Skip to content

Commit

Permalink
Enable --incompatible_sandbox_hermetic_tmp by default
Browse files Browse the repository at this point in the history
Fixes #3236
Closes #19915

RELNOTES[INC]: `--incompatible_sandbox_hermetic_tmp` is enabled by default. See #19915 for migration advice.

Closes #19943.

PiperOrigin-RevId: 581165770
Change-Id: I0d98102f10b1e47c1d8fcf32fb1f7dee5ae0788c
  • Loading branch information
fmeum authored and copybara-github committed Nov 10, 2023
1 parent 8473928 commit e2c0276
Show file tree
Hide file tree
Showing 5 changed files with 9 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -350,12 +350,12 @@ public ImmutableSet<Path> getInaccessiblePaths(FileSystem fs) {

@Option(
name = "incompatible_sandbox_hermetic_tmp",
defaultValue = "false",
defaultValue = "true",
documentationCategory = OptionDocumentationCategory.EXECUTION_STRATEGY,
effectTags = {OptionEffectTag.EXECUTION},
help =
"If set to true, each Linux sandbox will have its own dedicated empty directory mounted"
+ " as /tmp rather thansharing /tmp with the host filesystem. Use"
+ " as /tmp rather than sharing /tmp with the host filesystem. Use"
+ " --sandbox_add_mount_pair=/tmp to keep seeing the host's /tmp in all sandboxes.")
public boolean sandboxHermeticTmp;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,8 @@ public void testEditDuringBuild() throws Exception {
Path in = write("edit/in", "line1");
in.setLastModifiedTime(123456789);

// Make in writable from sandbox (in case sandbox strategy is used).
String absoluteInPath = in.getPathString();
addOptions("--sandbox_writable_path=" + absoluteInPath);
// Modify the actual source file, not a sandboxed copy.
addOptions("--spawn_strategy=local");

// The "echo" effects editing of the source file during the build:
write("edit/BUILD",
Expand Down
2 changes: 2 additions & 0 deletions src/test/shell/bazel/bazel_sandboxing_networking_test.sh
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,8 @@ source ${CURRENT_DIR}/remote_helpers.sh \
function set_up() {
add_to_bazelrc "build --spawn_strategy=sandboxed"
add_to_bazelrc "build --genrule_strategy=sandboxed"
# Allow the network socket to be seen in the sandbox.
add_to_bazelrc "build --sandbox_add_mount_pair=/tmp"

sed -i.bak '/sandbox_tmpfs_path/d' $TEST_TMPDIR/bazelrc
}
Expand Down
1 change: 1 addition & 0 deletions src/test/shell/integration/execution_strategies_test.sh
Original file line number Diff line number Diff line change
Expand Up @@ -223,6 +223,7 @@ EOF
bazel build --internal_spawn_scheduler --genrule_strategy=dynamic \
--dynamic_remote_strategy=sandboxed \
--dynamic_local_strategy=standalone \
--noincompatible_sandbox_hermetic_tmp \
--experimental_dynamic_ignore_local_signals=8,9,10 \
--experimental_local_lockfree_output \
--experimental_local_execution_delay=0 \
Expand Down
2 changes: 2 additions & 0 deletions src/test/shell/integration/sandboxing_test.sh
Original file line number Diff line number Diff line change
Expand Up @@ -735,6 +735,7 @@ EOF

touch "${temp_dir}/file"
bazel test //pkg:tmp_test \
--sandbox_add_mount_pair=/tmp \
--test_output=errors &>$TEST_log || fail "Expected test to pass"
}

Expand Down Expand Up @@ -812,6 +813,7 @@ EOF
chmod +x pkg/tmp_test.sh

bazel test //pkg:tmp_test \
--sandbox_add_mount_pair=/tmp \
--test_output=errors &>$TEST_log || fail "Expected test to pass"
[[ -f "${temp_dir}/file" ]] || fail "Expected ${temp_dir}/file to exist"
}
Expand Down

0 comments on commit e2c0276

Please sign in to comment.