From 0fe12bef5aef292ea4703443225bd84ab44f833f Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Mon, 6 Jul 2026 22:02:00 +0800
Subject: [PATCH] fix(nix): preserve default sandbox shell

Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.

Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.

Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
---
 modules/nixos/base/nix.nix                             | 10 +++++++++-
 .../tests/nix-system-features/expected.nix             |  3 ++-
 .../aarch64-linux/tests/nix-system-features/expr.nix   |  3 ++-
 .../tests/nix-system-features/expected.nix             |  3 ++-
 .../x86_64-linux/tests/nix-system-features/expr.nix    |  3 ++-
 5 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/modules/nixos/base/nix.nix b/modules/nixos/base/nix.nix
index 3c770733..35af9390 100644
--- a/modules/nixos/base/nix.nix
+++ b/modules/nixos/base/nix.nix
@@ -31,7 +31,15 @@
       "auto-allocate-uids"
       "cgroups"
     ];
-    sandbox-paths = [ "/dev/net" ];
+    # Use extra-sandbox-paths instead of sandbox-paths here. The plain
+    # sandbox-paths setting replaces Nix's compiled sandbox defaults, including
+    # the sandbox shell that provides /bin/sh for builders with legacy shebangs.
+    # extra-sandbox-paths keeps those defaults and only adds the paths we need.
+    # After deploying, verify the effective daemon config with:
+    #   nix config show | grep sandbox-paths
+    extra-sandbox-paths = [
+      "/dev/net"
+    ];
   };
 
   nix.channel.enable = false; # remove nix-channel related tools & configs, we use flakes instead.
diff --git a/outputs/aarch64-linux/tests/nix-system-features/expected.nix b/outputs/aarch64-linux/tests/nix-system-features/expected.nix
index 36454a33..8fe3ed9d 100644
--- a/outputs/aarch64-linux/tests/nix-system-features/expected.nix
+++ b/outputs/aarch64-linux/tests/nix-system-features/expected.nix
@@ -7,5 +7,6 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
   hasUidRange = true;
   hasAutoAllocateUidsFeature = true;
   hasCgroupsFeature = true;
-  hasDevNetSandboxPath = true;
+  hasNoExplicitSandboxPaths = true;
+  hasDevNetExtraSandboxPath = true;
 })
diff --git a/outputs/aarch64-linux/tests/nix-system-features/expr.nix b/outputs/aarch64-linux/tests/nix-system-features/expr.nix
index c21138c3..241628dc 100644
--- a/outputs/aarch64-linux/tests/nix-system-features/expr.nix
+++ b/outputs/aarch64-linux/tests/nix-system-features/expr.nix
@@ -16,6 +16,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
       settings.experimental-features or [ ]
     );
     hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
-    hasDevNetSandboxPath = builtins.elem "/dev/net" (settings.sandbox-paths or [ ]);
+    hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
+    hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
   }
 )
diff --git a/outputs/x86_64-linux/tests/nix-system-features/expected.nix b/outputs/x86_64-linux/tests/nix-system-features/expected.nix
index 36454a33..8fe3ed9d 100644
--- a/outputs/x86_64-linux/tests/nix-system-features/expected.nix
+++ b/outputs/x86_64-linux/tests/nix-system-features/expected.nix
@@ -7,5 +7,6 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
   hasUidRange = true;
   hasAutoAllocateUidsFeature = true;
   hasCgroupsFeature = true;
-  hasDevNetSandboxPath = true;
+  hasNoExplicitSandboxPaths = true;
+  hasDevNetExtraSandboxPath = true;
 })
diff --git a/outputs/x86_64-linux/tests/nix-system-features/expr.nix b/outputs/x86_64-linux/tests/nix-system-features/expr.nix
index c21138c3..241628dc 100644
--- a/outputs/x86_64-linux/tests/nix-system-features/expr.nix
+++ b/outputs/x86_64-linux/tests/nix-system-features/expr.nix
@@ -16,6 +16,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
       settings.experimental-features or [ ]
     );
     hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
-    hasDevNetSandboxPath = builtins.elem "/dev/net" (settings.sandbox-paths or [ ]);
+    hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
+    hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
   }
 )