使用Bazel执行任意命令均报无帮助的‘Operation not permitted’错误

问题 #

执行任意Bazel命令时均会触发与Python库Scapy相关的权限错误：

执行bazel build <build_rule>时的错误： #

user@comp:~/Documents/Code/bazel/projects$ bazel build run_testcases
INFO: Analyzed target //projects:run_testcases (39 packages loaded, 303 targets configured).
INFO: Found 1 target...
ERROR: /home/user/Documents/Code/bazel/projects/BUILD:15:10: Creating runfiles tree bazel-out/k8-fastbuild/bin/projects/run_testcases.runfiles failed: build-runfiles failed: error executing command 
  (cd /home/user/.cache/bazel/_bazel_user/<hash>/execroot/__main__ && \
  exec env - \
    PATH=/home/user/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/lib/jvm/jdk1.8.0_202/bin:/home/user/bin:/home/user/bin \
  /home/user/.cache/bazel/_bazel_user/install/<hash>/build-runfiles --allow_relative bazel-out/k8-fastbuild/bin/projects/run_testcases.runfiles_manifest bazel-out/k8-fastbuild/bin/projects/run_testcases.runfiles): Process exited with status 1: Process exited with status 1
/home/user/.cache/bazel/_bazel_user/install/<hash>/build-runfiles (args bazel-out/k8-fastbuild/bin/projects/run_testcases.runfiles_manifest bazel-out/k8-fastbuild/bin/projects/run_testcases.runfiles): unlinking 'my_deps_scapy/site-packages/scapy/contrib/rtps/__pycache__/rtps.cpython-38.pyc': Permission denied [13]
Target //projects:run_testcases failed to build
Use --verbose_failures to see the command lines of failed build steps.
INFO: Elapsed time: 2.929s, Critical Path: 0.04s
INFO: 5 processes: 5 internal.
FAILED: Build did NOT complete successfully

执行bazel clean --expunge时的错误： #

user@comp:~/Documents/Code/bazel/projects$ bazel clean --expunge
INFO: Starting clean (this may take a while). Consider using --async if the clean takes more than several minutes.
ERROR: fchmod (/home/user/.cache/bazel/_bazel_user/<hash>/execroot/__main__/bazel-out/k8-fastbuild/bin/projects/run_testcases.runfiles/my_deps_scapy/site-packages/scapy/contrib/rtps/__pycache__) (Operation not permitted)

网上未找到同类问题解决方案，求解决思路。

解决思路 #

• 手动清理权限异常文件：直接定位到报错的__pycache__目录，用sudo权限强制删除：

  sudo rm -rf /home/user/.cache/bazel/_bazel_user/<hash>/execroot/__main__/bazel-out/k8-fastbuild/bin/projects/run_testcases.runfiles/my_deps_scapy/site-packages/scapy/contrib/rtps/__pycache__
  

  替换命令中的<hash>为实际路径中的哈希值。

• 修正Scapy依赖构建规则：如果通过rules_python或类似工具引入Scapy，检查依赖规则是否错误保留了__pycache__目录。可以在依赖配置中添加排除规则，避免将缓存文件打包进runfiles；或者尝试启用preserve_symlinks = True（部分场景适用）。

• 修复Bazel缓存目录权限：执行以下命令将缓存目录所有者改为当前用户，确保Bazel有完整操作权限：

  sudo chown -R $USER:$USER /home/user/.cache/bazel
  

• 重建Scapy依赖：删除Scapy的本地依赖缓存，重新拉取并构建。例如使用rules_python时，删除对应依赖的缓存目录后，重新运行依赖同步命令。

• 排查系统级权限限制：检查报错路径所在文件系统是否开启只读、noexec等限制；或关闭SELinux临时测试：

  sudo setenforce 0
  

  测试完成后恢复SELinux：

  sudo setenforce 1
  

内容的提问来源于stack exchange，提问作者stochasticlover1