mbox series

[v3,0/5] bitbake: Add basic landlock support

Message ID 20260914-landlock_try2-v3-0-4ea504789675@est.tech
Headers show
Series bitbake: Add basic landlock support | expand

Message

David Nyström Sept. 14, 2026, 6:42 p.m. UTC 
When current implementation runs in an unprivileged docker container,
basic networking will be allowed by default in all steps, ignoring the
network varflags intention.
Introduce support for landlock blocking of bind and connect, providing
basic support for blocking TCP.
UDP is corrently beeing worked on upstream, but not yet supported.

Landlock requires PR_SET_NO_NEW_PRIVS for unpriv usage, 
which is also attempted. devshell and related are already tagged 
with network varflag and can sudo at will.

This changes the default task behaviour to set no_new_privs, and 
the 'network' varflag to exclude no_new_privs, which is needed
in a few places, like do_testimage.

syscall ABI is asm-generic, 6.7+ for all archs except alpha.
On alpha, we leak 2 fd:s in the childs context before graceful exit,
which is cleaned up at child termination.
x32, MIPS(except LoongSoon) will fail gracefully.
Don't have an alpha target, so this is not tested, evaluated via 
static analysis only.

Adding Bruce to CC, due to fusermount usage in vrunner.
There might be fallout in other sublayers as well, 
give me a CC and I'll try to help out.

Adding Peter and Mattias for awareness, since they seem to be 
users of enable_loopback_networking

Signed-off-by: David Nyström <david.nystrom@est.tech>
---
Changes in v3:
- Missing Signoff on last 2 patches.
- Link to v2: https://patch.msgid.link/20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech

Changes in v2:
- Make no_new_privs unconditional to linux version
- Add landlock-disable varflag, and document it.
- Addressed review comments from Paul regarding constant naming.
- Link to v1: https://lore.kernel.org/r/20260612-landlock-v1-0-77891f63ed7f@est.tech

To: bitbake-devel@lists.openembedded.org
Cc: docs@lists.yoctoproject.org
Cc: bruce.ashfield@gmail.com
Cc: mattias.jernberg@axis.com
Cc: peter.kjellerstedt@axis.com

Signed-off-by: David Nyström <david.nystrom@est.tech>

---
David Nyström (5):
      utils: Add landlock_restrict_network function
      bitbake-worker: Call landlock_restrict_network for tasks without network
      doc: bitbake-user-manual-metadata: Doc change in default behaviour
      bitbake-worker: Allow tasks to disable Landlock restrictions
      doc: Document the landlock-disable task varflag

 bin/bitbake-worker                                 |  2 ++
 .../bitbake-user-manual-metadata.rst               |  8 +++++
 lib/bb/utils.py                                    | 38 ++++++++++++++++++++++
 3 files changed, 48 insertions(+)
---
base-commit: 046a90b0e9b7b914b7a95aec579cdc3fc9c7617a
change-id: 20260910-landlock_try2-794b370dc4ed

Best regards,
--  
David Nyström <david.nystrom@est.tech>