diff mbox series

[v2,2/5] bitbake-worker: Call landlock_restrict_network for tasks without network

Message ID 20260914-landlock_try2-v2-2-0a1bad3579ec@est.tech
State New
Headers show
Series bitbake: Add basic landlock support | expand

Commit Message

David Nyström Sept. 14, 2026, 6:21 p.m. UTC 
Call bb.utils.landlock_restrict_network() for tasks without the 'network'
varflag. This to support basic network restrictions in unprivileged
docker containers.

Signed-off-by: David Nyström <david.nystrom@est.tech>
---
 bin/bitbake-worker | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/bin/bitbake-worker b/bin/bitbake-worker
index 208f512fd..50380201c 100755
--- a/bin/bitbake-worker
+++ b/bin/bitbake-worker
@@ -293,6 +293,7 @@  def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask):
                         bb.utils.disable_network(uid, gid)
                     else:
                         logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid))
+                    bb.utils.landlock_restrict_network()
 
                 # exported_vars() expands each value, so it must be called before
                 # empty_environment() below: an expansion that shells out needs the