Sandboxing/Firewall issue with latest version (4.1.1) on Apple Silicon

[milljm]

I want to state up front that I have a solution to this issue, included in the post.

I am posting in the hopes of understanding "why" this might be happening, when it wasn't before, with an older version of MPICH (4.0.2).

The setup:

MacOS Ventura; Apple Silicon (M1 Pro, and M2 Max). MPICH 4.1.1 (conda-forge).

I am using Macintosh's sandbox-exec tool to block outgoing connections (our continuous integration machines are locked down as much as possible).

[Edit]: To add to the strangeness, Linux and Intel based Macintosh machines are fine. This only seems to occur on Apple Silicon machines. Not the case. Intel Macs exhibit same issue. Linux is not applicative.

Example output:

$ mpiexec -f machinefile -n 2 ./a.out
<output trimmed>

Abort(864123407): Fatal error in internal_Finalize: Other MPI error, error stack:
internal_Finalize(50)...........: MPI_Finalize failed
MPII_Finalize(400)..............: 
MPID_Finalize(652)..............: 
MPIDI_OFI_mpi_finalize_hook(830): 
flush_send_queue(780)...........: 

Where machinefile's contents is:

127.0.0.1

And the Sandbox log if it helps:

Sandbox: a.out(63681) deny(1) network-outbound remote:*:65432
Sandbox: a.out(63680) deny(1) network-outbound remote:*:65433

Note: a.out actually runs to completion. Solves problems correctly. But the above error is appended when finished.

I am sorry I do not have sample source which reproduces the issue. Every MPI example I've compiled runs fine. So this is not strictly an MPICH issue. I am at a loss as to why I might suddenly run into this, when the only observed change is moving from MPICH version 4.0.2 to 4.1.1.

Apologies again for lack of sample source code to reproduce the issue. However, the project in question is Open Source if someone wants/needs to dig further.

Solution

And if anyone else runs into this, my solution is to include a new Sandbox allow rule, as follows:

(allow network-outbound (remote tcp "localhost:*"))

To my untrained network eyes, I am allowing what the system believes to be an outbound connection, originating on not the loopback device, back into localhost, on any port. When there are already rules set up to allow localhost to localhost communications.

Also, setting MPIEXEC_PORT_RANGE and MPICH_PORT_RANGE did not affect the Sandbox log. That is to say, if I set the following port ranges; 3000:4000, I would still see the Sandbox log complain about *:50000-60000 ports being attempted (and blocked).

Cheers! 🍻