1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# Output phrases that identify WHICH sandbox boundary refused a child process.
#
# Data, not code: when a new build tool prints a new phrase for a refused
# socket or an unreachable registry, adding it here is a reviewable one-line
# diff, and nothing in the Rust module decides what the phrases are.
#
# Every entry is lowercase and matched by substring against the lowercased
# child output. Classification order lives in the Rust module: writes first (a
# refused cache write under `~` names the home path too), then home reads,
# then egress, then local sockets.
# Present in every refusal the OS sandbox produces. Gates the write and
# home-read classes so a tool's ordinary "could not create" is not read as a
# sandbox denial.
= [
"operation not permitted",
"permission denied",
"access is denied",
"eperm",
"eacces",
"not readable",
]
# Resolver and connect failures a build tool prints when remote egress is
# refused.
= [
"unknownhostexception",
"getaddrinfo",
"enotfound",
"eai_again",
"eai_noname",
"could not resolve host",
"couldn't resolve host",
"name or service not known",
"nodename nor servname provided",
"temporary failure in name resolution",
"network is unreachable",
"no route to host",
"connection refused (os error",
]
# Local socket operations: Unix-domain socket libraries, the named-pipe
# vocabulary .NET uses for them, and `socketexception` for the JVM's loopback
# refusal.
= [
"ipcsocket",
"unix domain socket",
"unixdomainsocket",
"unix_domain",
"af_unix",
"sockaddr_un",
"named pipe",
"namedpipe",
"corefxpipe",
"socketexception",
"socket.error",
"bind(",
"listen(",
"connect(",
"eaddrinuse",
"econnrefused",
"server did not start",
"could not connect to the daemon",
"unable to start the daemon",
]
# A refused write. The fix is a write root, not a read root.
= [
"read-only file system",
"write failed",
"for writing",
# the JVM's write path; a refused `~/.sbt/boot` lock surfaces as this
"fileoutputstream",
"could not create",
"cannot create",
"failed to create",
"unable to create",
"failed to write",
"cannot write",
"could not write",
"mkdir",
]