macOS下构建MediaPipe人脸检测AAR时sandbox-exec链接错误

问题详情 #

在macOS上构建MediaPipe人脸检测模块的Android归档文件（.aar）时，链接face_detection_graph_text_to_binary_graph环节触发sandbox-exec错误，具体报错信息：

/Users/saurav/Documents/mediapipe/mediapipe/modules/face_detection/BUILD:99:26: Linking mediapipe/modules/face_detection/face_detection_graph_text_to_binary_graph [for tool] failed: (Exit 1): sandbox-exec failed: error executing command 
  (cd /private/var/tmp/_bazel_root/5bc38dea76c985b4052848234924bf2f/sandbox/darwin-sandbox/976/execroot/mediapipe && \
  exec env - \
    APPLE_SDK_PLATFORM=MacOSX \
    APPLE_SDK_VERSION_OVERRIDE=13.3 \
    DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer \
    PATH=/Library/Frameworks/Python.framework/Versions/3.11/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Library/Apple/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Users/saurav/Downloads/flutter/bin/flutter/bin:/Users/saurav/Downloads/flutter/bin:/Users/saurav/.pub-cache/bin \
    SDKROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX13.3.sdk \
    TMPDIR=/tmp \
    XCODE_VERSION_OVERRIDE=14.3.0.14E222b \
    ZERO_AR_DATE=1 \
  /usr/bin/sandbox-exec -f /private/var/tmp/_bazel_root/5bc38dea76c985b4052848234924bf2f/sandbox/darwin-sandbox/976/sandbox.sb /var/tmp/_bazel_root/install/f822566ff435ccaad75bcfd3b2719b0b/process-wrapper '--timeout=0' '--kill_delay=15' '--stats=/private/var/tmp/_bazel_root/5bc38dea76c985b4052848234924bf2f/sandbox/darwin-sandbox/976/stats.out' external/local_config_cc/cc_wrapper.sh @bazel-out/darwin-opt-exec-50AE0418/bin/mediapipe/modules/face_detection/face_detection_graph_text_to_binary_graph-2.params)

使用的BUILD文件：

load("//mediapipe/java/com/google/mediapipe:mediapipe_aar.bzl", "mediapipe_aar")

mediapipe_aar(
    name = "mediapipe_face_detection",
    calculators = ["//mediapipe/graphs/face_detection:mobile_calculators"],
)

执行的构建命令：

sudo bazel build -c opt --strip=ALWAYS \
        --host_crosstool_top=@bazel_tools//tools/cpp:toolchain \
        --fat_apk_cpu=arm64-v8a,armeabi-v7a \
        --legacy_whole_archive=0 \
        --features=-legacy_whole_archive \
        --copt=-fvisibility=hidden \
        --copt=-ffunction-sections \
        --copt=-fdata-sections \
        --copt=-fstack-protector \
        --copt=-Oz \
        --sandbox_debug \
        --copt=-fomit-frame-pointer \
        --copt=-DABSL_MIN_LOG_LEVEL=2 \
        --linkopt=-Wl,--gc-sections,--strip-all \
        //mediapipe/examples/android/aar_example:mediapipe_face_detection.aar

参考文档：MediaPipe框架Android归档库文档

解决方案 #

1. 禁用Bazel沙箱 #

macOS上的sandbox-exec错误多由Bazel沙箱机制与系统权限冲突导致，直接在构建命令中添加--sandbox_off参数绕过沙箱：

sudo bazel build -c opt --strip=ALWAYS \
        --host_crosstool_top=@bazel_tools//tools/cpp:toolchain \
        --fat_apk_cpu=arm64-v8a,armeabi-v7a \
        --legacy_whole_archive=0 \
        --features=-legacy_whole_archive \
        --copt=-fvisibility=hidden \
        --copt=-ffunction-sections \
        --copt=-fdata-sections \
        --copt=-fstack-protector \
        --copt=-Oz \
        --sandbox_off \
        --copt=-fomit-frame-pointer \
        --copt=-DABSL_MIN_LOG_LEVEL=2 \
        --linkopt=-Wl,--gc-sections,--strip-all \
        //mediapipe/examples/android/aar_example:mediapipe_face_detection.aar

2. 校验Xcode与SDK版本兼容性 #

当前使用Xcode 14.3.0 + MacOSX13.3 SDK，可尝试切换至Xcode 14.2版本（MediaPipe对该版本兼容性更稳定），同时确认DEVELOPER_DIR环境变量指向正确的Xcode安装路径。

3. 调整Bazel沙箱配置 #

在项目根目录的.bazelrc文件中添加以下配置，放宽沙箱路径限制：

build --macos_sandbox_debug
build --sandbox_writable_path=/tmp

4. 清理Bazel缓存 #

执行命令清除旧缓存，避免残留文件干扰构建：

bazel clean --expunge

之后重新执行构建命令即可。

内容的提问来源于stack exchange，提问作者Saurav Prakash