Bazel: Mac bazel build fails due to `operation not permitted` on contents of local directory

[smarterclayton]

On OSX Sierra (10.12.2 (16C67)) I have a clean bazel installation and I am attempting to build both the bazel build example and Kubernetes master. I get:

$ git clone https://github.com/bazelbuild/examples
Cloning into 'examples'...
remote: Counting objects: 407, done.
remote: Total 407 (delta 0), reused 0 (delta 0), pack-reused 407
Receiving objects: 100% (407/407), 83.51 KiB | 0 bytes/s, done.
Resolving deltas: 100% (129/129), done.
$ cd examples/
$ ls -al
total 64
drwxr-xr-x   5 clayton  staff    374 Jan 19 12:26 .
drwxr-xr-x  13 clayton  staff    714 Jan 19 12:26 ..
drwxr-xr-x   7 clayton  staff    408 Jan 19 12:26 .git
-rw-r--r--   1 clayton  staff     26 Jan 19 12:26 .gitignore
-rw-r--r--   1 clayton  staff    333 Jan 19 12:26 AUTHORS
-rw-r--r--   1 clayton  staff   1161 Jan 19 12:26 CONTRIBUTING.md
-rw-r--r--   1 clayton  staff    700 Jan 19 12:26 CONTRIBUTORS
-rw-r--r--   1 clayton  staff  11358 Jan 19 12:26 LICENSE.txt
-rw-r--r--   1 clayton  staff     91 Jan 19 12:26 README.md
drwxr-xr-x   3 clayton  staff    238 Jan 19 12:26 java-maven
drwxr-xr-x   6 clayton  staff    306 Jan 19 12:26 tutorial
$ cd tutorial/
$ bazel build //backend
........
INFO: Found 1 target...
ERROR: /Volumes/development/projects/origin/src/k8s.io/examples/tutorial/backend/BUILD:5:1: error executing shell command: 'set -e;rm -rf bazel-out/local-fastbuild/bin/backend/backend.war.build_output
mkdir -p bazel-out/local-fastbuild/bin/backend/backend.war.build_output
mkdir -p bazel-out/local-fastbuild/bin/backend/b...' failed: sandbox-exec failed: error executing command /usr/bin/sandbox-exec -f /private/var/tmp/_bazel_clayton/22a971d37f99d96071f8ddce80650f97/bazel-sandbox/2f239a21-434f-43d3-b6a6-8bfb187953b3-2/sandbox.sb /bin/bash -c ... (remaining 1 argument(s) skipped).
Cannot stat file ./WEB-INF/appengine-web.xml: Operation not permitted
File ./WEB-INF/appengine-web.xml does not seem to exist.Target //backend:backend failed to build
Use --verbose_failures to see the command lines of failed build steps.
INFO: Elapsed time: 39.896s, Critical Path: 1.42s

Same for kubernetes

$ git clone https://github.com/kubernetes/kubernetes.git
$ cd kubernetes
$ bazel test //cmd/... //build/... //pkg/... //federation/... //plugin/...
INFO: Found 2779 targets and 418 test targets...
ERROR: /Volumes/development/projects/origin/src/k8s.io/kubernetes/federation/BUILD:37:1: null failed: sandbox-exec failed: error executing command /usr/bin/sandbox-exec -f /private/var/tmp/_bazel_clayton/5d0ba53608021b87fa9bd88a3bdcf100/bazel-sandbox/802524f6-ce4c-4cc2-a2f6-60dfef00aead-0/sandbox.sb ... (remaining 2 argument(s) skipped).
Traceback (most recent call last):
  File "/private/var/tmp/_bazel_clayton/5d0ba53608021b87fa9bd88a3bdcf100/bazel-sandbox/802524f6-ce4c-4cc2-a2f6-60dfef00aead-0/execroot/kubernetes/bazel-out/host/bin/external/bazel_tools/tools/build_defs/pkg/build_tar.runfiles/__main__/../bazel_tools/tools/build_defs/pkg/build_tar.py", line 180, in <module>
    main(FLAGS(sys.argv))
  File "/private/var/tmp/_bazel_clayton/5d0ba53608021b87fa9bd88a3bdcf100/bazel-sandbox/802524f6-ce4c-4cc2-a2f6-60dfef00aead-0/execroot/kubernetes/bazel-out/host/bin/external/bazel_tools/tools/build_defs/pkg/build_tar.runfiles/__main__/../bazel_tools/tools/build_defs/pkg/build_tar.py", line 169, in main
    output.add_file(inf, tof, mode)
  File "/private/var/tmp/_bazel_clayton/5d0ba53608021b87fa9bd88a3bdcf100/bazel-sandbox/802524f6-ce4c-4cc2-a2f6-60dfef00aead-0/execroot/kubernetes/bazel-out/host/bin/external/bazel_tools/tools/build_defs/pkg/build_tar.runfiles/__main__/../bazel_tools/tools/build_defs/pkg/build_tar.py", line 93, in add_file
    self.tarfile.add_file(dest, file_content=f, mode=mode)
  File "/private/var/tmp/_bazel_clayton/5d0ba53608021b87fa9bd88a3bdcf100/bazel-sandbox/802524f6-ce4c-4cc2-a2f6-60dfef00aead-0/execroot/kubernetes/bazel-out/host/bin/external/bazel_tools/tools/build_defs/pkg/build_tar.runfiles/bazel_tools/tools/build_defs/pkg/archive.py", line 269, in add_file
    with open(file_content, 'rb') as f:
IOError: [Errno 1] Operation not permitted: 'federation/deploy/config.json.sample'
INFO: Elapsed time: 136.311s, Critical Path: 2.44s

$ bazel version
Build label: 0.4.3-homebrew
Build target: bazel-out/local-opt/bin/src/main/java/com/google/devtools/build/lib/bazel/BazelServer_deploy.jar
Build time: Thu Dec 22 15:20:15 2016 (1482420015)
Build timestamp: 1482420015
Build timestamp as int: 1482420015
$ ls -al federation/deploy/config.json.sample
-rw-r--r--  1 clayton  staff  2004 Dec  1 12:19 federation/deploy/config.json.sample
$ id
uid=501(clayton) gid=20(staff) groups=20(staff),401(com.apple.sharepoint.group.1),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),33(_appstore),100(_lpoperator),204(_developer),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh)

I was unable to find a similar issue filed.

[smarterclayton]

@mikedanese as I mentioned

[mikedanese]

Looks like a bug in the sandboxer. I suspect this can be suboptimally worked around with bazel build --spawn_strategy=standalone and bazel test --spawn_strategy=standalone. @damienmg who is the mac sandbox expert?

cc @ixdy @spxtr

[smarterclayton]

Standalone indeed got me past this issue (filed a separate issue in Kube for a Mac only problem)

[breakds]

Confirmed that --spawn_strategy=standalone get me through the exactly same issue. My setup was:

1. Ubuntu 16.04 in an LXD container.
2. Bazel installed from apt repository.

[Nickersoft]

@damienmg @mikedanese I'm still getting this issue on Bazel 0.11.1 with macOS High Sierra over a year later. While this workaround does work, are there any plans to fix this issue permanently?

[meisterT]

Is this still an issue today?

[susinmotion]

I'm going to close this for lack of activity. Please comment if it's still present.