Unable to deploy example NDK app to Android 9: 'remote secure_mkdirs failed: Operation not permitted'

[jgavris]

I'm running bazel 0.17.1, android NDK r17b. When I try to deploy to an Android 9 device I get:

jgavris in ~/code/examples/android/ndk on master
λ bazel mobile-install //app/src/main:app --fat_apk_cpu=arm64-v8a --start_app
INFO: Analysed target //app/src/main:app (0 packages loaded).
INFO: Found 1 target...
ERROR: /Users/jgavris/code/examples/android/ndk/app/src/main/BUILD.bazel:21:1: Installing //app/src/main:app failed (Exit 1)
Error:
adb command: ['external/androidsdk/platform-tools/adb', 'push', '/var/folders/q4/yjz6lvkj5hgg3tw1802g76zh0000gn/T/tmpIsCjcL/adbfile_4', u'/data/local/tmp/incrementaldeployment/com.example.android.bazel/native/native_manifest']
return code: 1
stdout: [   ?] /data/local/tmp/incrementaldeployment/com.example.android.bazel/native/native_manifest: 0/?
adb: error: failed to copy '/var/folders/q4/yjz6lvkj5hgg3tw1802g76zh0000gn/T/tmpIsCjcL/adbfile_4' to '/data/local/tmp/incrementaldeployment/com.example.android.bazel/native/native_manifest': remote secure_mkdirs failed: Operation not permitted
/var/folders/q4/yjz6lvkj5hgg3tw1802g76zh0000gn/T/tmpIsCjcL/adbfile_4: 0 files pushed.
stderr:
Updating 1 dex...
Updating application resources...
Updating 0 native libs...
Target //app/src/main:app failed to build
Use --verbose_failures to see the command lines of failed build steps.
INFO: Elapsed time: 1.691s, Critical Path: 1.37s
INFO: 0 processes.
FAILED: Build did NOT complete successfully
jgavris in ~/code/examples/android/ndk on master
λ bazel info
bazel-bin: /private/var/tmp/_bazel_jgavris/a529821f4856b67750ce7a4f6d160c6a/execroot/__main__/bazel-out/darwin-fastbuild/bin
bazel-genfiles: /private/var/tmp/_bazel_jgavris/a529821f4856b67750ce7a4f6d160c6a/execroot/__main__/bazel-out/darwin-fastbuild/genfiles
bazel-testlogs: /private/var/tmp/_bazel_jgavris/a529821f4856b67750ce7a4f6d160c6a/execroot/__main__/bazel-out/darwin-fastbuild/testlogs
character-encoding: file.encoding = ISO-8859-1, defaultCharset = ISO-8859-1
command_log: /private/var/tmp/_bazel_jgavris/a529821f4856b67750ce7a4f6d160c6a/command.log
committed-heap-size: 888MB
execution_root: /private/var/tmp/_bazel_jgavris/a529821f4856b67750ce7a4f6d160c6a/execroot/__main__
gc-count: 17
gc-time: 1010ms
install_base: /var/tmp/_bazel_jgavris/install/79d9f22886570ca416e6ffca28ab7725
java-home: /private/var/tmp/_bazel_jgavris/install/79d9f22886570ca416e6ffca28ab7725/_embedded_binaries/embedded_tools/jdk
java-runtime: OpenJDK Runtime Environment (build 9.0.7.1+1) by Azul Systems, Inc.
java-vm: OpenJDK 64-Bit Server VM (build 9.0.7.1+1, mixed mode) by Azul Systems, Inc.
max-heap-size: 3817MB
output_base: /private/var/tmp/_bazel_jgavris/a529821f4856b67750ce7a4f6d160c6a
output_path: /private/var/tmp/_bazel_jgavris/a529821f4856b67750ce7a4f6d160c6a/execroot/__main__/bazel-out
package_path: %workspace%
release: release 0.17.1
repository_cache: /var/tmp/_bazel_jgavris/cache/repos/v1
server_pid: 48463
used-heap-size: 148MB
workspace: /Users/jgavris/code/examples/android/ndk

@jin ?

[jin]

Does regular adb install work? Looks like adb push under Bazel doesn't have the correct permissions.

As an aside and mentioned in the Slack chat, we’re in the process of open sourcing mobile-install v2. It’s a complete rewrite of mobile-install in Starlark, and thereafter we will deprecate the native mobile-install in Bazel. AFAIUC, mi-v2 will solve this issue.

[pandasyr]

I had this happen before and for me it was because the apk signature mismatch (because I switched computer), which was solved by uninstalling the old apk.

[jgavris]

A regular install works, yes. That's what we're using in Android Studio.

[jin]

Update: I managed to repro the issue and found the root cause.

Somewhere between 28 and 29, when creating directories as part of adb push, the behavior changed w.r.t. directory permissions.

On 28, the created directories via adb push have the permissions drwxrwxr-x.
On 29, the permissions are drwxrwx--x. The difference is the read permission for others. For some reason, this causes the adb push to fail.

It turns out that inserting a adb shell mkdir -p /data/local/tmp/incrementaldeployment/com.example.android.bazel/native/ before pushing the files creates the directory with the correct permissions, and native_manifest can be pushed correctly.