macOS: Ugly hack to make the tests succeed

Sandboxes cannot be nested, so if Nix's build runs inside a sandbox,
it cannot use a sandbox itself. I don't see a clean way to detect
whether we're in a sandbox, so use a test-specific hack.

https://github.com/NixOS/nix/issues/1413

1 files changed, 2 insertions, 3 deletions

diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index bdec30151b08..c34083d2e2fc 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -2621,7 +2621,7 @@ void DerivationGoal::runChild()
             ;
         }
 #if __APPLE__
-        else {
+        else if (getEnv("_NIX_TEST_NO_SANDBOX") == "") {
             /* This has to appear before import statements. */
             std::string sandboxProfile = "(version 1)\n";
 
@@ -2736,13 +2736,12 @@ void DerivationGoal::runChild()
             args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);
             args.push_back(drv->builder);
         }
-#else
+#endif
         else {
             builder = drv->builder.c_str();
             string builderBasename = baseNameOf(drv->builder);
             args.push_back(builderBasename);
         }
-#endif
 
         for (auto & i : drv->args)
             args.push_back(rewriteStrings(i, inputRewrites));