build: fix sandboxing on darwin

Starting ba87b08f8529e4d9f8c58d8c625152058ceadb75 getEnv now returns an
std::optional which means these getEnv() != "" conditions no longer happen
if the variables are not defined.

2 files changed, 21 insertions, 14 deletions

diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 78f39fed1..c3d69f387 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -3338,7 +3338,7 @@ void DerivationGoal::runChild()
             ;
         }
 #if __APPLE__
-        else if (getEnv("_NIX_TEST_NO_SANDBOX") == "") {
+        else {
             /* This has to appear before import statements. */
             std::string sandboxProfile = "(version 1)\n";
 
@@ -3447,25 +3447,32 @@ void DerivationGoal::runChild()
             /* They don't like trailing slashes on subpath directives */
             if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
 
-            builder = "/usr/bin/sandbox-exec";
-            args.push_back("sandbox-exec");
-            args.push_back("-f");
-            args.push_back(sandboxFile);
-            args.push_back("-D");
-            args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
-            args.push_back("-D");
-            args.push_back("IMPORT_DIR=" + settings.nixDataDir + "/nix/sandbox/");
-            if (allowLocalNetworking) {
+            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {
+                builder = "/usr/bin/sandbox-exec";
+                args.push_back("sandbox-exec");
+                args.push_back("-f");
+                args.push_back(sandboxFile);
+                args.push_back("-D");
+                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
                 args.push_back("-D");
-                args.push_back(string("_ALLOW_LOCAL_NETWORKING=1"));
+                args.push_back("IMPORT_DIR=" + settings.nixDataDir + "/nix/sandbox/");
+                if (allowLocalNetworking) {
+                    args.push_back("-D");
+                    args.push_back(string("_ALLOW_LOCAL_NETWORKING=1"));
+                }
+                args.push_back(drv->builder);
+            } else {
+                printError("warning: running in sandboxing test mode, sandbox disabled");
+                builder = drv->builder.c_str();
+                args.push_back(std::string(baseNameOf(drv->builder)));
             }
-            args.push_back(drv->builder);
         }
-#endif
+#else
         else {
             builder = drv->builder.c_str();
             args.push_back(std::string(baseNameOf(drv->builder)));
         }
+#endif
 
         for (auto & i : drv->args)
             args.push_back(rewriteStrings(i, inputRewrites));
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index ed81186af..690febc5b 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -443,7 +443,7 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
     // lsof is really slow on OS X. This actually causes the gc-concurrent.sh test to fail.
     // See: https://github.com/NixOS/nix/issues/3011
     // Because of this we disable lsof when running the tests.
-    if (getEnv("_NIX_TEST_NO_LSOF") == "") {
+    if (getEnv("_NIX_TEST_NO_LSOF") != "1") {
         try {
             std::regex lsofRegex(R"(^n(/.*)$)");
             auto lsofLines =