Issue with sandbox.sh

[drjdn]

I'm unable to build ocaml-r via opam. If I clone the repo and build using dune it compiles correctly. On my system R is installed at prefix /usr/local/R which is not where it would generally be installed if using a package manager. I'm pretty sure it is related to sandbox.sh since:

${HOME}/.opam/opam-init/hooks/sandbox.sh build dune build -p ocaml-r -j 5 @install

fails with a message about missing shared libraries. However, if I cd into:

${HOME}/.opam/default/.opam-switch/build/ocaml-r.0.4.0

and run:

dune build -p ocaml-r -j 5 @install

it builds correctly. I've tried adding the appropriate paths to OPAM_USER_PATH_RO via:

~/.opam/opam-init/variables.sh

but it still fails to build correctly. I've tried /usr/local/R/lib/R/lib where libR.so lives and various other attempts like /usr/local/R but nothing has worked. Not sure if this is a bug or if I'm not understanding how opam sandboxing works. You can find further discussion about this between me and the author of ocaml-r at PR14.

Result of opam config report:

# opam config report
# opam-version      2.0.7 
# self-upgrade      no
# system            arch=x86_64 os=linux os-distribution=debian os-version=testing
# solver            builtin-mccs+glpk
# install-criteria  -removed,-count[version-lag,request],-count[version-lag,changed],-changed
# upgrade-criteria  -removed,-count[version-lag,solution],-new
# jobs              5
# repositories      1 (http) (default repo at ea0d9f1d)
# pinned            1 (git)
# current-switch    default

[rjbou]

/usr is already mounted as a ro path, it shoudn't fail because of the access to /usr directories, and you should not need OPAM_USER_PATH_RO.
What distro do you use ? on debian, I tried and wasn't able to reproduce the bug (ocaml-r from dev repo), with opam 2.0.7 & master sandbox scripts.

Out of curiosity, why did you added the environment variable on variable.sh ? This script is rewritten by opam on some operations.

[drjdn]

I originally had OPAM_USER_PATH_RO exported at the system level but it wasn't showing up in the *.env file in ${HOME}/.opam/log so I added it to variable.sh.

I have several debian systems (both buster and testing) and the problem is consistent across all. Just to verify I installed a fresh version of Debian 10 (buster) in a virtual machine (gnome-boxes) and I get the same issue. Did you install R with prefix /usr/local/R? If so you'd need to remove the package installed by apt. The Configurator in ocaml-r is using pkg-config and it will find the system installed version of libR.so first unless you tell it otherwise. There are no issues with installing ocaml-r with opam if R is installed in the standard location as is the case with the debian package.

[rjbou]

It is the same behavior than reading a file from /usr/local location :

$ ls -lh /usr/local/RR
total 4.0K
-rw-r--r-- 1 root root 6 Dec 15 15:19 lib.r
$ cat /usr/local/RR/lib.r
found

$ cat ./local-r/local-r.opam
opam-version: "2.0"
name: "local-r"
version: "0.1"
synopsis: "One-line description"
description: """
Longer description
"""
maintainer: "Name <email>"
authors: "Name <email>"
license: " "
homepage: " "
bug-reports: " "
dev-repo: "git://github.com/foo"
build:  [ "cat" "/usr/local/RR/lib.r" ]

$ opam install ./local-r -vv
[...]
+ ~/.opam/sw/bin/ocamlc "-vnum"
- 4.07.1
Package local-r does not exist, create as a NEW package? [Y/n] y
local-r is now pinned to file:///./local-r (version 0.1)
The following actions will be performed:
  ∗ install local-r 0.1*

<><> Processing actions <><><><><><><><><><><><><><><><><><><><><><><><><><><><>
+ /usr/bin/rsync "-rLptgoDvc" "--exclude" ".git" "--exclude" "_darcs" "--exclude" ".hg" "--exclude" ".#*" "--exclude" "_opam" "--exclude" "_build" "--delete" "--delete-excluded" "/w/pkgs_opam/local-r/" "~/.opam/sw/.opam-switch/sources/local-r"
[...]
⬇ retrieved local-r.0.1  (file:///./local-r)
+ ~/.opam/opam-init/hooks/sandbox.sh "build" "cat" "/usr/local/RR/lib.r" (CWD=~/.opam/sw/.opam-switch/build/local-r.0.1)
- found
λ compiled  local-r.0.1
∗ installed local-r.0.1
Done.

Can you try something similar, to check if it comes only from the sandbox not reading from /usr in your case or from sandboxed build with an unusual R install ?

[drjdn]

I can confirm that the above example works as expected.

[dra27]

@rjbou - is this definitely to fix for 2.1?

[dra27]

@kit-ty-kate - does #4795 eliminate this?

[kit-ty-kate]

Unless /usr/local/R was a link to another directory outside of /usr /bin /lib /lib32 /lib64 /etc /opt /home /var /tmp, I don’t think so.

@drjdn was that the case?

[drjdn]

@kit-ty-kate Nope, I have no symlinks in `/usr/local`

[dra27]

Closing this for now, as it doesn't appear that there's anything which we need to alter. Please feel free to re-open with any additional information, though, if it's still not working!