From patchwork Mon Sep 14 18:42:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98210 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E00DCC88E73 for ; Mon, 14 Sep 2026 18:43:10 +0000 (UTC) Received: from GVXPR05CU001.outbound.protection.outlook.com (GVXPR05CU001.outbound.protection.outlook.com [52.101.83.64]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5048.1789411388407126520 for ; Mon, 14 Sep 2026 11:43:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@est.tech header.s=selector1 header.b=obfDWote; spf=pass (domain: est.tech, ip: 52.101.83.64, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NpyBl2xKXULKbwfjhiCqCmM2Kp38FjDyGKYozSig3EhxciV6JgyYeiQUE7Kz0Fzs5nN7ptqf7EmOraWu3M7Q6iGwLeNgN1desAIyflx+CwDMETwqZUZXsiTbs/WIgUrp5X7yCHNirqEXFLH68o9smIoau9Pzo+tLudw0Fs3l7MPVa3PzN67nx92NH1We8GBgEgEfyNA9ScLeoU8vYijdGKOkRY0gs8mII2GmBdqeKgCN7nuIu7RdiIGsis6FmVG01tphzKV0jJrnE+qnA8bRlH5nKlou4npa6HklON6eva2S8HF1BbmjI5bkRcXDKZoquzdm56QDFkz7q37eBrGjtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=//SC/l5gOO8vmiLZ6qujTqe+inm6GaJasOoE9xKREoc=; b=ZyohqGLdvzi9eCYC8k1i+NGMQVgcoxxzCZH/UMFcbr2tN+murMk7MCljmEzKBy5nMbpBGGluO66rL0axQjeV1fsFoEX0q5fKqhH3TLvjptjABmFmjbGuvqmvogY1rPQMJdx/Hl3r4FpDRGOZ68/IA5ayZwN/ZqT0oUp/Ua6cfE0J5vNHkuzfSq4EBqvwefkF1K0SXemBTeP69gVxEH0LFhBlBGAUbfztlhzkqvVhItUXJ5f4K5chHNM7zfmTge9+aHCJyUyCvYRaijhlsn2o4QGaK+ra8xD7iNMU1FuWZ+9qHW9nAwARkyhwJ0/3b6eCxZoYBxIdgRGFd+SIXuRnQg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=//SC/l5gOO8vmiLZ6qujTqe+inm6GaJasOoE9xKREoc=; b=obfDWoteVNOVEGHMEBIKL/zJt2sr2qhBApT4ErM9pleLl5PUzdrslLsG7AWpIatnDf6GSCSx1nrwmg4acRWRv9OjJDPyUFMAxkBNeKStsZOVE1wRv3eAFqLX/5oZ6wqjY9apHfp+WuXq2IxhUlq2+wNAqg/7R6OXg3dDj9ffHwB7U2h1WHm7eZGjhP78bTlcbKyZfQPl5LZFpTkvG/go50ibUGOCBD719zOPs3VbP3IhGpfLxSKBYNUKXr9HP2z7L0kgpf+VxzNBMkLmoKbmrHEHSICJyXWkS78D6Wn7pRYoZWLMWNp4FFeyEpf1jRcNqEWHOZhkqxN0JT4+jXDX+Q== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by DB9P189MB2051.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:393::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:43:04 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:43:04 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:42:25 +0200 Subject: [PATCH v3 4/5] bitbake-worker: Allow tasks to disable Landlock restrictions Message-Id: <20260914-landlock_try2-v3-4-4ea504789675@est.tech> References: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> In-Reply-To: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> To: bitbake-devel@lists.openembedded.org Cc: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789411368; l=1230; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=ef0X2Wg2ArQRvqZ0GTthttmsbUtOMkPGiAU0GNdi7kA=; b=cFPhFtBOT/IkrDheqayx4QpQqg29nVryOzuN2OA4XCBSZlpAGS7h7kdv9FFK6Ts6q/+r8n9D4 E19LjcGtV3/CMViJh52si9mZJ9ruoPo9UFngf+dgtLRUZYy8heRgbAG X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GV3PEPF0001DBB2.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:401::6e9) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|DB9P189MB2051:EE_ X-MS-Office365-Filtering-Correlation-Id: 2349d889-b1e4-4f76-15eb-08df129002a8 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|376014|23010399003|1800799024|11063799006|56012099006|10067099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: mZCSZwytgzE1Uf2AwM2tZ88UQpZ8YSxxUZxVjbNakg81qWcb4brQy/nF+SyYtwR8FlY4uANsvPHujHYKnhvZ6NaTtyHlwaufL5m+QuP0nyb3SYhe67LCywsq8+wP2mABWoDOpmL3z41wCuyn5Rck7ZlujVHt8TyItfyF0Wrks1UVks3p8E2MsSboox2bu/XFK8wUXBIn8UKi3K7kMMq1cNpwV8s+ub9CQU7jLRyWnk5EFHvxo1dnhAZqAYwbeIFO3bwPSgmLGAljwMqUPuH+AwyUU6C5/Hdd56amn8dlSfvzv2qOnDqTw82vHCo5EsNSTPnpcZGV9ewVvpLeR8KIGfDGhTWQ8NoyuzqwNmqqhadk3OthORIQ7IxS47Dl2b92Ch4iZAK0VJxiw2Rp++5GWtwizE4PkQjoR3dKIWut4uXWz9mvkowXIs22+ZUIbjVP5jxBPKRxt8JBI//Klzru32Jb4P/HoYnC2YIg14OuhyjmWq9BxFj4hUvYZiaUBOrVHf+p9a6vR8Dy4GSM4Hj05ImAGzeVKsHBX8+IBStD8Qm+bNl5uQM221wCIOPOuCF2EN94jj14cNlItDhPOwU8mfRadlPlXwXizst8oOD7Sslxj29oVqVwzNIbnDN+ywWZK85s7YCx+8qemw5SwNh2ISmbiheyBGAe5Nb3e8gu9po= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(376014)(23010399003)(1800799024)(11063799006)(56012099006)(10067099003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?pX3mBjTX0lqHbUtLTlJrm6fzOE2B?= =?utf-8?q?m/6NnIjP7BDeYl/C64njvlQov3aJFQTVMgGoic4bCBRdGMxJy4MTDxerGizous9W2?= =?utf-8?q?aN2CsgQI5MruAQ5p72lBUkHacKVdJVBxYV6DkjUml73Lq/lnudLGxg2ePT2YmeGgG?= =?utf-8?q?k/L801Km6C/LNVhZXjJ5M5lLU2d616HYWC0k0Y6nsTxJKb8YlmZS6WpjbMEFx45Fy?= =?utf-8?q?cXVdoVRCMzi0qBfQmx6+/UcTKlz71SOEeHWn3iNwB4VpH60zmKl5rHXtGHzH5mI0U?= =?utf-8?q?puqgbBmvlnp16mJ/zVQ0kL4DGgpCuF3R0JNOxbZ0FW+NRuCiHqy9xTd6sIWvrNsz0?= =?utf-8?q?xcut/XJIlnFhh9OBSS2LiDJ0A86A7HT28YshTHE7Jjls2nQm2zpiSOrKKrV65DA18?= =?utf-8?q?HsoLdjMxQlRxYzFVIgIrd5L1YUeBF7DnSRSD6IFW3DNoULRJR9tKLhACwGv271vqD?= =?utf-8?q?ZKTYOiL7oCeSybw+nGzQoTg/1Hy7IaK7LwjmaSpkM7VHbr2YJotig9S80QZx3bvsD?= =?utf-8?q?9kiSQMeCRdg3d3kq6YViByCzopJUv0xOoTfQbOg5JBkTTh/l4j+X7H+HraAPcMSxs?= =?utf-8?q?QZp+T19YO5yfTNF0ZXXi9la4+gG6cEyvfH3l3l6Br0xQ1Pd7FCKNPzjFRavyyb+Qv?= =?utf-8?q?iU/GQpc2v6pJOcMF826vsJMpipo6mHsQ05j9k7wuMjhGx8/SOqjakDNLRhoDWsHNW?= =?utf-8?q?L24X4Cn4Qrn4chRHfhX1gfstMXLgdCjJl0kW9VRY46fU5BKwO16zZlcGof/q7hcHi?= =?utf-8?q?FhXde8wxAjG209W3+4z6wCMDbErX4UTaWh+2A5hstnwLXaIFRxY6pp/UZLW02MZau?= =?utf-8?q?8be8LNjpTaPgJEGieEOS4OfNvDfQ81E5s90ydAAwrdzvrvGtt6yOYnCpZwNlTFQE4?= =?utf-8?q?ijjxESOx6JGp//+0/ty40tBVC1po0f2zllTEPkXJoaHuL9I3yeLLvenv5qUpmkTQ+?= =?utf-8?q?gyVNvREFqQCd4x5/IsxYH3zKMdaPIn8DgHlh3HaFW/PuMO4F8akzcWIXYNBo0EPgD?= =?utf-8?q?1zjAK/NBEb4rmyCgVZEjHhV3JR5i7CA+7iiaBsh1eI5dyK4K9clkeR7+r6tHcgwsj?= =?utf-8?q?jPJwyOT4+XdGygdrxYxjJ08TERd7Cg3xysZKSwKoZfpaRgbO10C2ft0Jd7hmrjz2J?= =?utf-8?q?jsv+PQjgsWXJufLO7Br/eAcRuuOWlQxT6ptug4XtKm6dpKWtxmbKqO04IjnqoSOr9?= =?utf-8?q?qxzmbWzQwlJ8fh/LHb/ZCuGQga/pFAyxUE2/PTW2j3LsmoOeJaoibRXdMTjgu+Fe/?= =?utf-8?q?fVarGKljNymt3bDLyvsFxk11Rqs8BTuO70bbwtXsCImc2Kxii5FU86yq1cZqsRh9a?= =?utf-8?q?icPl2F+VfeYW4C3v9zBsOyTlt7RTS3BLJxhSFQeK033uMPy1mcSO5xK3l0MHbWn+a?= =?utf-8?q?DzujLi0sNdjD42/Bs1EOdX7HXX2ePGMQGXKXx7EhSSxdA5W7lvSyhGnGcNFVslw/G?= =?utf-8?q?NwloRDS+h7IEcwicAeV1Mi3TVHw8dQF/EetRVvBkAqhjAiUFDK8OeS61jru9qbASq?= =?utf-8?q?sYkIoxp1COyanTCFNcsy7BGRV/0O7TSd/XCHPU+bZVe0lV+lH2YVfwn8tsg4HoAWr?= =?utf-8?q?o/9qZCBOF6/CPovjsZnTq+JE538mtR3WXT6drPVRg75AVFCxF636OM7zRI6ZXq7oY?= =?utf-8?q?L1SowkfYZ15bvA2tWmHvhQxfW2jGt7NG0hSPgixvNDyW2a6NGpLM2deucKNxH2MDb?= =?utf-8?q?7KHWvZ8bPMCuOCmi6?= X-MS-Exchange-AntiSpam-MessageData-1: RjqVQjHP7xHfYzmm/lXrKGrTlcQpXJlAmxI= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 2349d889-b1e4-4f76-15eb-08df129002a8 X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:43:03.9853 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: XN7e7H+8cNNy9wO15/XDPcCXVSFkTnorCwXt2bfBTV80q9+qsticIVl+v7Fzp+4Beyol5cfknM4fMzKGMBKD7g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 18:43:10 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/docs/message/10512 Honor a landlock-disable task varflag so individual tasks can opt out when PR_SET_NO_NEW_PRIVS is incompatible with their operation. Network namespace isolation remains enabled when available. AI-Generated: gpt-sol-5.6 Signed-off-by: David Nystrom --- bin/bitbake-worker | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bin/bitbake-worker b/bin/bitbake-worker index 50380201c..9a744ce56 100755 --- a/bin/bitbake-worker +++ b/bin/bitbake-worker @@ -293,7 +293,8 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask): bb.utils.disable_network(uid, gid) else: logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid)) - bb.utils.landlock_restrict_network() + if not bb.utils.to_boolean(the_data.getVarFlag(taskname, 'landlock-disable')): + bb.utils.landlock_restrict_network() # exported_vars() expands each value, so it must be called before # empty_environment() below: an expansion that shells out needs the