| Message ID | 20260612-landlock-v1-2-77891f63ed7f@est.tech |
|---|---|
| State | New |
| Headers | show |
| Series | [[RFC] 2/2] bitbake-worker: Call landlock_restrict_network for tasks without network | expand |
On Fri, 2026-06-12 at 13:38 +0200, David Nyström wrote: > Call bb.utils.landlock_restrict_network() for tasks without the 'network' > varflag. This to support basic network restrictions in unprivileged > docker containers. > > Signed-off-by: David Nyström <david.nystrom@est.tech> > --- > bin/bitbake-worker | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/bin/bitbake-worker b/bin/bitbake-worker > index aa14ef191..5f3fd9933 100755 > --- a/bin/bitbake-worker > +++ b/bin/bitbake-worker > @@ -287,6 +287,8 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask): > bb.utils.disable_network(uid, gid) > else: > logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid)) > + if not bb.utils.landlock_restrict_network(): > + logger.debug("Skipping Landlock network restriction for %s since kernel lacks ABI v4+ support." % taskname) In disable_network, the logger.debug() calls for failure are handled within the function instead of by the caller. We should do the same for landlock_restrict_network() as suggested in my reply to patch 1/2 and drop the debug print from here. > > # exported_vars() returns a generator which *cannot* be passed to os.environ.update() > # successfully. We also need to unset anything from the environment which shouldn't be there Best regards,
diff --git a/bin/bitbake-worker b/bin/bitbake-worker index aa14ef191..5f3fd9933 100755 --- a/bin/bitbake-worker +++ b/bin/bitbake-worker @@ -287,6 +287,8 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask): bb.utils.disable_network(uid, gid) else: logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid)) + if not bb.utils.landlock_restrict_network(): + logger.debug("Skipping Landlock network restriction for %s since kernel lacks ABI v4+ support." % taskname) # exported_vars() returns a generator which *cannot* be passed to os.environ.update() # successfully. We also need to unset anything from the environment which shouldn't be there
Call bb.utils.landlock_restrict_network() for tasks without the 'network' varflag. This to support basic network restrictions in unprivileged docker containers. Signed-off-by: David Nyström <david.nystrom@est.tech> --- bin/bitbake-worker | 2 ++ 1 file changed, 2 insertions(+)