3 files changed, 19 insertions, 4 deletions
diff --git a/pkgs/development/compilers/rust/binaryBuild.nix b/pkgs/development/compilers/rust/binaryBuild.nix
index 37b06555bdb..cbe92df814c 100644
--- a/pkgs/development/compilers/rust/binaryBuild.nix
+++ b/pkgs/development/compilers/rust/binaryBuild.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, cacert, zlib, buildRustPackage, curl
+{ stdenv, fetchurl, makeWrapper, cacert, zlib, buildRustPackage, curl, darwin
 , version
 , src
 , platform
@@ -36,6 +36,8 @@ rec {
 
     phases = ["unpackPhase" "installPhase"];
 
+    propagatedBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+
     installPhase = ''
       ./install.sh --prefix=$out \
         --components=${installComponents}
@@ -49,6 +51,11 @@ rec {
           --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/cargo"
       ''}
+      ${optionalString (stdenv.isDarwin && bootstrapping) ''
+        install_name_tool -change /usr/lib/libiconv.2.dylib '${darwin.libiconv}/lib/libiconv.2.dylib' "$out/bin/cargo"
+        install_name_tool -change /usr/lib/libcurl.4.dylib '${stdenv.lib.getLib curl}/lib/libcurl.4.dylib' "$out/bin/cargo"
+        install_name_tool -change /usr/lib/libz.1.dylib '${stdenv.lib.getLib zlib}/lib/libz.1.dylib' "$out/bin/cargo"
+      ''}
 
       ${optionalString needsPatchelf ''
         patchelf \
diff --git a/pkgs/development/compilers/rust/bootstrap.nix b/pkgs/development/compilers/rust/bootstrap.nix
index fbcac09fc45..d9aa3f757a4 100644
--- a/pkgs/development/compilers/rust/bootstrap.nix
+++ b/pkgs/development/compilers/rust/bootstrap.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, cacert, zlib, curl }:
+{ stdenv, fetchurl, makeWrapper, cacert, zlib, curl, darwin }:
 
 let
   # Note: the version MUST be one version prior to the version we're
@@ -30,7 +30,7 @@ let
   };
 
 in import ./binaryBuild.nix
-  { inherit stdenv fetchurl makeWrapper cacert zlib curl;
+  { inherit stdenv fetchurl makeWrapper cacert zlib curl darwin;
     buildRustPackage = null;
     inherit version src platform;
     versionType = "bootstrap";
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 9f96d05c116..4d92566edd4 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 
   inherit src;
 
-  __impureHostDeps = [ "/usr/lib/libedit.3.dylib" ];
+  __darwinAllowLocalNetworking = true;
 
   NIX_LDFLAGS = optionalString stdenv.isDarwin "-rpath ${llvmShared}/lib";
 
@@ -109,6 +109,14 @@ stdenv.mkDerivation {
     # Disable all lldb tests.
     # error: Can't run LLDB test because LLDB's python path is not set
     rm -vr src/test/debuginfo/*
+
+    # Disable tests that fail when sandboxing is enabled.
+    substituteInPlace src/libstd/sys/unix/ext/net.rs \
+        --replace '#[test]' '#[test] #[ignore]'
+    substituteInPlace src/test/run-pass/env-home-dir.rs \
+        --replace 'home_dir().is_some()' true
+    rm -v src/test/run-pass/fds-are-cloexec.rs  # FIXME: pipes?
+    rm -v src/test/run-pass/sync-send-in-std.rs  # FIXME: ???
   '';
 
   preConfigure = ''