Merge pull request #22315 from Homebrew/improve-linux-sandbox-checks

Improve Linux sandbox behaviour

Author: MikeMcQuaid

.github/workflows/tests.yml

@@ -263,9 +263,16 @@ jobs:
         if: matrix.name == 'tests (online)'
         uses: Homebrew/actions/cache-homebrew-prefix@main
         with:
-          install: subversion curl
+          install: bubblewrap curl subversion
           workflow-key: tests-tests-online
 
+      - name: Install brew tests Linux dependencies
+        if: matrix.name == 'tests (Linux)'
+        uses: Homebrew/actions/cache-homebrew-prefix@main
+        with:
+          install: bubblewrap
+          workflow-key: tests-tests-linux
+
       - name: Install brew tests macOS dependencies
         if: runner.os != 'Linux'
         uses: Homebrew/actions/cache-homebrew-prefix@main
@@ -274,21 +281,6 @@ jobs:
           workflow-key: tests-tests-macos
           uninstall: true
 
-      - name: Install brew tests Linux dependencies
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends bubblewrap
-          # Allow unprivileged user namespace cloning; rootless `bwrap` needs this
-          # to create its user namespace.
-          sudo sysctl -w kernel.unprivileged_userns_clone=1
-          # Ensure the runner can allocate user namespaces instead of hitting a
-          # per-user namespace limit.
-          sudo sysctl -w user.max_user_namespaces=28633
-          # Ubuntu runners may additionally restrict unprivileged user namespaces
-          # through AppArmor; older kernels may not expose this sysctl.
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
-
         # brew tests doesn't like world writable directories
       - name: Cleanup permissions
         if: runner.os == 'Linux'

Library/Homebrew/build.rb

@@ -261,11 +261,6 @@ def normalize_pod2man_outputs!(formula)
   ENV["HOMEBREW_INTERNAL_ALLOW_PACKAGES_FROM_PATHS"] = "1"
 
   formula_path = ARGV.first
-  # `build.rb` is handed a concrete formula file; keep reparsing from falling
-  # back to the API inside the Linux sandbox.
-  # TODO: remove this and fix the sandbox code instead.
-  ENV["HOMEBREW_NO_INSTALL_FROM_API"] = "1" if ENV["HOMEBREW_SANDBOX_LINUX"] && formula_path&.end_with?(".rb")
-
   args = Homebrew::Cmd::InstallCmd.new.args
   Context.current = args.context
 

Library/Homebrew/env_config.rb

@@ -469,6 +469,10 @@ module EnvConfig
                      "shadowed by other commands earlier on `$PATH`.",
         boolean:     true,
       },
+      HOMEBREW_NO_SANDBOX_LINUX:                 {
+        description: "If set, disable the Linux sandbox.",
+        boolean:     true,
+      },
       HOMEBREW_NO_UPDATE_REPORT_NEW:             {
         description: "If set, `brew update` will not show the list of newly added formulae/casks.",
         boolean:     true,
@@ -626,6 +630,7 @@ def env_method_name(env, hash)
       :HOMEBREW_CASK_OPTS_REQUIRE_SHA,
       :HOMEBREW_FORBID_PACKAGES_FROM_PATHS,
       :HOMEBREW_DOWNLOAD_CONCURRENCY,
+      :HOMEBREW_SANDBOX_LINUX,
       :HOMEBREW_UPGRADE_AUTO_UPDATES_CASKS,
       :HOMEBREW_USE_INTERNAL_API,
     ]).freeze, T::Set[Symbol])
@@ -769,6 +774,14 @@ def download_concurrency
       [concurrency, 1].max
     end
 
+    sig { returns(T::Boolean) }
+    def sandbox_linux?
+      return false if Homebrew::EnvConfig.no_sandbox_linux?
+
+      sandbox_linux = ENV.fetch("HOMEBREW_SANDBOX_LINUX", nil)
+      sandbox_linux.present? && FALSY_VALUES.exclude?(sandbox_linux.downcase)
+    end
+
     sig { returns(T::Boolean) }
     def use_internal_api?
       return false if Homebrew::EnvConfig.no_install_from_api?

Library/Homebrew/extend/os/linux/dev-cmd/tests.rb

@@ -26,14 +26,20 @@ def os_files(files)
         sig { void }
         def check_test_environment!
           super
-          return unless GitHub::Actions.env_set?
+          return unless Homebrew::EnvConfig.sandbox_linux?
 
           require "sandbox"
-          with_env(HOMEBREW_SANDBOX_LINUX: "1") do
-            return if ::Sandbox.available?
 
-            raise UsageError, "GitHub Actions Linux tests require a working rootless Bubblewrap sandbox."
+          if GitHub::Actions.env_set?
+            ::Sandbox.configure!
+          else
+            ::Sandbox.ensure_sandbox_installed!(install_from_tests: true)
           end
+          return if ::Sandbox.available?
+
+          reason = ::Sandbox.failure_reason ||
+                   "`HOMEBREW_SANDBOX_LINUX` requires a working rootless Bubblewrap sandbox."
+          raise UsageError, reason
         end
       end
     end

Library/Homebrew/extend/os/linux/diagnostic.rb

@@ -6,6 +6,7 @@
 require "hardware"
 require "os/linux/glibc"
 require "os/linux/kernel"
+require "sandbox"
 
 module OS
   module Linux
@@ -25,6 +26,13 @@ def fatal_preinstall_checks
           ].freeze
         end
 
+        sig { returns(T::Array[String]) }
+        def fatal_build_from_source_checks
+          (super + %w[
+            check_linux_sandbox
+          ]).freeze
+        end
+
         sig { returns(T::Array[String]) }
         def supported_configuration_checks
           %w[
@@ -163,6 +171,48 @@ def check_kernel_minimum_version
           EOS
         end
 
+        sig { returns(T.nilable(String)) }
+        def check_linux_sandbox
+          return unless Homebrew::EnvConfig.sandbox_linux?
+
+          state = ::Sandbox.state
+          return if [:disabled, :available].include?(state)
+
+          reason = ::Sandbox.failure_reason || "The Linux sandbox is not available."
+          lines = case state
+          when :missing
+            [
+              reason,
+              "",
+              "Install Bubblewrap and ensure a rootless `bwrap` executable is available on `PATH`.",
+            ]
+          when :setuid
+            [
+              reason,
+              "",
+              "Homebrew's Linux sandbox requires a rootless `bwrap` executable.",
+              "Install a non-setuid Bubblewrap or put it earlier on `PATH`.",
+            ]
+          when :unavailable
+            [
+              reason,
+              "",
+              "Homebrew's Linux sandbox requires rootless Bubblewrap and unprivileged",
+              "user namespaces. Check and update this system configuration:",
+              *::Sandbox.configuration_command_messages,
+            ]
+          else
+            [reason]
+          end
+
+          "#{[
+            *lines,
+            "",
+            "As a final workaround, disable the Linux sandbox:",
+            "  export HOMEBREW_NO_SANDBOX_LINUX=1",
+          ].join("\n")}\n"
+        end
+
         sig { returns(T.nilable(String)) }
         def check_linuxbrew_core
           return unless Homebrew::EnvConfig.no_install_from_api?