From patchwork Mon Sep 14 18:42:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98209 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4783C88E72 for ; Mon, 14 Sep 2026 18:43:00 +0000 (UTC) Received: from MRWPR03CU001.outbound.protection.outlook.com (MRWPR03CU001.outbound.protection.outlook.com [40.107.130.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4862.1789411375916366586 for ; Mon, 14 Sep 2026 11:42:57 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=VXRT4Puz; spf=pass (domain: est.tech, ip: 40.107.130.43, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=XdJWMPYeXe3LZg0AUAqFNOkOoEmuGSxoAGJz6lz5TRRr/4+W94MkTyuAOJCZbZeIMgiuhooyckN6aA2m5Kl1hlIiPKV3dTw+XosWba6T3zwv0P/v0Jn9eR/V2w+vZ8hyxP+iDElBMPKDC2fJmr0jQhOcGM84ZnhpWgexbcJFd8b0ayTvkUFU4pUOBVjuTetgPuKn17m6lSAFenrFY8TtSWcS/lOPG+/jg9/gQP71J+e8vahBuW8NBfC1wOtOKq5CCHVeO+brzj1fL9CHEdYjq/uxWw5lNWDgWxjOrr03FyQxnHvJw0rjpJN/YysQzxQ77mnKv9mVYFsuqiGdm77veg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=YhPomrdGvIyDh013Cf2KMmhSp27skPjvKFWZZiRnBNQ=; b=nY98b1CMf8j3Q63hH7BJorEoYVmCWKdvz2OQE9FQQosvyXuKLhbjFBQF6cXxOYAKkKE0CothAP/TbNcwUMIiJib0lJlhPfF1OeHOP1sPlwchNvTMjh4SRwoiBZYmeS8wVlgcIW1vXSZ3/AXS3J5vf2bHhWy6tA69e10umAM1xi4TkV93LcIUOk8QklK+rw8EGADk3amTiLtbAqW0M2kcllL5fhPGEIy41/i8Vo3hS1AX4ddR+yAzrNoniR+lXccwaNgx15PPGFt2kXOKgbajGTmXfP9ZeWV+J31xtBQxgcu+ZwzzzoxpKzplh2TPCu//EvLGItLsKgrGHjRXY0Q+0g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YhPomrdGvIyDh013Cf2KMmhSp27skPjvKFWZZiRnBNQ=; b=VXRT4PuzMw1qGHNI7iA+0Ztr1ydCgoZzEhzrDiPm9TIIP+BXtgrMA3Vs+E/LT7Krwl0k0sIh5HvhEIrgr43sptvenKWPawp/9SeclhyuJMg+Srz0eWwLl2i7VbPsF5Ugt+n9gHVXtocy9YXMOtKIu7dqW6eXg1haf2SHmqnmXDRC5Z/8F1r7knEC80DdasxSkNyUwTPdp3HCzBYrq5zKYJrm/z5+3+jPg5EVLOLwo+g5ujnfas7BJEmL44Y8uQZJsxMO9GY2P/a7QaGP/x8x0piZU+nzJCvq5FSA0pqGDreYu43JGvARkTe64QamX2k94i26uGbxkKJ9IEXYodwACQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by DB9P189MB2051.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:393::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:42:54 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:42:54 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:42:22 +0200 Subject: [PATCH v3 1/5] utils: Add landlock_restrict_network function Message-ID: <20260914-landlock_try2-v3-1-4ea504789675@est.tech> References: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> In-Reply-To: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> To: bitbake-devel@lists.openembedded.org CC: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789411368; l=2373; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=Zycb63z1kUQGDPk7Mu7fPr7vhKWxpq3CkmmKUmoT4Jw=; b=ibuwMfDoTkLC0XY6npZlBrPJCnyzvMyS3BI3DSkxW1m1R7PpGSht6cSaf7L6d9qvcKMnrf9nc +8CP0QK/pwBAkO6K6W63C6MGA4pdVsej1xWL1atk1T6Ok7+NAEo6dlM X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GVZP280CA0080.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:274::10) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|DB9P189MB2051:EE_ X-MS-Office365-Filtering-Correlation-Id: e12b038c-5742-4075-f7fd-08df128ffcc6 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|376014|23010399003|1800799024|11063799006|56012099006|10067099003|22082099003|18002099003|10063799003|6133799003; X-Microsoft-Antispam-Message-Info: +41+e41l+Faym/EDragBX/wxpZwuBvQHWSZ2hOJKUbwVo5mfGikFVGh3Ct3fE6oiS4gTpmhKnETKf1Cv5jxXeP55tpDuJ6GNkjJjRY4PK8uBov7z5BIEGGepI4LYSt8ho1/Y1qEEtdNWeEBSmmHgPCivhTYMDpsHgNw19sHBOZuVrLKvhSOgQGjiQ8NEaFKxEiNMtmyf9UL4OSiPiNWCpdZjh5vGozbaO3C4yTr3RY1X5YTziH3EqnsqG37s9gEA2p5nSpsNcOxlQRaWp+g/okkqIVQqRLCuwUby/sNlqByOxUIIyHuKfleOwXFvVBctU/7m229Tue8HowEtGr0XkxeFgtCgEU0BZ4AGjcUagbuq+wEqJDY76ko2xwjrhxT1khdoxgI9TNkJ52g/bmxGAubpWPVgfBjk1C2HGptYCAWC/bE1B9rXZhmzm+Sk/y0xtgMe4nJtwu/3Jhp7NX1NTgVNIBbsl3NZI/P8DcZuwSmWUgDYc3rGyyQnTCWiNwJQDYZgX2akuV3J+sY+/WPxWsLbfE9LsIHTilCgD6jGwl/dZ4zBQ/aL4SfVosUFdghiWtalpQ3kEk/o4TGuumTgkla4XimdyzoknwSMBGbyErHv9JRwTX/0se/xPmn9TDKlt7G3Wok5swvvj2M7uxEj+aJnMWbp3vuC58DDrq7YdOg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(376014)(23010399003)(1800799024)(11063799006)(56012099006)(10067099003)(22082099003)(18002099003)(10063799003)(6133799003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: zCaIumT5h5LguTmfO8lJpeWZGH5JxnDQ82/qZXIjrkYYuc1CPM319n2cg8yNbAlcvsKWPlkONHRK38WLfAtgpbaKk8udncpr5OjeLhuxlRoqLGPuZ5/KDxFBeePJh9KHAd9rghKlnfca0HqFrRFSxo+aeZl2dqJoV4iYl9MzbtWRILT37CHUWPcFQvg1sDDH7/dEAwlMT5e/R6ECU2mu4NIRH6GdgdeF1kVC2KVOdQqUgtSZSA6fqqJifohUyR+TnN14JR3GXuRnMudSniXF8NJA5R9qjvFQJua3DzQHZVJENXNjmFvxkNhQoH4t80bbrrGcCEygL/12/BodcEExqsbGxQaV/CueE6gL4esNfH7SnCFM7shNL+Rov9YWOlO8wQhAZJpzvNI91TIjKeA0WXKKNvqF5vOoBpoFtktvosuU5CHpTpaegP72xuO7eK5btcOfKKpPRCSVVZBLrlBJysmFRfyZ9CgN12n1TtvlEB6psCXaImJL5eD12vFqG5hyJDbjdLlHQqSxz48UvSPkFIbfdJ+dOd0gK2odGdXMUxhr13Fd//R2TGH9Bq4gHq8ND0FJ+9gh39mIQw98LYuNa35AiXN8qc4vHNaHnADtjODPJxR1iI4r/HY3NvqXh8qVqX8jvLMF5CTfRdbHD8+vmtxAwfvLRyqq2i1TfSUtIGyA7ez+WiTxveSeP+HOaXAcYlfTSJsC1QI2+bqOzkHPvA0V3I+68sScXl0oSfcE7Q7+aLWrv6VGBmCC3SuM6wgVT1bq+q8Zj6czN7MaSatFcHZG3Err3CrF3SQqx/ZBj9iwrqrttTsxby/OfHuXagWB4yy5cDhKShox97echxJ+4cbsYs6iLXyceYMbvr4KGLyy4LZt24n6QtuZJuzJxLksgRa6tFW03eCAMf9na8SdEfplgJLYBSOTJdEIrosMCFKaIrd5Pei6SM7f9vMx1KgSy2J8yfq3csraBt0hU840kVp4Mcv53uqd42r+Ig8PMyX6MI0JhGY0sygyJpV34ASx5JdvYGuSlyS63Zy/BXRWPTAs2F3UiiAyP+IWKcjpQFTjIC+5r8YwwEeoc5PQVk/3Z5t78cSTNFJVcOi3mq+EH5QIe2FdJG26J2cu8zrRO1RP4Wg0txYFtFSOuc+4rzZsapoAJC+2+iJR4fq2MLksBinW3RZxVBIZx3rqv8QBamEP+7c7e8D8+jdrkowCBxs+rT7cFibYsavecE+ZTHVOmv20krWDt6r3mMJfqdjzWmAeisnzGPUhzx1KYlNguF8XQsDD08ehhzA0Ou25XOql5U3DqksU/He97slbZD3L/RZ2RpNzN0RPHWQDomp08ib0A3nOBqbTVKj9EAbeok+N2QvOWE1cpYqt2QtdI11r/znlneAKVXR6bxgj28Yiq4bMhZ5ufbz7Pcw1ll4tQV219Q+peU+KK1czWTZYWEcX+Z69hU8mdyIGQsFMGCcwQKF7BDhf0sqO+FL4WKWDyw+shVU+1QX6vTrwgukb54DG9O8b1Fr33xCD/B6QecIpdk1eRlIbeTTDsp+fnBFb9Sr3YLMTyz3JSxwoMMtYJ7pcn5OqHf1fpd+QEMTKZsgPcyAsmBHefNFO/rMAypgoZo1cZNfLON/2wa2O+i3u4c9buUTXr0ZAsiBViXSrNGqnR3dBozmycZv3JOjzzsgUhipMDWp3Fahqp2RXHzbGv57N3uuBV+VVLLh6OiGrbEQhU4Lb5X5b4qN3Fdv0UtnvwNarlzoFr+Oe0z40IpxnTuXCuJ09mu8dgzkIX4AfKmBlh9f+M8m+teTn X-MS-Exchange-AntiSpam-MessageData-1: vBVjCSdtVMRMghBXYOvBPtH4/K5wJGIsqCc= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: e12b038c-5742-4075-f7fd-08df128ffcc6 X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:42:54.1054 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3nUmkmFH3kG7ghmmoLJMm2LeEsooGhihta1SwrntwJkq+mhMgyZNVq5cd8GjtKF4eIUvGY1S4Ow6ILACS+ZqBQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 18:43:00 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/docs/message/10509 Add landlock_restrict_network() which blocks TCP bind/connect using Landlock LSM (ABI v4+, kernel 6.7+). Designed to stack with the existing disable_network() namespace isolation, covering the case where disable_network() is skipped for non-local UIDs. unpriv landlock requires PR_NO_NEW_PRIVS. Any setcap/uid:ed binaries will silently execute without additional privileges for tasks. Gracefully fails on older kernels (ABI < 4). Signed-off-by: David Nyström --- lib/bb/utils.py | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/lib/bb/utils.py b/lib/bb/utils.py index 7667dee8e..ec6eb2181 100644 --- a/lib/bb/utils.py +++ b/lib/bb/utils.py @@ -2080,6 +2080,44 @@ def disable_network(uid=None, gid=None): with open("/proc/self/gid_map", "w") as f: f.write("%s %s 1" % (gid, gid)) +def landlock_restrict_network(): + """Block TCP bind/connect using Landlock LSM (ABI v4+, kernel 6.7+). + Gracefully skipped on older kernels. Stacks with disable_network().""" + + NR_landlock_create_ruleset = 444 + NR_landlock_restrict_self = 446 + + LANDLOCK_ACCESS_NET_BIND_TCP = 0x1 + LANDLOCK_ACCESS_NET_CONNECT_TCP = 0x2 + + LANDLOCK_CREATE_RULESET_VERSION = 1 + + PR_SET_NO_NEW_PRIVS = 38 + + libc = ctypes.CDLL('libc.so.6') + + libc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) + abi = libc.syscall(NR_landlock_create_ruleset, + 0, 0, + LANDLOCK_CREATE_RULESET_VERSION) + if abi < 4: + logger.debug("System doesn't support disabling network via landlock") + return + + net_access = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP + attr = struct.pack("QQ", 0, net_access) + buf = ctypes.create_string_buffer(attr) + fd = libc.syscall(NR_landlock_create_ruleset, buf, len(attr), 0) + if fd < 0: + logger.debug("Failed to create landlock ruleset for network restriction") + return + + r = libc.syscall(NR_landlock_restrict_self, fd, 0) + if r < 0: + logger.debug("Failed to landlock restrict_self") + + os.close(fd) + def export_proxies(d): from bb.fetch import get_fetcher_environment """ export common proxies variables from datastore to environment """ From patchwork Mon Sep 14 18:42:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98211 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6F43C88E72 for ; Mon, 14 Sep 2026 18:43:10 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.22]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5041.1789411381356818679 for ; Mon, 14 Sep 2026 11:43:01 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=xXVssvRq; spf=pass (domain: est.tech, ip: 40.107.162.22, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=APvAOh7eJpUtTrFnNMLVX3aCavC9o6CbQsW2xBL9JWLAStNwObv0vEhRxVXNqDiT10/Kk0uYSestdIPslSBnZ/TonX/jpKlmdfPoIcdFcFwSOP2TwnJF3gKw/9nSbnp5J3iYl5/Kv5lzBlpkR6jOOhVnrvtsUvV3MbAA2ttzXVosOP88r4MLlo/fqQlOGzgfNYQe7XCNBhrO2phNwyp2Sdhuru9z2eQOeY5ipJHzxaqr3WvGhJ/tURqm8/GNcSgiPkTD9vMu/0Zbp8dIVe1tRjtR22GYXucSHQvMioNvZ0PJvYmfxZP+jsvEyhtOSUxp15DTPhOGFrEpvbcYn51DQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cgLB5ro8HRkZthOj2SUtH+pvEXvrCTECi1UCRoIh9+s=; b=uBTKDRhNEQsbeJ1rkTNUmA8N/ccCU/P1RtULohVjD8eRXyye5m2l+7wQ8lWKiyogtKjrhGxN0h+V914iZxWFZv1PrFp0p2GsmPgNC9bPOAUrkGQ8WHbzNc2y5xgADWtLtCEQ03Esz3wKBbuMymA6MYvqbFNCeLk8UztmjzvMt3JQViTblZbAiJvUE2hlTTQjg5ZbPUP/PxP2VHJ/Q0YArwPArf5v6LqRKbS+IzbMeC5giZ8zUytA+HBxrrXlkfyIRMX/wOrpPO5nJZunkmSUyELMU9B+DeZ2QSHzrFCpsCBXqsUUBRDnu6JSbNrRDP3FuvGG7EDMEQSojsC+K+wWVg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cgLB5ro8HRkZthOj2SUtH+pvEXvrCTECi1UCRoIh9+s=; b=xXVssvRquHt7XY5JAk64L6qqwPavXlPtxJ4Ndk5ituAD0nE3G/0AA4fVtDSNef7uFjO3IVbL2x45jfcDWvz/rJrlo0h+A9Nm0o6Jw1bX7C6IaiCd5/sB9u/oIPYiXpXyJDb7fx9q4fnpO1ivTWEYbcH67dLzAvnZFX5wUlqQm3Y2P+//soxUF34Bs3lPBkfXFkpAiIBiU7TaJpu771J0F1qPVzQGDlYiNT31klpQJlYsGSFARvKWHgS/P32ZUE6tYtyYuADfSAKWfEU2bWhMvLVmV8whusMLdMpunU4JX1rRpdmJUZ/MnsskpH2o6KRC2JExuqDbBlSudwCfK7pe0g== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by DB9P189MB2051.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:393::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:42:57 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:42:57 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:42:23 +0200 Subject: [PATCH v3 2/5] bitbake-worker: Call landlock_restrict_network for tasks without network Message-ID: <20260914-landlock_try2-v3-2-4ea504789675@est.tech> References: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> In-Reply-To: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> To: bitbake-devel@lists.openembedded.org CC: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789411368; l=989; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=2CYKypWmovyQoJMbLVs3ifcwFkR2mPiZOicgM2mjvlk=; b=UWRQ+X1feNtWbIZAL+k1rFeBtDuUyR/QCPkMg4NpfTMV/9DdD2dkuiL4Lvw9eOPkv4g6IbUZ9 XxBNF9R1x+KDYvpOksspCGh7Y84SlMrVjI3HaM+mbCXnPm0EIF5COAF X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GV3PEPF0001DC3F.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:400::2e6) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|DB9P189MB2051:EE_ X-MS-Office365-Filtering-Correlation-Id: 06f1d80e-60c1-4022-6b5f-08df128ffedd X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|376014|23010399003|1800799024|11063799006|56012099006|10067099003|22082099003|18002099003|3023799007; X-Microsoft-Antispam-Message-Info: fHnE7BQDXIbs+e7pe9HBqsak960XCSQ/IsZavVz0L4j7PrzS7Jt5tPVcS+DybNToksNa944yXzqwzb1KFQd/KnrBDfOTZlB7QYc3XtF42r/4iRK1m1CdRAcvBEMNl5o+1yZxtCdgZqq+m5L9OT0bw9jcFpSP1kJhBOx3YK0bNy9jf9k6nAxTDbTEZnqzwNTb7U1uPrMEgTfg9RT6g1e4r3BHQ08CA6yxHEbTBS9S62DRsC29S5OkuJC7m4ZxWKZBNgdhndPyM3jGidJnldE52BguDKH/GoOCUngVkVc3QlHj/pdOg82l3NF/4WXc53tuUkPotQ1RAU8wVRCaVUeTHcxjW8eyZdzkLqPJoFy7Gn4TMQV44GFoWaLd0c3sqPhZvFN8euh6rfePu85VOn6dEcgZcyejqA71fSOKvt5TcxaK9WabPIPz0wPGGa3wBJfDiq6Zr9/bC9NOoQlBLruLC9FabVPF1C088LiLV64jWnK8+cD+dyMQkpkFAkXdG8Yu5v0j5WnMNvgpV5vm1tW8HwzAMDI2YwlLhaGz2okchMJOvenZ64fOTKK5zp8PAGbl5kP8A8Sm1mQ6IiNPHHfnrzMoTU4VOm1JiDra9/HuruKv1nHFC6JRm3+H4tmZTF3/AF3+YsohbsR/PFRc8nt/RF76gPxdvcXKn7W1zgVHhPA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(376014)(23010399003)(1800799024)(11063799006)(56012099006)(10067099003)(22082099003)(18002099003)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: cWkqWI036gX3tqlp1eR/eZXg0aYCFIME5UjWMFnFcaviVCNudsu6J2RjKC4dTIDmxIQBPyHDE8Cm9Udw0yG8pbHJC5IJpImhoezRuRWalO4KZC1KC1Onui3sfikL9wgfatMPxn4NOLHjOpattWAqz7pDihAvWWXHb0i23SDBzob9JTgfwG4J70xErFGWEmbchHkA5MWMG4x4GgTfJiy7Wb/lGbRAYYi8lYLWnWdQ18FvqP5ujVL0qWozji8ISY7X0ycuAJhSRr9aJmXDpD7OI0khi+7QZEn0UcBHEirNCK1ibFOC/0mPPV+28gQUyJfe2Vro01TPP0S3wBzs2C8PGoGv8e/CswkgKHPl1Rk6rzgTnsag53sB1MVPJQ2DR6J6knbMQLDH6UPmHVBex9oV+KSBXdSqroaSU8ZD3WL1bl2hX/lKad6tF80m08GuQvMiqadjbhgAB6IcmA4XhiXLlS25mHraJOPLVEGZptHMGyUMp1Vbs31UpWOvnaHBO+mPzIW7scuuI8qIrkFPM4qRhGctgLznG+uVHsGyQG75fme1BgHcx540MMabEyD1LOEgfRV7e3fnxGlW6YpzXQ7cjx4/LGRlUgbVrOUNXnwaj6FE8vx3JVt1/Kivfq7z8FLA3+q5K91V9ypLkal+lvcAMfX5lx+OPkHLquxBlxUKpZmIIWWPQX9+IriYrvYs1UVJpH3cdfnRSydPwlxz1nhFu8Ikh+JsC22u1q0tKJsxc3OGUDhELma6V4Jldg8tvzJz+Br+PUun+hclMvW4qJQXQrENen5yH4mSlsbCRHvRApw4jGJgi2ZnrISTFr8Vd9uekERYQL8rvCvooF7wFVH55GUuerORA6YyTLL+RyRJm7MvowIR7p+Y9wLTGDGsqfsm0op+546jv5Bt9mG6Le8eOdE0knU5MfiPwBr3oVlUJT+qub8lrOXM+LrjGbj4rzRk9BaWmez9y2TUCfc0osgvSRaPHfjzBPfJUM/IpH0tfHeW6jbO3VRkgPKTMHWIeH20X4buIXCgDKTeE5wulZQNmU+70c6YPCY79uJKIKibLqNSJjh454R55p01Wyj2qNgRZpivhgOljWUlpnuQKrC5AAJ+WzBp+O5Te1jsGen2E7wnJgg0SInJD6XXIQKZ9FLzBF/YlvsjIXCjsRbAqbpdKALORdQmXNoPa2BF8gM881hmyXb0xC2J27VgpLb8WYYy34R4nEGdvMtxWiVn747ydCLnymUxJhThYZqOtJONFIIwpdcWd0b2XX7AbzqR0r+ODEtiVnKiLJdUBJzUMYWkVID4znjz4EU6RR/qHan3DVKvwNT20kFihz+z5aFesSA1taSVVqPNp3d4M7rifz4cGl+GGB3wQTTx0a179uIwaNePO+4BJSvXuIJv+RJg5Er/fJJ5aRLdexXjTgb/g6eawxbOPZx+lnxuyT6GXyLPOxQj5La1wY9dVmgVxPXRibe60jGwGxT87//oPfdBht5xb9twqNK9dgDS5UnCXvE3/qu3SDAeTq3G4E7DQEAzMMWZsscHWX0zuUKeq8wbFr8dESuheTGKr7W6QOY8FUfNvgHFJ/24ZNVYv3ppxJzm2DGQ5/H35Dxhv0wbVahiKQOIf0VCDMaencSiKwtRZxmJ51yVLcsIBsaBghQev+yL01Ha002dQ+6vpgffh9Ud7GntuGWJCCspzxjQhoBlgqxS5Gz59Ht8Eypt48W9ee5oyGPrU3n9xKNjet0fY3vFlR0h6BN0KbOpe7PmSWZHTmJfPh02wNyElCZR0CkmegQib861n+ygrDen X-MS-Exchange-AntiSpam-MessageData-1: CnRpA5YQhJbvBBGpgYe6dp1FUL/4I2/iSpY= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 06f1d80e-60c1-4022-6b5f-08df128ffedd X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:42:57.6477 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7FWDpCmFYb9cdec+YB136LTFkwE6OPdmhYtE1zUtOFOk1Oj4lvSzuUmHPlOh1id6niaYmmt/twroeW4XswxcCA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 18:43:10 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/docs/message/10510 Call bb.utils.landlock_restrict_network() for tasks without the 'network' varflag. This to support basic network restrictions in unprivileged docker containers. Signed-off-by: David Nyström --- bin/bitbake-worker | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/bitbake-worker b/bin/bitbake-worker index 208f512fd..50380201c 100755 --- a/bin/bitbake-worker +++ b/bin/bitbake-worker @@ -293,6 +293,7 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask): bb.utils.disable_network(uid, gid) else: logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid)) + bb.utils.landlock_restrict_network() # exported_vars() expands each value, so it must be called before # empty_environment() below: an expansion that shells out needs the From patchwork Mon Sep 14 18:42:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98213 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 061D0C88E6F for ; Mon, 14 Sep 2026 18:43:11 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4865.1789411383506634136 for ; Mon, 14 Sep 2026 11:43:03 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=w+tQ7I2Z; spf=pass (domain: est.tech, ip: 40.107.162.47, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=V9rwivahet04qmSYe5oDELkiFdaC3LZntuYmWsGfwRHuOA22E3/jN+pHUET5NHUzAZwdKcyWZ2gWhRewVyl/V8/zfzKDmVveI2wj3du1JSnAOqw37G2illptlgPpn5lBxwgCaAhYNSV8fuGB8hhUPLQOOd2SDdXZx2dcscQPbZYJ9rPSYEVs/ZGg+TU0/6drDKmw7nRPt59UdZ0chtqdYPAcMliCWAfY++1A4T9t5o7x6vUYgSDroyNXKhCHwMHyDabSoEKRJxinNmyHU9Fr+NhrFvSinIETcZcoKbSog8Y2z2cxdoc2otyrVkWbLlhCuAd6eqxXDsok5EvUI7cU7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=pUTKWTQrKqJudG9FPrNtsFVCCyReg8PWcTFlm2az8Dg=; b=nYaTCZZQ5R/uRDZUmBIr7iOhPHq8o6Vkgzcwgfz5Vy1V9gniuRsrZW+XSWV/vhqhD/Sm7c4eXSnTmvEpKM2hpK/v91MfU+VI7kCfHu6fbTAzTcaq9rzZpBPIBY8yTDr+CcEwkQE18oflZRutVli8FTVEtETH9uucXoP8jFMbhhZQ1UtJkBBcOec4fmfdKciW+Gmvkc1Pc9ZxRSkz+40Y/1NSjAnGutNarAevTXU3h1XwRqC+ix5QrTOXX4M8kp8z3r5hiopr7UPEn2HnTWl8b/tmxVCXKdP/p8fPE3X8E8S3bzWBQKRqST7veRR2TylT5s+yxMfB6gl1WQqk2fN5yA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pUTKWTQrKqJudG9FPrNtsFVCCyReg8PWcTFlm2az8Dg=; b=w+tQ7I2ZjsaTW9TCV+yc6r2lOIZSgRM2L/mzZlSErlsqrdcZ5+vTTN0HDgS9wgo+VOhDJlBftNcJjBQKKSl4OOe0gxvZnHRcBuHtVKOcd8dW8BvVeDOBRs6gMYvRiiKdb75uA0J4xMS566H40Hdj3igkXdIr8gvvWoco4OgUKYMKZnECfW9Q1l2f5vmtzlF9NYZ0BdwEXRVZ1/5XHkd1NXxvUqlllo0eSs4654us33lTgKN7IF8VvncRk0WasniSSfBOb58fNynBdIY1B9+eWwTQ6XDt3kq1kTKLGj84/vZHOJ1ZyQg0hrF7CAoLuWir5hR3YR0TqWHmNu9uPY7aPw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by DB9P189MB2051.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:393::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:43:01 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:43:01 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:42:24 +0200 Subject: [PATCH v3 3/5] doc: bitbake-user-manual-metadata: Doc change in default behaviour Message-ID: <20260914-landlock_try2-v3-3-4ea504789675@est.tech> References: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> In-Reply-To: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> To: bitbake-devel@lists.openembedded.org CC: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789411368; l=1138; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=ecGizml/kW69/bAUhokv+n8CRnnEWaRnvb5Yn/RCpnU=; b=0w3LY/jS1Qpb0REZtVZRKPv+jkWLB22A7da6ky6jbr0rOY+tu4kUMn5aXeaM+iNRd5zjOuCUx DfE1Mai8KHEDu+2ZjVt7cj7tvjgMbkOKbawUpExC+q2GqPnz9JzbBAk X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GVZP280CA0039.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:26f::7) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|DB9P189MB2051:EE_ X-MS-Office365-Filtering-Correlation-Id: d7dd4528-b7ae-4f1e-7e00-08df129000c5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|376014|23010399003|1800799024|11063799006|56012099006|10067099003|22082099003|18002099003|6133799003|3023799007; X-Microsoft-Antispam-Message-Info: jlfsOQM3P4UZZHWYbFHr4VAOyf/Ta8Ss3UG1QW099zAb3LlfXt/hUWmLmri/p2XSD3dVT7WraNCC4CgeJgEKcfFkUavq0+T41OgKkOBtRL0QdmJNnlxexZ8C/HAwsiVGDTesrd60lzNnE5LvGHM0l8tOI0NZdHnlx8+bJfM070XvtQqUn93FcqBQ6FdoSEITAp2kUmEJ8lYbdL+25uYrNag+lkq5kFxJfUZ2oxGyf2cuJ6f6k3XJjY/iRXUvzYGjOITbWyD+yKsL+vBgO+pvxnyAtOn6e3GYk2l1nYHFQNCi4CAkeREikbCKD8dii++OikFVgcfQ5VpkjClrKlqC9xOyWSsk7FCTbBsCfx3/0Hk1hQk6HevzEdSz/2x4yP0aHeItXw6t/a8oPIs7vT/AXhGwbALKpo7L89R89a9c2/cuhlQVtgY7mifbXkbZQ4J5ICtGnHIRl85VEgLdxTMY19P9cAbrmDsnvpOtmSJYWaopJ68nAOJWQsljqOpvto1WPYbps8KEeaW4Yc2gLlUVXclPi+QX0p6TPKs2BeS9S9JjzDy1MXBV69SRBg4TZm5vZPnw2u+h0msXCZmSA41QK7Qqpe4c19lk2cWs9XR0SgCYefcizifNxAKRCZKuaDLeoPST6dKqstkk4BeCWKdjVY1PG84MX/BUFtHNUbsD6fY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(376014)(23010399003)(1800799024)(11063799006)(56012099006)(10067099003)(22082099003)(18002099003)(6133799003)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: lkSRHr/n6iVbobIvGMMWSxm34rih040mWty8aIzE0dkyWlSppXfKrDlxWOuwSxprKCTq/DR8A1G3XWBulklW7o/9ejeG4T+372U+pYRjwcPFiDmd5Wx+Ft7HPVj/ZT0v8DEnjAy8jAnt0BbYisYa7tNWA6x3Ddmux3zv4WQakgqnlgg5QbT4JcYGaaweoPcCzxdfW9cl6vEQySXrmGMqrHdR5HmAonclchZuPFSuD2ZyQRtAQN/skFN/QXqbib6OYpzZwP7pdyqVfe+X+m6ANb7vW2EkOnh0YEx3c4hM34qNYoPPNwGFANgn30milxql8gJfU+v1Ct/YkuNalt6rnM4Qzm8E76cf9bykt3PQJB0dtgBjq/jqjSp+d6hAnDN2Rrg3EwPXUzokah73L6JiFt03EcF5A6dkKZRXxpu2VcdNTsFetSzZTk5xX+gv/kGqHVqjLhC+ZRGheYIqzbohTi790pXaNt6RFCPRCjUvs+rmDRui+v9eXpKYFzboWGZmsf2ur/6KyDyY4tMXloV2idwZBgCRVQLzaaNyiP2bnuQx7xRc7/XxLzD5WrLnCWnZ4DvPy9F+iSB5kryi9T5zOvim5dVYebdoQ3SmN8n7bwJL/gYti4SnqMQ9MujG9U/0ISAVlASySvlhvAU6rY8IYIbXtLgrjgSzqRiZXAublIFpw2YNyQLyFuGU0JZQWIhHE2WN6yTzpDhMygE0TNzNS8Vfz42tsIZcKd8kj0fVDpo4GKf5FQwclglrrdSRi61nFvVbeXsl1glO9FN118R9FqpojDRttTKO8fabtg+g+qO+LNuY0Ge0NQutrQi8dxJwBgVmcaBxNCPx1SP2F1YwOtYvvRuFOqcRe8C+mb6Zs9ueXuxm+1p3EtqsqEF3t4Xf/ELtgSl4o6lWrmdJ8WwQPlA05LTwuSSUaSxo129fW8NTNmVu4+pIPmFvxyZUJzOYSQVL2uM2MYjv/O0etEkDotoNHJDVIMzY4Fl+f3p+JKansZ7EDGOs0l9j67afAknzaraDLi0AbWZtpOdGj2VgV4GbhznWukvHqA1GLhtNJfqiNBHlsxIQKUOgsNfNif4YkAWHALBTeVHP+W9iHLXxCta0i78xTBzlfAbXPGfDpLXNlt839LAZVNWlc+c4hMErOBFeVeD7yCBQH+sjJZQu9lIBfBWwbhx2X3SA/5uKPT6djOE9EV5GCVGiBWAwYTLIXRmfBGmpwvcNrszqSmCUKAKcPx2qjb/vFA91mX1DD+aPgZ3153J2oSUpXAozn+nSOw2epLA0RALJ1qHUqe8XsZKJOe+luiZKboCQ1EMYptx4YN7A6qwaVnFSvesj3MZlZZEDrVbfqVw22+Xk0O4EVXWevmWhTZPMIRMp/j84Hp52GBl44DK8zN6d0lSWZGLM+lVss5Ve+l8NNpuGUvivFyqHe5t6+39BmuTJ0SPJaIWzHDwIH0+zJM8SCyjCbHV5dwEFWciNFMQGig8GVjtz8x1d1A51MXxMoWiHOTSbCpvPxCRekTA56z5k7zmmIHgSgwZPolJn+u/mhkGd0tWqnL+UpjSMdNA95C33aJlFA4O9r4Gw68sgF/AVVuGpFZ7iISnYjo6+mjplPNT459BYqnRcku+4PJFAOdwf8JcZx9QVD42fYb7rYoICbsT/Og5Xs/x7T399cuuYE6mOcWyBuUCljjhVGU4o8FRFHvBxwh4YaV2f3EKMsj7mU9aOh//l8TfuLBU3zA0t0Y2E0uoCm3kiRIk+WPyuYRSd+R3BMYtHihq4BtItGbeUB9NuyexBVytzTCgo X-MS-Exchange-AntiSpam-MessageData-1: foqb16pTNeCmVKDvb8weD3EASXlBox6usyc= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: d7dd4528-b7ae-4f1e-7e00-08df129000c5 X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:43:00.9044 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: vEmjfLeb1E4OzaDWp3jElyWI7FD6V+WleYZ+WpX7VwflLLcIqwBJL15J7hKqoYMgA6ADeEyzG4X7eRzyWBNHhg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 18:43:11 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/docs/message/10511 Document the change in default tasks behaviour. The "network" tag is now needed for usage of setcap:ed binaries. Signed-off-by: David Nyström --- doc/bitbake-user-manual/bitbake-user-manual-metadata.rst | 3 +++ 1 file changed, 3 insertions(+) diff --git a/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst b/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst index 9cac793d3..621aab253 100644 --- a/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst +++ b/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst @@ -1791,6 +1791,9 @@ functionality of the task: shouldn't access the network outside of ``do_fetch`` as it usually undermines fetcher source mirroring, image and licence manifests, software auditing and supply chain security. + Tasks without the network flag will run with PR_SET_NO_NEW_PRIVS, + which prevents executables from gaining privileges through + file capabilities. - ``[noexec]``: When set to "1", marks the task as being empty, with no execution required. You can use the ``[noexec]`` flag to set up From patchwork Mon Sep 14 18:42:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98210 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E00DCC88E73 for ; Mon, 14 Sep 2026 18:43:10 +0000 (UTC) Received: from GVXPR05CU001.outbound.protection.outlook.com (GVXPR05CU001.outbound.protection.outlook.com [52.101.83.64]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5048.1789411388407126520 for ; Mon, 14 Sep 2026 11:43:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@est.tech header.s=selector1 header.b=obfDWote; spf=pass (domain: est.tech, ip: 52.101.83.64, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NpyBl2xKXULKbwfjhiCqCmM2Kp38FjDyGKYozSig3EhxciV6JgyYeiQUE7Kz0Fzs5nN7ptqf7EmOraWu3M7Q6iGwLeNgN1desAIyflx+CwDMETwqZUZXsiTbs/WIgUrp5X7yCHNirqEXFLH68o9smIoau9Pzo+tLudw0Fs3l7MPVa3PzN67nx92NH1We8GBgEgEfyNA9ScLeoU8vYijdGKOkRY0gs8mII2GmBdqeKgCN7nuIu7RdiIGsis6FmVG01tphzKV0jJrnE+qnA8bRlH5nKlou4npa6HklON6eva2S8HF1BbmjI5bkRcXDKZoquzdm56QDFkz7q37eBrGjtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=//SC/l5gOO8vmiLZ6qujTqe+inm6GaJasOoE9xKREoc=; b=ZyohqGLdvzi9eCYC8k1i+NGMQVgcoxxzCZH/UMFcbr2tN+murMk7MCljmEzKBy5nMbpBGGluO66rL0axQjeV1fsFoEX0q5fKqhH3TLvjptjABmFmjbGuvqmvogY1rPQMJdx/Hl3r4FpDRGOZ68/IA5ayZwN/ZqT0oUp/Ua6cfE0J5vNHkuzfSq4EBqvwefkF1K0SXemBTeP69gVxEH0LFhBlBGAUbfztlhzkqvVhItUXJ5f4K5chHNM7zfmTge9+aHCJyUyCvYRaijhlsn2o4QGaK+ra8xD7iNMU1FuWZ+9qHW9nAwARkyhwJ0/3b6eCxZoYBxIdgRGFd+SIXuRnQg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=//SC/l5gOO8vmiLZ6qujTqe+inm6GaJasOoE9xKREoc=; b=obfDWoteVNOVEGHMEBIKL/zJt2sr2qhBApT4ErM9pleLl5PUzdrslLsG7AWpIatnDf6GSCSx1nrwmg4acRWRv9OjJDPyUFMAxkBNeKStsZOVE1wRv3eAFqLX/5oZ6wqjY9apHfp+WuXq2IxhUlq2+wNAqg/7R6OXg3dDj9ffHwB7U2h1WHm7eZGjhP78bTlcbKyZfQPl5LZFpTkvG/go50ibUGOCBD719zOPs3VbP3IhGpfLxSKBYNUKXr9HP2z7L0kgpf+VxzNBMkLmoKbmrHEHSICJyXWkS78D6Wn7pRYoZWLMWNp4FFeyEpf1jRcNqEWHOZhkqxN0JT4+jXDX+Q== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by DB9P189MB2051.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:393::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:43:04 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:43:04 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:42:25 +0200 Subject: [PATCH v3 4/5] bitbake-worker: Allow tasks to disable Landlock restrictions Message-Id: <20260914-landlock_try2-v3-4-4ea504789675@est.tech> References: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> In-Reply-To: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> To: bitbake-devel@lists.openembedded.org Cc: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789411368; l=1230; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=ef0X2Wg2ArQRvqZ0GTthttmsbUtOMkPGiAU0GNdi7kA=; b=cFPhFtBOT/IkrDheqayx4QpQqg29nVryOzuN2OA4XCBSZlpAGS7h7kdv9FFK6Ts6q/+r8n9D4 E19LjcGtV3/CMViJh52si9mZJ9ruoPo9UFngf+dgtLRUZYy8heRgbAG X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GV3PEPF0001DBB2.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:401::6e9) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|DB9P189MB2051:EE_ X-MS-Office365-Filtering-Correlation-Id: 2349d889-b1e4-4f76-15eb-08df129002a8 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|376014|23010399003|1800799024|11063799006|56012099006|10067099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: mZCSZwytgzE1Uf2AwM2tZ88UQpZ8YSxxUZxVjbNakg81qWcb4brQy/nF+SyYtwR8FlY4uANsvPHujHYKnhvZ6NaTtyHlwaufL5m+QuP0nyb3SYhe67LCywsq8+wP2mABWoDOpmL3z41wCuyn5Rck7ZlujVHt8TyItfyF0Wrks1UVks3p8E2MsSboox2bu/XFK8wUXBIn8UKi3K7kMMq1cNpwV8s+ub9CQU7jLRyWnk5EFHvxo1dnhAZqAYwbeIFO3bwPSgmLGAljwMqUPuH+AwyUU6C5/Hdd56amn8dlSfvzv2qOnDqTw82vHCo5EsNSTPnpcZGV9ewVvpLeR8KIGfDGhTWQ8NoyuzqwNmqqhadk3OthORIQ7IxS47Dl2b92Ch4iZAK0VJxiw2Rp++5GWtwizE4PkQjoR3dKIWut4uXWz9mvkowXIs22+ZUIbjVP5jxBPKRxt8JBI//Klzru32Jb4P/HoYnC2YIg14OuhyjmWq9BxFj4hUvYZiaUBOrVHf+p9a6vR8Dy4GSM4Hj05ImAGzeVKsHBX8+IBStD8Qm+bNl5uQM221wCIOPOuCF2EN94jj14cNlItDhPOwU8mfRadlPlXwXizst8oOD7Sslxj29oVqVwzNIbnDN+ywWZK85s7YCx+8qemw5SwNh2ISmbiheyBGAe5Nb3e8gu9po= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(376014)(23010399003)(1800799024)(11063799006)(56012099006)(10067099003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?pX3mBjTX0lqHbUtLTlJrm6fzOE2B?= =?utf-8?q?m/6NnIjP7BDeYl/C64njvlQov3aJFQTVMgGoic4bCBRdGMxJy4MTDxerGizous9W2?= =?utf-8?q?aN2CsgQI5MruAQ5p72lBUkHacKVdJVBxYV6DkjUml73Lq/lnudLGxg2ePT2YmeGgG?= =?utf-8?q?k/L801Km6C/LNVhZXjJ5M5lLU2d616HYWC0k0Y6nsTxJKb8YlmZS6WpjbMEFx45Fy?= =?utf-8?q?cXVdoVRCMzi0qBfQmx6+/UcTKlz71SOEeHWn3iNwB4VpH60zmKl5rHXtGHzH5mI0U?= =?utf-8?q?puqgbBmvlnp16mJ/zVQ0kL4DGgpCuF3R0JNOxbZ0FW+NRuCiHqy9xTd6sIWvrNsz0?= =?utf-8?q?xcut/XJIlnFhh9OBSS2LiDJ0A86A7HT28YshTHE7Jjls2nQm2zpiSOrKKrV65DA18?= =?utf-8?q?HsoLdjMxQlRxYzFVIgIrd5L1YUeBF7DnSRSD6IFW3DNoULRJR9tKLhACwGv271vqD?= =?utf-8?q?ZKTYOiL7oCeSybw+nGzQoTg/1Hy7IaK7LwjmaSpkM7VHbr2YJotig9S80QZx3bvsD?= =?utf-8?q?9kiSQMeCRdg3d3kq6YViByCzopJUv0xOoTfQbOg5JBkTTh/l4j+X7H+HraAPcMSxs?= =?utf-8?q?QZp+T19YO5yfTNF0ZXXi9la4+gG6cEyvfH3l3l6Br0xQ1Pd7FCKNPzjFRavyyb+Qv?= =?utf-8?q?iU/GQpc2v6pJOcMF826vsJMpipo6mHsQ05j9k7wuMjhGx8/SOqjakDNLRhoDWsHNW?= =?utf-8?q?L24X4Cn4Qrn4chRHfhX1gfstMXLgdCjJl0kW9VRY46fU5BKwO16zZlcGof/q7hcHi?= =?utf-8?q?FhXde8wxAjG209W3+4z6wCMDbErX4UTaWh+2A5hstnwLXaIFRxY6pp/UZLW02MZau?= =?utf-8?q?8be8LNjpTaPgJEGieEOS4OfNvDfQ81E5s90ydAAwrdzvrvGtt6yOYnCpZwNlTFQE4?= =?utf-8?q?ijjxESOx6JGp//+0/ty40tBVC1po0f2zllTEPkXJoaHuL9I3yeLLvenv5qUpmkTQ+?= =?utf-8?q?gyVNvREFqQCd4x5/IsxYH3zKMdaPIn8DgHlh3HaFW/PuMO4F8akzcWIXYNBo0EPgD?= =?utf-8?q?1zjAK/NBEb4rmyCgVZEjHhV3JR5i7CA+7iiaBsh1eI5dyK4K9clkeR7+r6tHcgwsj?= =?utf-8?q?jPJwyOT4+XdGygdrxYxjJ08TERd7Cg3xysZKSwKoZfpaRgbO10C2ft0Jd7hmrjz2J?= =?utf-8?q?jsv+PQjgsWXJufLO7Br/eAcRuuOWlQxT6ptug4XtKm6dpKWtxmbKqO04IjnqoSOr9?= =?utf-8?q?qxzmbWzQwlJ8fh/LHb/ZCuGQga/pFAyxUE2/PTW2j3LsmoOeJaoibRXdMTjgu+Fe/?= =?utf-8?q?fVarGKljNymt3bDLyvsFxk11Rqs8BTuO70bbwtXsCImc2Kxii5FU86yq1cZqsRh9a?= =?utf-8?q?icPl2F+VfeYW4C3v9zBsOyTlt7RTS3BLJxhSFQeK033uMPy1mcSO5xK3l0MHbWn+a?= =?utf-8?q?DzujLi0sNdjD42/Bs1EOdX7HXX2ePGMQGXKXx7EhSSxdA5W7lvSyhGnGcNFVslw/G?= =?utf-8?q?NwloRDS+h7IEcwicAeV1Mi3TVHw8dQF/EetRVvBkAqhjAiUFDK8OeS61jru9qbASq?= =?utf-8?q?sYkIoxp1COyanTCFNcsy7BGRV/0O7TSd/XCHPU+bZVe0lV+lH2YVfwn8tsg4HoAWr?= =?utf-8?q?o/9qZCBOF6/CPovjsZnTq+JE538mtR3WXT6drPVRg75AVFCxF636OM7zRI6ZXq7oY?= =?utf-8?q?L1SowkfYZ15bvA2tWmHvhQxfW2jGt7NG0hSPgixvNDyW2a6NGpLM2deucKNxH2MDb?= =?utf-8?q?7KHWvZ8bPMCuOCmi6?= X-MS-Exchange-AntiSpam-MessageData-1: RjqVQjHP7xHfYzmm/lXrKGrTlcQpXJlAmxI= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 2349d889-b1e4-4f76-15eb-08df129002a8 X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:43:03.9853 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: XN7e7H+8cNNy9wO15/XDPcCXVSFkTnorCwXt2bfBTV80q9+qsticIVl+v7Fzp+4Beyol5cfknM4fMzKGMBKD7g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 18:43:10 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/docs/message/10512 Honor a landlock-disable task varflag so individual tasks can opt out when PR_SET_NO_NEW_PRIVS is incompatible with their operation. Network namespace isolation remains enabled when available. AI-Generated: gpt-sol-5.6 Signed-off-by: David Nystrom --- bin/bitbake-worker | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bin/bitbake-worker b/bin/bitbake-worker index 50380201c..9a744ce56 100755 --- a/bin/bitbake-worker +++ b/bin/bitbake-worker @@ -293,7 +293,8 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask): bb.utils.disable_network(uid, gid) else: logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid)) - bb.utils.landlock_restrict_network() + if not bb.utils.to_boolean(the_data.getVarFlag(taskname, 'landlock-disable')): + bb.utils.landlock_restrict_network() # exported_vars() expands each value, so it must be called before # empty_environment() below: an expansion that shells out needs the From patchwork Mon Sep 14 18:42:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98212 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68C0AC88E7B for ; Mon, 14 Sep 2026 18:43:11 +0000 (UTC) Received: from GVXPR05CU001.outbound.protection.outlook.com (GVXPR05CU001.outbound.protection.outlook.com [52.101.83.64]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5048.1789411388407126520 for ; Mon, 14 Sep 2026 11:43:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=e907gEC0; spf=pass (domain: est.tech, ip: 52.101.83.64, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=lDyp3dimzXz+OCfl7eKsHVNdC2pwyO5HAnjZ9jKepfj79ZizOy9kE0Pd12Ag7a8yDMEjHT7DDbX0zcE04jQ6k0AlzvZu+y71PmdAViX6iuaY4GT+RnKYESz/muId+fxOzomHGVjaX/SHNwwvpn96GOONa7ktnw91llnaspGJZf1TeB80jknejXjBcEcpnIx+e9OUP5gL8PBKT8gci0iue36xBI2GYkhlWvcqiPwH3mOQq/2WM3vzBdoa9B+G/wxLFz45diwSiB19MwlETwtavBeIUX6X43hsNL4RTQLQX3EoGgC0oi4rtzkXfwxeV3UUoz4bJbZrPjj/ekQbWAZnyA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NOFt5qVNzDyQVv0bTdkeSGNhglBECCcYaF/XTBndhW0=; b=F5VGmzCUsSrPLrJ0q1bZkLkO8L4JKzqzpja6uhzP8w5ToTcHKC4Z2H1ZlgV537DybPc5K8v8ZzLd7XVpiYWvcFRii7ACvGD6prJ7XItGIVjVMOQCH7lAD2r8bUKzdXpbT3YtiKGZ7jSs552FW7hrUoFnmDaTWTu6QFRRWWs1ncioGE+votDYbYPO1cWiAI0zvq2QnveEI9NmbVY8+FlMFr6yLfEoMLMBmPJwPQ3DMQil6xz33F5x9XIm29EvqM5yk0idsEFVyOLhD4Rf3cojMLcRkUNkQ9E/Z6RI8DcbXlDj3fLjLnDdhnlLQgWtnpEty4rEZQuBiYborMji4+TcBQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NOFt5qVNzDyQVv0bTdkeSGNhglBECCcYaF/XTBndhW0=; b=e907gEC0ijpD1n6FWQbQU2uhPDgm0UTS1aNprhBRxIpeKHYev+dqRYc/cR+OMtZx8cV5W6TpNhV5rChnXLu6jiu7NXOY7jyPAPl58SwwOipKHoUndpJVrzvsMvQLxsdsJoL4iB6QgA4Tw7t+mvujtvI155MjbKPqsBHn1bp4eTKPl/gB1JPJ5gDueI7uZk9ojDvbJa1ytaXY4OvAwBUVrYLLiBLFYGMnx5izPoCZ/lV1PxDeGowDmx3iD4FSriUuaJm7zjhb1cH5u4QEw8iyoBBqQiCkR8Juwe+S7kkX735dEc939b4n5Mdzp0uQEpt/O3H1kzq1i5QGlSfNg9V5Zg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by DB9P189MB2051.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:393::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:43:08 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:43:07 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:42:26 +0200 Subject: [PATCH v3 5/5] doc: Document the landlock-disable task varflag Message-ID: <20260914-landlock_try2-v3-5-4ea504789675@est.tech> References: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> In-Reply-To: <20260914-landlock_try2-v3-0-4ea504789675@est.tech> To: bitbake-devel@lists.openembedded.org CC: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789411368; l=2046; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=Ndyd8qgH60SzNJgM3/dBAaTiZSou2kqH/eBmEva2+sg=; b=LEYhsjIieDWdKX5C7H7nhHX4OGC56qt8jaOSjOqDw5eJLbBQA0ryxZTiFeLueLFsT+ODvxcsV /1quzFQZUxcADmlQM/Ac3SuBF3wLdeeHQ3CPLb4hcarNRTVa2djNtQ8 X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GV3PEPF0001DBB8.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:401::6f0) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|DB9P189MB2051:EE_ X-MS-Office365-Filtering-Correlation-Id: 0f3c5db3-7258-4848-e417-08df1290049c X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|376014|23010399003|1800799024|11063799006|56012099006|10067099003|22082099003|18002099003|6133799003|3023799007; X-Microsoft-Antispam-Message-Info: 7S4PszyRTJRX8QL0P5CsqWFtgqB8mpMQm8tohxvS7Cz9MlGDB6CXYI/AEVi+sX0ENg5PG7/9R+3SK1LqgRXxIv+/k0FFCWmqK6rPj++LVg9pQUfdtpE/hG2Gq5wGzn/kGCLpjzClK7K7wTyrCCwtnxjkLuVwwRT/Z/hKfYSPqfVYmfEJB4s4Q6XyWOcc+t64EY454eaIm86Sh2BBidfyH/H99M2vVmigk7KnyVS1PmHczNfR2VhLQKRK9EIeBW7JcaG2h2LT8HhCDfgA3QPDkd5PUhP+HuHlV8WTzwsppds1bRw3eVoMKE7msozHPp6Pr26lAoHPqt5PXA0IM6GlfLB3OiKE+ZWYTdsl+QwWo7/qFPwtBwlYYSrDV/wh1x5COTV6TVsv/2TT9WeJsQ0T2QrtCcmz5B9OERBJ81G+RSlFs/UPDrBEVZe0+4+5S7seCnJGwRhdk16YD/LIPdWqi1ZLl5GWQqljWMs2M2zBkxfBWIh0xE3K7sjAQmw+Bda3h5F0Pjugj7ZQ5AmNplRxGvqzawuYClcTcAMBh2B2B1yJByth/IEESvBpCg9w6uk0gCD0f+yspJy9Mc70xAu/XZBShoF9clE6j76S6UsNIXVZ4yrooeICL0+SWyxWaZSLcODnG0yJ/gl2CTp9ya8gxpOhXYSxwJahORs1TQRnWxY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(376014)(23010399003)(1800799024)(11063799006)(56012099006)(10067099003)(22082099003)(18002099003)(6133799003)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: T5RPK/LoUJwLAyUGTG9gHNXeO3cA4rCJ41ePGZJlaJnfTY0vRGBDIMMEgviCxpKP6zoO+VD6Z2A+QkJeBsJUS/LkApyEVY1pELVcc6Yv/JSd+V/uv5RD5/7OcicufQI8/18FVQuWtmmbzi0xt8umBdEgvxirfW0x0yyKFUjtA4yM8vDQ6OiWnxL9r1+FHOSlZIOhTGJAenQAPL5EotfuzDOKxhw0Z4gUuRg+XMIwtIMLVeFpQhHxgtDP0njM7am+6KJRuPo3VO/XLiuQGzF+VLtajEUTVvDop0Z2iFveozKSpITELD/W43JwVkaLV12KKmWTSwmZlgNtr7cuh/Y1AOgEjFBKKMuMdMTstXd5CZBWcLSmn7WKboFVmkynI7AnC0z64x9/4WXiIztYWxbNn/DpRbskAB88RJAX4TtA+BQk+Dvz+Ol6XmWTUw7av5NQ2N/bgRXcwsDz7oKTxUDgBFr3NQFs2rA3d+SLoEVgHtHMywEHc7y+3RfNwoiquP0Z+OdwdE+LQg5S5+QJRP+uUDSas9FcKmKKKvLOMeR6xO4UaVJzetu8cNfhdW/az9RwND6Y2PGSI5cT8wDnmJ0LjEwqtUv5TCMq09RAaXQTYmyw8Crb1Yb6jNVxHDwzhcMT/ag5LJymHJB0uv020p19ZnflJovgR2UtrUba6KDVRnP8V1UvmOxdA/MWUySqQYxoBIc3GHwPbbBDZ/lfvGuTGptioIRCpBDUIBUJp4yvWLA+KDaJctTLf/KA9GaGKz+A0nbRwYom+G9TMaJ2j+++6YdrtqjyYJ9DCW0tdpoLhCfvcJ65Pj9T0ykz7vo5kh932WId+Em4SMTdqYGPTt1igRb1fZpbFY32h3QhyLF713G6gwxfql/SZ1GnjIskxIXqJVU6XRE7esJI1vz3TKYG30w5Jw6oUx6DtTPi0znm9uBx2DdlD+hI9q/pHALR96ONl1VgOiDNXkPqhHICVs6m8GTTIgA8JsmawfYYPHObBWZ1RPPyJAirgagvbl9dc5LNuCxlbN7sDHWACQh2l2NhnqTpFgiw1pTwobzyV6VmTj9GgYqrhw7QOZx7Idi8taefrMkhDsFIC2Cd39tRQrZBDO2L8n/hA0mbXMxpjx23tCIgFT/Y+vzufkAfQh0cUILoHaDu1MzccWhJFqDXe14NT017XWr13Dl47/h6h5kAp8DpYxWT0Z+fhzhcOexJAVLobrTvW4FgPyF4D14pNFzsc2rYwFRYdYklfbogwhyo25KonE1kanP5nkhqHEy/LyMIXi+/Lnk+UM51xBtlbmCL0lEA4pvxJZrOuG/G4PJwqdfP12nAszYkNL+zmsS8yXLUMI0CaPqMp2goGrdRHIy4hOGLiGwN1eJHxYDFjQ2JCX80rBMpbwfWghOxaJJrUNV6Wm+YyjlGNZGG9AxWH0TVKhBOw0o/+z6nMCsUw72fiLf0hjjFlmY7Sjzoq3coK+m+Tg9uyGCB9T8BMN4z3yEJibuN148Sfj0C8P/OXi/1dSk3f1kuCgQbXtiQsbR7e6mRu5oBPVK+yiWxHoSVwPBf1CbTZBEwK+TZYVxmShFvhYHqOWR6MB2MZKtLP9Fgv5zUPUqlShpX3YT9jKuTJVBHQggdxJkFGBw/C+wG/r/tx81AUKh9qem9w2NG0tPiuo+XH0sN+M8Ode0HWyl3pVg8b+RQWEsj+2AlfDc2KHq6ohdSgYFsIptBACm4G6/ryM+6Tn1978tvzsLdGQ04hsnScEgBgn2cQJQ1U69uog+8HQtsDM4+VDhsSfqwcdGdmf0rET+IW5LY X-MS-Exchange-AntiSpam-MessageData-1: /HLiVQl4mVbg6l35c9e6yXyqg+7u+OszfhI= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 0f3c5db3-7258-4848-e417-08df1290049c X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:43:07.2954 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UbOUGPB6YQ4wigVqWcqjop5mphZBT4k8GhyOR++0UflPTJJt86q8Z8NJ6rbDlEt0M5Bj+g579QplT7NXiQjSYQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 18:43:11 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/docs/message/10513 Document how tasks can opt out of Landlock restrictions and clarify the resulting exception to PR_SET_NO_NEW_PRIVS behavior. Also, needed by users of enable_loopback_networking AI-Generated: gpt-5.6-sol Signed-off-by: David Nyström --- doc/bitbake-user-manual/bitbake-user-manual-metadata.rst | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst b/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst index 621aab253..b67320f47 100644 --- a/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst +++ b/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst @@ -1780,6 +1780,11 @@ functionality of the task: "exists" True or False value after the path allows this to be handled. +- ``[landlock-disable]``: When set to "1", disables Landlock + restrictions for the task. This can be used for tasks that need features + incompatible with Landlock, such as gaining privileges through file + capabilities. + - ``[lockfiles]``: Specifies one or more lockfiles to lock while the task executes. Only one task may hold a lockfile, and any task that attempts to lock an already locked file will block until the lock is @@ -1791,9 +1796,9 @@ functionality of the task: shouldn't access the network outside of ``do_fetch`` as it usually undermines fetcher source mirroring, image and licence manifests, software auditing and supply chain security. - Tasks without the network flag will run with PR_SET_NO_NEW_PRIVS, - which prevents executables from gaining privileges through - file capabilities. + Unless the ``landlock-disable`` flag is set, tasks without the network + flag run with PR_SET_NO_NEW_PRIVS, which prevents executables from gaining + privileges through file capabilities. - ``[noexec]``: When set to "1", marks the task as being empty, with no execution required. You can use the ``[noexec]`` flag to set up