diff mbox series

[v3,4/5] bitbake-worker: Allow tasks to disable Landlock restrictions

Message ID 20260914-landlock_try2-v3-4-4ea504789675@est.tech
State New
Headers show
Series bitbake: Add basic landlock support | expand

Commit Message

David Nyström Sept. 14, 2026, 6:42 p.m. UTC 
Honor a landlock-disable task varflag so individual tasks can
opt out when PR_SET_NO_NEW_PRIVS is incompatible with their
operation.
Network namespace isolation remains enabled when available.

AI-Generated: gpt-sol-5.6
Signed-off-by: David Nystrom <david.nystrom@est.tech>
---
 bin/bitbake-worker | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/bin/bitbake-worker b/bin/bitbake-worker
index 50380201c..9a744ce56 100755
--- a/bin/bitbake-worker
+++ b/bin/bitbake-worker
@@ -293,7 +293,8 @@  def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask):
                         bb.utils.disable_network(uid, gid)
                     else:
                         logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid))
-                    bb.utils.landlock_restrict_network()
+                    if not bb.utils.to_boolean(the_data.getVarFlag(taskname, 'landlock-disable')):
+                        bb.utils.landlock_restrict_network()
 
                 # exported_vars() expands each value, so it must be called before
                 # empty_environment() below: an expansion that shells out needs the