How do you debug a Bazel sandboxing failure? - bazel

Question

Repo with full code example.
When I try to run a test with Bazel involving the tree-sitter binary, I get an Operation not permitted error without any further information.
❯ bazel test --test_output=errors --verbose_failures --sandbox_debug //tree-sitter-nbts:check-generated
INFO: Analyzed target //tree-sitter-nbts:check-generated (0 packages loaded, 0 targets configured).
INFO: Found 1 test target...
FAIL: //tree-sitter-nbts:check-generated (see /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/execroot/__main__/bazel-out/darwin_arm64-fastbuild/testlogs/tree-sitter-nbts/check-generated/test.log)
INFO: From Testing //tree-sitter-nbts:check-generated:
==================== Test output for //tree-sitter-nbts:check-generated:
++ dirname /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts/check-generated
+ cd /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts
+ git init -b main
Initialized empty Git repository in /private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/sandbox/darwin-sandbox/17/execroot/__main__/bazel-out/darwin_arm64-fastbuild/bin/tree-sitter-nbts/check-generated.runfiles/__main__/tree-sitter-nbts/.git/
+ git add .
+ GIT_AUTHOR_EMAIL=_
+ GIT_AUTHOR_NAME=_
+ GIT_COMMITTER_EMAIL=_
+ GIT_COMMITTER_NAME=_
+ git commit -m 'Initial commit'
[main (root-commit) 1f79ef2] Initial commit
11 files changed, 11 insertions(+)
create mode 120000 Cargo.lock
create mode 120000 Cargo.toml
create mode 120000 bindings/rust/build.rs
create mode 120000 bindings/rust/lib.rs
create mode 120000 check-generated
create mode 120000 check-generated.sh
create mode 120000 grammar.js
create mode 120000 src/grammar.json
create mode 120000 src/node-types.json
create mode 120000 src/parser.c
create mode 120000 src/tree_sitter/parser.h
+ tree-sitter generate
Operation not permitted (os error 1)
================================================================================
Target //tree-sitter-nbts:check-generated up-to-date:
bazel-bin/tree-sitter-nbts/check-generated
INFO: Elapsed time: 0.220s, Critical Path: 0.11s
INFO: 2 processes: 2 darwin-sandbox.
INFO: Build completed, 1 test FAILED, 2 total actions
//tree-sitter-nbts:check-generated FAILED in 0.1s
/private/var/tmp/_bazel_varun/e55142ab9bc72292b8c54fb9627025eb/execroot/__main__/bazel-out/darwin_arm64-fastbuild/testlogs/tree-sitter-nbts/check-generated/test.log
INFO: Build completed, 1 test FAILED, 2 total actions
What is a good way of debugging this? So far, I know the following:
Running tree-sitter generate directly in the source tree works fine.
The bazel test command works fine with --spawn_strategy=standalone, which I think confirms that this is a sandboxing issue.
The bazel test command works fine inside the Nix environment (see the linked repo). This one is a little weird, not sure what's going on here.
Configuration information:
macOS 12.4 on an M1 Mac
Bazel v5.2.0 (both in Nix and outside)
tree-sitter v0.20.6 (both in Nix and outside) (I tried using the Nix-installed binary with Bazel and that didn't seem to make any difference)
OpenJDK v11.0.15 in the global environment vs OpenJDK v11.0.11 in Nix.
GitHub issues which seem related:
ln call fails with "operation not permitted" during bazel test - This comment mentions there is no command printed with --verbose_failures --sandbox_debug.
Strange "Operation not permitted" problem for test program accessing files in the sand box on MacOS