  * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage
 * ACCESS DENIED:  mkdir:        /var/lib/portage/home/.oracle_jre_usage

STreen · Post by **STreen** » Thu Jun 03, 2021 6:54 pm

I also tried to

Code: Select all

mkdir /var/lib/portage/home/.oracle_jre_usage
chmod 777 /var/lib/portage/home/.oracle_jre_usage

then I get

Code: Select all

hecking for Java compiler...  * ACCESS DENIED:  open_wr:      /var/lib/portage/home/.oracle_jre_usage/93b98799d4afa1f6.timestamp
 * ACCESS DENIED:  open_wr:      /var/lib/portage/home/.oracle_jre_usage/93b98799d4afa1f6.timestamp

alamahant · Post by **alamahant** » Thu Jun 03, 2021 7:24 pm

Some perms

Code: Select all

ls -l /var/lib/portage
total 20
-rw-rw---- 1 root    portage 5967 May 17 12:41 config
drwxr-xr-x 2 portage portage 4096 Dec 28 10:29 home
-rw-rw---- 1 root    portage    2 May 27 13:09 preserved_libs_registry
-rw-r--r-- 1 root    portage 2611 Jun  3 22:01 world
-rw-r--r-- 1 root    portage    0 Jun  1 23:58 world_sets

In my case it builds

Code: Select all

emerge -1av gettext

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] sys-devel/gettext-0.21-r1::gentoo  USE="acl cxx ncurses nls openmp -cvs -doc -emacs -git -java -static-libs" ABI_X86="(64) -32 (-x32)" 0 KiB

Total: 1 package (1 reinstall), Size of downloads: 0 KiB

Would you like to merge these packages? [Yes/No] y
>>> Verifying ebuild manifests
>>> Emerging (1 of 1) sys-devel/gettext-0.21-r1::gentoo
>>> Installing (1 of 1) sys-devel/gettext-0.21-r1::gentoo
>>> Jobs: 1 of 1 complete                           Load avg: 2.31, 1.34, 0.58
>>> Auto-cleaning packages...

>>> No outdated packages were found on your system.

 * Regenerating GNU info directory index...
 * Processed 120 info files.

Maybe rebuild portage and sandbox.......?

STreen · Post by **STreen** » Fri Jun 04, 2021 6:50 am

Permissions look ok for me as well:

Code: Select all

# ls -l /var/lib/portage/ | grep home
drwxr-sr-x 2 portage portage 4096 Jun  4 08:40 home

Reemerging portage and sandbox didn't help though.

What does work is setting FEATURES=-usersandbox
but this seems more like a workaround.

c8lkid · Post by **c8lkid** » Fri Jun 04, 2021 7:33 am

Hi, I had some issue. Just temporary unlink symlinks on jdk and try rebuild again. That's helped me

Post by Hu » Fri Jun 04, 2021 3:57 pm

Sandbox permission denial errors are independent of the filesystem, and are triggered by the program trying to write outside a sandbox-approved directory. It is odd though that setting USE=-java did not bypass it.

If you don't have Java installed, why is anything trying to create a .oracle_jre_usage directory? Do you have java installed outside of Portage?

STreen · Post by **STreen** » Sat Jun 05, 2021 8:00 am

Hu wrote:Sandbox permission denial errors are independent of the filesystem, and are triggered by the program trying to write outside a sandbox-approved directory. It is odd though that setting USE=-java did not bypass it.

If you don't have Java installed, why is anything trying to create a .oracle_jre_usage directory? Do you have java installed outside of Portage?

Indeed, I have

Code: Select all

ls /opt/|grep jdk
jdk-11.0.9
jdk1.8.0_121

There actually existed symlinks under /usr/bin

Code: Select all

ls -l /usr/bin/java*
lrwxrwxrwx 1 root root 26 Feb 11  2017 /usr/bin/java -> /opt/jdk1.8.0_121/bin/java
lrwxrwxrwx 1 root root 27 Feb 11  2017 /usr/bin/javac -> /opt/jdk1.8.0_121/bin/javac
lrwxrwxrwx 1 root root 29 Feb 11  2017 /usr/bin/javadoc -> /opt/jdk1.8.0_121/bin/javadoc
lrwxrwxrwx 1 root root 36 Feb 11  2017 /usr/bin/javafxpackager -> /opt/jdk1.8.0_121/bin/javafxpackager
lrwxrwxrwx 1 root root 27 Feb 11  2017 /usr/bin/javah -> /opt/jdk1.8.0_121/bin/javah
lrwxrwxrwx 1 root root 27 Feb 11  2017 /usr/bin/javap -> /opt/jdk1.8.0_121/bin/javap
lrwxrwxrwx 1 root root 34 Feb 11  2017 /usr/bin/javapackager -> /opt/jdk1.8.0_121/bin/javapackager
lrwxrwxrwx 1 root root 34 Feb 11  2017 /usr/bin/java-rmi.cgi -> /opt/jdk1.8.0_121/bin/java-rmi.cgi
lrwxrwxrwx 1 root root 28 Feb 11  2017 /usr/bin/javaws -> /opt/jdk1.8.0_121/bin/javaws

I don't recall putting these in place. The JDKs were installed only by unzipping an archive, not by running any script, weird.
Anyway, after removing them it solved the issue.

Thanks for the help!