From patchwork Mon Sep 14 18:21:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98231 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BA69C88E6F for ; Mon, 14 Sep 2026 19:29:43 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.30]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4556.1789410124949907937 for ; Mon, 14 Sep 2026 11:22:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=TgS5gCCK; spf=pass (domain: est.tech, ip: 52.101.65.30, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Q4bHRyY3bKUR4lscwBKOdbDnqJ8jTvcSnQi8VvYcceJAtW9O24nfgOfKN6O1tw2PyB9koBemI7xDmvJhCTgC6D8Yc3C6RdhsGuFZprEn57kBVd4qPIdI+MuGRlCfE2tYY8HZvuBSMrONPyrGYXE+S6J18tCrYOmU2ounnh4jLDdtKRDHqlDfSh6avIxu+ApI4YeFweyvzIDv4RvS1nlmTV3MxIHWq6dZUgffCc1KNlfvJY8ZC4giYte9J7/wfiN95dlgJr3wEcYPDoxrBajO5nMVMhxsVpugI0WBurL56Ht5tNqgrJvYs3h8LPDJme9kgG/eGv6nSBErua22gXOCVQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=YhPomrdGvIyDh013Cf2KMmhSp27skPjvKFWZZiRnBNQ=; b=lryLNloRkfh16gMW6ggOnjigxPqeFfCROgF8FdW19Smnoq9Af0jBGr1iR8t96qYHxN9+a8Ktx78wb9xJURt5XM/oLgRg7eThi9GvuytI3V3ziUanXGJSM5p/cpzJxgx7urkUuBuy/klt/oL9dptZbB56FJEclufHYLo+SfJp8Gt+LLKr1M/rj22qLJnGo1PweQ4nv4DoBik0ZKaL1+zkYvqEMa5HiZKYedtuAzntzKk+v1xKashUj7+FYadNzJC+XiVM/NUN72XS4SdloO+iLxIN/pNLgJ/ShDwq63bpayxFYTQsWHOamD7Befy1MN8BR66sgx5LHvR+f0hsT+SbSA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YhPomrdGvIyDh013Cf2KMmhSp27skPjvKFWZZiRnBNQ=; b=TgS5gCCKg+keC5oH/Qk9NRil2gDJJejAXz0Tu1eb3vSrnDg3C0VnQjCLpz6/VwdOSK4fQNggvQjaqt9qkqKyatz3keU0o14QKCEaLKjHm1EmOJ2jF4F4WHMjcT6UHKsqU19jwgLXHm0Mr9BT+8SowtB7lsCDyn6ayrgAIH/gxASy4jUv1P3irNLmeOxVx7CkGCG+KTb5pJvRUA4BXye0EsdlQkKIb0MYMVr+KXLxrcC9cyUhbJlUv8BL3974sjkxZO/zgwDwpFfve2a5kgQWx7sAjdZcoBIwukuLxH+tM+G4/IzOaSR/2ro52R+knltTgmyxwQyVvCJm6M86pCMffA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by AS8P189MB1302.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:2aa::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:22:03 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:22:03 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:21:40 +0200 Subject: [PATCH v2 1/5] utils: Add landlock_restrict_network function Message-ID: <20260914-landlock_try2-v2-1-0a1bad3579ec@est.tech> References: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> In-Reply-To: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> To: bitbake-devel@lists.openembedded.org CC: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789410117; l=2373; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=Zycb63z1kUQGDPk7Mu7fPr7vhKWxpq3CkmmKUmoT4Jw=; b=LlsS/+OhhuJJarKB9YS89+LhW0gjxCVd4t1SdN/XSVlgPS2VKDOw1nwsTgT68P4dT/uNqdLrd l+ni3vSfzrxABWYEv/MBsBgPFiYoRIaaWGybQFhuOxsC59g8ervYnjN X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GVZP280CA0015.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:272::12) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|AS8P189MB1302:EE_ X-MS-Office365-Filtering-Correlation-Id: 7d7a1b8e-870a-463d-6efe-08df128d1388 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|10070799003|6133799003|10063799003|18002099003|22082099003|10067099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: ULmJ0dv1NQmcvE4CD6b9Zj4pxDM0JztXNGfJVRdD3Yg3nDAA0BjNZoveTmlXQR99wx6UO8IT7m5aKKSIk77EsIfpQUWJyynL67caORaIvSmDRKj1hIq4ihL/6BNLwGVGKA+FO04ZLrYxoLdW/kB3oYozH31UrkzgRO5a94PF8GySXPW6dRZC/kvYeBgUOShA3ZtyQf/zGZfxn2A8deK4J8z+saoAem+FxMSxTPuzW2H6EUrA7siNSg2DX53QYx2E7R3aYmUh6nfg1FBw4Z7nlko6PrsRWQHKsMZFKZeOAA9IkgudJkh4G5E4Ipf+jnHFpZ/i1fskOF0dQLUQqMONYasUWi4bX+XO6b9usGH2z3uAeEaWHo+syXgHniCd0PaKkvVzrZM7gu5tCWHI1sXFs4G87A02LE8zTHXQPe+A1P1kv/D5M99GdaREenfi6fC/gpNSJAjRz36WvUuA4QgyTvzxHBIqhXtYJvoPQqnC1cuQyvcOX9qR73x5/ytv6xVmLN/QtMmz1docUnZZTVKj3LawF6cvXxWG21Vt1zlo4BwIhxzVWxPzQTYAhdhptUZANa/5emN9+gcICriuIMZo0XJ69qIjOZavZJIcZkH1mlRGj97WHKglY6YR0PP20If5WsbVLtaCSOps1GFJxvPw+L+2/0IvYquZo9y+sPPXLQ4= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(10070799003)(6133799003)(10063799003)(18002099003)(22082099003)(10067099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: JvqLB6rFO5q49Z5bnflc981vCpH7tj5HszVt6+ZKbRXux3RjOL7KnNYXFInAHAipKRFBgBaC0GSd8Rnmpx7lLxRsS83yngEIk7DSnln40ino41/RDm3bKCKP4V5Ee+XlXhkPdfvCgJePGKT552Yjh8Gv3IHc+IltPeXK+XYIPMhdSRieibldi3GmaPbQGeO5Q14XNkpfqTPxtMHWk8bsjDa2wL9ZPB+MP6lQF85Wfxc/Butjsn1zls2FLZLcpcSjHoeScTChH/6zUYspF+zOaRrC/1eSOgd3ZEKCPkq7k1IcAcia9K+2H93GfEyaIaCL8PMZpr1C76Y+jjwLwjxJsSMHodqTwqTWuuXw2yKxvG1/PjMp0fXPlXiQo8rZJzBKqDoJ1Qs2zDG2xGr/BysgOx7Q5ATljcSa2EcI6zWxOeN1eCRByd/gxApL0Pkrh5RUvQItX3g7rHASIinHWsXfArqSd8A26zNotBFPkRhmTH9QlEs9eic054oGTw98zbAaoDApWnxipqsS59oCtibgTQTMJeIDMT07Ld7I9VTPt2PquQ2nbAZQHpz42ZDK9B18TDkzXeB1zrhS1F6hBymZAWEWQ1eYi36EwslxsrUSbEqi43pqARk1i3DyIkjEDPBqmPyiHe6BsloekbuXl8LXZNgQqjwrmEGlD9vTwYNoeJ6WloMRS9FOaUqMnIubOBhlgn0Hu8k/xoGzLmE/mZA+TMy2D2k7Iw3ZGIkBtX6RNE2/IZX5Mcb2FkDs5dmyXW7qcVrmvKPNoVSu5b4GWAO8a3Ev5qLkpFt6tFeNS7enmRSpHqJeJddyVmQsz9C6Z8x+v1VQXWtFlzppUnOymcQPq59MCIo7GUbLRnPsWzblG5sN4zU7FaZ5rMMf/oQWvyjtoAWHNtYHCgzhZeMDUp3KSVXA1JXLCje31z7vgPBIF3gZZ0W4W3U/i/NFhywz2t7JuVcPXH4Kq+1hdmpCttH597pm7+zw1oo2pOM/KLNAKk3YN4pN2ECOObiwDC4Qb8V44UVIBH4bWXMzW6g90WCUrH2+xASpOuYYqgZvisYwa/+eWYV0OevjR9+caAY8L/BVxFB5WqLmp/urRVrmXgRPssh+xO67ptnLPJirp2D4yhQDIKag7SGRuZ+euARA9YGM0pAUBO1CDXHa1/ki8kiaiKQYFM22bfpAisP5SKzOiMMkypXOr9eXpNML5ktzIwHBBqzt1X1uDCGCrJMRRiAUWQ41rVWNBSMLH5qonaY8OTaPibeko/j+g1Xb5X74IP3opOJsVhGwgoGmiBdvkCQUPfdLEEYTI/xn6BYQg8zM5TgUm/2chp4D3yODkIxjNr+i5tPmaAjze//Q0xajjglH3B+G8gjlRmmTxL7iQJBMUG7XcnJX8dt3EfTjkr2toP06jCfkcReF95Fn+22f3LPZrIprrf0sSF6vXcYHxeQFl24tFBUzqqH42bNAB61ggCOGLzD1MURuH7QUUaOmKMDo79YeKWWqvgDyoKo1XpY/iroG5iYT4vwZ0cIwf2jf9u4Xd+3dvvNpOZNclTtSPdInF796n2OzN8oMoGz9UgYXuMrTG1zGt3YG8UEgldQXmnyTsg6pcB47g7efwxJENIxke3ycS1HZimjkVEWcIsg92EF/UCdaorXxSFm0OsjMIAgTXThbNYF1QeSIrjGjeIQIwhFrLirMO8oJBTXt8bupiQ5vdw1xQy+N5etioXMl8d+HLwqEGC2eL6M5gKnAtgxMWJ9lBhPHxrrqJhVaVWE/Rj1yXeh1cftJeo7ZW1a8DH1Ybz5TurqW X-MS-Exchange-AntiSpam-MessageData-1: 3HYD/ILUxd7Fj1VCaSKo5AlTO+NxyQcpPN0= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 7d7a1b8e-870a-463d-6efe-08df128d1388 X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:22:03.8366 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: o/aROJB08ugvbtUqnJkwV6XEko97kPNQyHNYreWwXbW9JzCFhCSXhropCGEAWbCYkrrf1RqDppUWTGQXy+YJDw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB1302 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 19:29:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/bitbake-devel/message/20201 Add landlock_restrict_network() which blocks TCP bind/connect using Landlock LSM (ABI v4+, kernel 6.7+). Designed to stack with the existing disable_network() namespace isolation, covering the case where disable_network() is skipped for non-local UIDs. unpriv landlock requires PR_NO_NEW_PRIVS. Any setcap/uid:ed binaries will silently execute without additional privileges for tasks. Gracefully fails on older kernels (ABI < 4). Signed-off-by: David Nyström --- lib/bb/utils.py | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/lib/bb/utils.py b/lib/bb/utils.py index 7667dee8e..ec6eb2181 100644 --- a/lib/bb/utils.py +++ b/lib/bb/utils.py @@ -2080,6 +2080,44 @@ def disable_network(uid=None, gid=None): with open("/proc/self/gid_map", "w") as f: f.write("%s %s 1" % (gid, gid)) +def landlock_restrict_network(): + """Block TCP bind/connect using Landlock LSM (ABI v4+, kernel 6.7+). + Gracefully skipped on older kernels. Stacks with disable_network().""" + + NR_landlock_create_ruleset = 444 + NR_landlock_restrict_self = 446 + + LANDLOCK_ACCESS_NET_BIND_TCP = 0x1 + LANDLOCK_ACCESS_NET_CONNECT_TCP = 0x2 + + LANDLOCK_CREATE_RULESET_VERSION = 1 + + PR_SET_NO_NEW_PRIVS = 38 + + libc = ctypes.CDLL('libc.so.6') + + libc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) + abi = libc.syscall(NR_landlock_create_ruleset, + 0, 0, + LANDLOCK_CREATE_RULESET_VERSION) + if abi < 4: + logger.debug("System doesn't support disabling network via landlock") + return + + net_access = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP + attr = struct.pack("QQ", 0, net_access) + buf = ctypes.create_string_buffer(attr) + fd = libc.syscall(NR_landlock_create_ruleset, buf, len(attr), 0) + if fd < 0: + logger.debug("Failed to create landlock ruleset for network restriction") + return + + r = libc.syscall(NR_landlock_restrict_self, fd, 0) + if r < 0: + logger.debug("Failed to landlock restrict_self") + + os.close(fd) + def export_proxies(d): from bb.fetch import get_fetcher_environment """ export common proxies variables from datastore to environment """ From patchwork Mon Sep 14 18:21:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98233 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C665C88E72 for ; Mon, 14 Sep 2026 19:29:53 +0000 (UTC) Received: from GVXPR05CU001.outbound.protection.outlook.com (GVXPR05CU001.outbound.protection.outlook.com [52.101.83.16]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4558.1789410130080039753 for ; Mon, 14 Sep 2026 11:22:10 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=nEJgMCem; spf=pass (domain: est.tech, ip: 52.101.83.16, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FQc0YxMPgt08ZnE4Vmv4hFDIdHWWVMGdXOT1VsICM+wH7zhR647FM0Sqx2g2WPn4/0A7PqPBLVoXiIChwBqBLjWxl2Xm+8A0nKSNp3yr5eYl9yD0eLwBkE2bL0AKrijttnkjkU4UyCUPrITMB7/3TpkABoYtrKe/CUHgRjpiOMOyVNHQgFVX5z1lnKZrxR3L/SLh0s4MCSLnrVKqtQR9oxDCEKe/ihhhSVM/BVT8WgPSNMRv0EUm2vg7fOr56fG1p3quWQS6RASeMtkoWvkKjq141KhjaO5ZGQDL/zNFcS9oeyDDaVbIFop+YeUdvuCxM72RSmSldheJCxQ3qsLDSg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cgLB5ro8HRkZthOj2SUtH+pvEXvrCTECi1UCRoIh9+s=; b=svZhknXtTe3KfbONrmGdEOWt9d2Zr/4wPpnJcboWC9rRqTd7HWWqviI+aKlx3XHIEwRMnVudK15OQ8RW9DhAsD2IKVscauoeFoUDmK5LEe+otU979wUcMAhUo5iKyBtxVkeKUGM9KVXfeXxL/PCCLBTYc/USj9+kZsnYmqTa+fgFH9PcLOlC/CxrPQGa8Dccheu3IBqpxieXMA5yLDN69nF4ogan9VFSTnL2UMBKzlZp0bVDa7TKq/367cDq7277EDkymC1bfCDCg1maPBuo138iP60+IykI1WBTfTnHfKlYrBYTSymuxuGZ3o23Wio/dKYFWCwBbgaEUTreTl8w3g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cgLB5ro8HRkZthOj2SUtH+pvEXvrCTECi1UCRoIh9+s=; b=nEJgMCemZAx3vLWF/vRSXqB1P0B+l85VUCPlm4Wf+HsR/2VG7CCil9A0BvC+QDZBWZS9z+2juIdOPGpPzYAjMa8vX2ByIlKKJ2wmRYCFZTIEoHxh+9uVkABIkVEGUuKI/b0UcPCTSSc1kfgQm1nT5/OojBsaL3AZOioZxkxQZHTibdaxU9CgSGDDjjZdMU2AN+5D/M8MsqjNd43o9boYKqmk053yEY6Asg3Hk4hIc9gvrp19sPtrTU2C+DDRpWtviWaKCQZ7n3yuz7KptBDAAq0td+tIhL5vznbgKgh8HbE6K7aElsRR8mBtWA4PvNYR5fatpCRVYPUgquwue7Iy3w== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by AS8P189MB1302.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:2aa::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:22:07 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:22:06 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:21:41 +0200 Subject: [PATCH v2 2/5] bitbake-worker: Call landlock_restrict_network for tasks without network Message-ID: <20260914-landlock_try2-v2-2-0a1bad3579ec@est.tech> References: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> In-Reply-To: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> To: bitbake-devel@lists.openembedded.org CC: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789410117; l=989; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=2CYKypWmovyQoJMbLVs3ifcwFkR2mPiZOicgM2mjvlk=; b=Y6Y9lk+OuB88cQJtu9/apOCBQ7owH6bmIq812MoNslVga+bHwzqlxvBlacLpGh/BpQl1Lq+Xu PsRTDqVcB+ZDDqYBOeQMcguIX0bAUoZsDHB29IbdMpxtl7D7yarvPvS X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GV3P280CA0104.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:8::24) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|AS8P189MB1302:EE_ X-MS-Office365-Filtering-Correlation-Id: 19275f5a-ee93-4fe9-9362-08df128d155e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|10070799003|18002099003|22082099003|3023799007|10067099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: kEYhz6rgWhtcVWIed7hFqHConIeHDWfKJl5n2cIg3vjR27fBmhABOEp42+35BMu7bP+sqyaFvX6MsrLc+35/HYVP1vxkHtgCLNXKtzNmvaDXyR20jzEsjdo0QVTj+rOMEws2yDvByVZnzImGctzBJ+rpSl0rwY6MuyOLWS2POOZIuxO2BZ/MvbJfg02w+SJvkWVIe+1n8f2P+mR1jkErJU0taGRAJhGDRazzWWhV81EbFovRVvue3YxA4BZlMOM1OPUYw3wrnW6oNXfKEwczCCAOmI6E24OAET7wV47MMcaEbLlrA5f0+jGScRodv/osukXUIIR6uE+NszaVv56ObFzupf7C5lzpVV5nEngj0Py6OLY2zJuxpuBRNG4sbgrw5D8BhU+YlEqU7u0zPAIlWksRKAW1F4d+cV0VCJ3XC5J+Fsb7luHV1Nbfe4EWnfQVW305srKksYwtWKIhkMa0kWR5eEOZz1FlOyy8ORr4MwBBMpFnT0ay9Uoxynxxd8Y3lmJCV0kfRCjcX6sDB1skOWCsO6ejmzNKvDXQ69vx4EyHiCS8y0yE8VJhcE1BVtEEUAfDnLuXJaHuoYL4OPbTAfmZdDqniYdPRj9ZT1IVxpa4H/PUNnaaSQkHvGLtPrD+ZHzWTh13bYJgCOuyJ8IAxPwGQF4o9j0tVpkuF7HYZY0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(10070799003)(18002099003)(22082099003)(3023799007)(10067099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: gbYBqMa9S5Y9qWTUEhL8jPlXh5/d4yQPy/UiYS4W9FG5wqTqcvj7MdKYpYm321UmFL74ENmNB9Kw5/fAOR1sl4Z82GFRITvGQAwD3vfIeZ6w3A+BWx62L7Zl/DPAcRST2d0u8dNN0TG9vCenM0Oor194zJ7fQHFDL9hSGLV9F3aMT5a/nZJOPRqC9gzyJK5Foyw4OxaD3ZaF4hwLZUQ5tXLXEmVEm+7hYcVBu39DHowL5+IzBIiz1nE+d6vrFbhQGe3eCBSEkSHE8JJLdX0/WZ9tX894R8n1B2nU82+oKcxASkKvXEHK3kmifUMPhg1o0sXGJVtn6AYDOcLgd1mfinWLKyRN+XSjBNwriR3wYXakwX3S1qKWQCsiL08MhbQp3lkMmpQ91EvZy9RBNmScP2hxqpmHFtrviFWEec7M/ukifT14WAIBQWVMjoDTkpXd0PTnz92B7QgaBHdyeTvuxX6AiPBYOLW8p9KylMTzQMVVtpXRzDVwtrgmsgd9BremIgrKJQ6inxy6twSPcMeV3P49/KAILtIq9TxywiuyHE+xZkC7NOxAd/+SLIdVNZOOEZWd54OrrX3tYuhF3dArDC6yy4pE4kWaYLREc+Jx6YtjQT2kE2Y9Uz/xwQXlZBkdg8RqvAUf3Q9R+J28aNPFKamrjO4jwZVSlztChJuz5AXxKtJ68FM+zCMhu8lKS3FmKIR8zgOlnTzVsN3dRUxrn42HcJ9Vjv0u+WNP9g+mmk/+6Lnte7ZBIPdBnEseihWUdejfhNy7QJTYwPr3An9GTSBC934vPnQpsg7aJ82qjl7/337dSex6O1Qos+vmrtDf9qW5rFtJqUXWcNxcNoKM7XI2LO1Tex2pM1wQspqltqMYh4KyxSkjAohru+jx6FHa4x5633PxNRGXXMWQfeud/5AwQaTzw7BBcfDd9u19ZkJSxdBcagfVw3cPvpQl9OnU0FIwvb+8Tb8Xt2eTECviR4dO8exaOcgZ83TJ1tlT88QNMPXd/tJj+NjSah4yJ/RDpi6YPL3xIO8E9abdRcTn90UbtfN5h5e2QbFMnSEc/arDAvgOy6LVLa5FcNjTwQxMmVdFrfA66CgNQFv+Z+/1H+XFWynt6qAKk7oCyo9uOjsz0OKhJg7rKB3cTuTNHiYt2nAUoBozYA1QWwkz+8IbYhzk7uDVGmCoYNPxxfNeD5rHJmI0bHGUi7TT+DgqM6n5icBfREPRcwJ05Qj+9GIjJLFOk22o3o1TcxqhbKdXydRLkBKMWcqoMsSicITJ25RT9fgOVgTSVH1sUhFsyta31srtZdtf4Isj1W4v5GCC29BZiSmcfS67OmTxi2s3AWtjOY+EfBu/f2MpT27VY8Kj0D/WsuRWJVdvdmpoiIeY6oopEEiDnmflLtxYN7JSPLKrvS+ukivDMbI97I84h+OWj/YnXd3VcCXP93FxE+/FU2Ja5N9MAoqcQDIF6QevhzBKzwSuu87Ws/R2BhXVyuLQpYdZR20Lzv7uW4hyUmU8dwwVSaNc8fO0tCRis9abs0wBDk1+XiYTUR3GP8wMxGJQMzzpT9DoQPeGLnEHgSEfcHe38v5nPue/TYlYkw9VxtDA5XljBT0UCc6rNeyOSwbtQKkwBofgG0WEJBkzuBdswgPbbxuA73RKgoNSvGMXEqoaVyiXnDUevBId5kswZ1GoE4Z7gQ+W8oEtZY1IrRcOlhfoQqhM0GLcMhwkU0bPk5AnUFxjY+LU8xLhGQNPFHW8Wed0huKf0ulpcafyjnYIk02WedqWA5MV/VMSQMmN9Dea2SecfzO7 X-MS-Exchange-AntiSpam-MessageData-1: vbN5fyraeTSUwV7sC5xEHJdROik7CfuZ3/4= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 19275f5a-ee93-4fe9-9362-08df128d155e X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:22:06.9191 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: peutWkNIVIhoNt9eLzQubHbkm2DLLWHsVL8GwwdBTuWlqDOhDbGQkCDBCzzxB+XdNjkmlzoW8Roqh+l+2ozCCQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB1302 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 19:29:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/bitbake-devel/message/20202 Call bb.utils.landlock_restrict_network() for tasks without the 'network' varflag. This to support basic network restrictions in unprivileged docker containers. Signed-off-by: David Nyström --- bin/bitbake-worker | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/bitbake-worker b/bin/bitbake-worker index 208f512fd..50380201c 100755 --- a/bin/bitbake-worker +++ b/bin/bitbake-worker @@ -293,6 +293,7 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask): bb.utils.disable_network(uid, gid) else: logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid)) + bb.utils.landlock_restrict_network() # exported_vars() expands each value, so it must be called before # empty_environment() below: an expansion that shells out needs the From patchwork Mon Sep 14 18:21:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98232 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C20BC88E6F for ; Mon, 14 Sep 2026 19:29:53 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.13]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4559.1789410132407216228 for ; Mon, 14 Sep 2026 11:22:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=T+pgujDl; spf=pass (domain: est.tech, ip: 52.101.65.13, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=gujQ//8vH83hAX++CJceMhTDB5ZtuGDA7RvWYrPyQtHSEeFeZrag/3E20tBfX8obhbYwZ7zMlG7jWSfsTDJdACmkdE4n1+12iZWccXNvQuA2scRZoWTKWYjMrQI+VcYE/qhsCdOy3svCgPUu8JxlWj8GN849PXvyzqsQX5MRarUSwq5BeYVJxNrKDTbbX8ACduWR7LmApd7PBWo9lYVcxmDaq+ujLxt27g4Gqe2NID57Qf2CgpPp1qooX5GFmdaC+Cevp/5pJlIPlN7tNAdKfelqw3QXMVmQCpYs9HorKIgtwcSUJgDW74J3tXeYOHkEt+CoImFBN61YVA/MijbOmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=pUTKWTQrKqJudG9FPrNtsFVCCyReg8PWcTFlm2az8Dg=; b=NFCb3IpoD1iVn+qkE89NAWL2cvPBft1NUrv/qHM7vI0J79ZXDUcG7DEPu2dZM6gAgjcOvy/ZuNDEuqUJqR2MxodDh7xOTdNDDKITFvDpOlFtvojqqVqeUTcDJq/Oj/yYMknzCeMvEAIybymcRUAQCYZzAtGfa1yVqfc08TPqQBKJo0m9PEByejrSajQF3WaS9eaXrNj/80PZ7yLrnR0EIy6XELmvrrmBdQlYNq6IP9LTWJgeykRGrlUHIm+mIWDmYU7vgmOQH0qpKZ7qN0yEUzjPAAYmwkSVFJ7a+EWY9JOfz6jzOxtmE4zvUstb8CrxT1PUTWWTTdrtFkX9g5gU9w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pUTKWTQrKqJudG9FPrNtsFVCCyReg8PWcTFlm2az8Dg=; b=T+pgujDlRVY3V6iSk75tb2k/XYd5qgDwD4QnrBt6KWSVAThfq6+asGOQX5Y1GUaBvMRuGVUktkLtPb5oB+d9P9WCMx29+lGJDJAZBXSiHblqsWk12YPUZyC+U7RTTE6OzhJd95bHKzyQLstlswHHG5VJaMlpdyITuWSsTlncpT47xcThylNgPn51qEoyrZl43QNHao9vbXS8NKwe2dnmc14lVod0GzD29/HC7+mikEU5+vwWUvVf6OyGifEs9g9Gv4g7mK/dAjfak7RUFfbJheSDYzSAOSLAGazr81gl8V2nXbKJJb8Z9jBVkyWWtl7PKQCQkxxVfKbiHE6xv8DO2w== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by AS8P189MB1302.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:2aa::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:22:10 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:22:10 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:21:42 +0200 Subject: [PATCH v2 3/5] doc: bitbake-user-manual-metadata: Doc change in default behaviour Message-ID: <20260914-landlock_try2-v2-3-0a1bad3579ec@est.tech> References: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> In-Reply-To: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> To: bitbake-devel@lists.openembedded.org CC: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789410117; l=1138; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=ecGizml/kW69/bAUhokv+n8CRnnEWaRnvb5Yn/RCpnU=; b=sG3U/3Tj7B2di7CaSjR027yy5Ai1jwFxIOzZXB6T3DV59cbTVFNTJuRbFEQqnhp8zfOVQOVIj U3SBVBpekwGAG32Yqv3n5oxy7bzFen7IfHT/zyFw8WwV4Qzu0P2NxY3 X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GV3PEPF0001DDA2.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:401::6c9) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|AS8P189MB1302:EE_ X-MS-Office365-Filtering-Correlation-Id: 52cf9b06-a96e-4c5f-e536-08df128d1757 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|10070799003|6133799003|18002099003|22082099003|3023799007|10067099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: Y5bLOeFhhQVmsayNrAiTCnf6RnExJ3sapHQ001pumT0ra3pnthzJWAo8VWiDz2K4GoEbo0YUecfGVt0RGu/Xmg6cRKPomy6f5LfJFjeXBFPOfpi82snKrLMBVeQfq533LUS6FkCaLP+PGOjR3TZ/vLAYSZKKqmgluMP3TDiQRFUYCxfNxRiJMFoMr9GmqulIYrSvdM9neflv9oTLF7X5ayeZVyseJChmSQk86uUIfkGxigxeg7qmAwPr7qeBsO9kAYR3ASPQD4wmEYZ0w1B32KTVxG8niKIUANZQNq1OgNHxVAzAi9PH/qd+1ED9HYZDP9vXC/TBM0zXS6gq3vQ9L/uwbRy/vvGZ24UJT2cDwTfW1RIt5YI8yLCG1p9nkh3QEWFxDmQ7ZRz3Hmx4ZSUPXm2rq43oDxJXzLv9tWuOg20FRjxTyQ3F1z1Wo86uloEzR/4Qw270BEiToTM9GerkePwoVI4yzOzVTluQCQZCbO9VqCK+k8TwzVSujHdDvWIGn3bDNuTOanHTvAXTG3YgtDsr6qgYrJAyp5vTF78xL99vb9alDaPakAcakaMbXiO5oj81SEhL9QQBbaMD1BEin/S85V6do073zkS9JgvXpW8tkIVuAYGlKrTUO04HOIZ81QHjtwaTzneIALWm7qDGuMiW018ials1m0eJntZ+O5s= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(10070799003)(6133799003)(18002099003)(22082099003)(3023799007)(10067099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: beWww0a/LBhXPvJaqtJy0iMIO8/yXxAquSEqFMDs2lVwJRy+kXXhqtUtQ8GreyievHggmZsO+AhopPadjqnG5nVUmtvTBRmMJWTwm9EiDPXoYrw99Q1La1GbP7SaoQtZTL8u895x39tlm1J+asJcFFvEw5AhHkHJWcPNl/ZeOiwDr3jhnJV6V+9Rcpuv5cspXaBMH+FFpjIVq33E+XdStFRuYybk1Z3CoYXHg2wcM+Y+7ard+hC6TuvKq5xT4tDRmj3wQa6+c8D6HlUfnetcUFMeHVWKaym/lL/bTEIPiqlZpLf1npuVh/SWMofkzoOQzCp5PGpPvZR5eX4+wDpNIJeABeAAfr+vDMCrcbay8SdLm7JQH4kovYptaY0caeLwefLvVg6xNfbRZkE8NiabPlcVRBBBQ5qP5QlkhTYOWtL0RK2HlBtJePMhVutlysL48t1FHbMcw4O0kC6/lyUpTcBILWhZE6zXgOLSNYF/gsJgpEZYGKOj73h4Toc1+7VCKAbgNNOmtosjjIfXnjVF09BNtvWHy+IMAfvwnDXiKL3PnEIdzIBtJs1/CyyMfDn2Qa4A4HP1xmvgV0X0YQGXWXbJ7LZpyo0QVmo1/YcXe2KBXKXLND7wOZWCfI9xAdMHNMOUhCu3jCl4I+8QOkWT+ZkBq7u0Icq5psq4ZY/sWazCDlhp4t0XWGC03B1UjzmuZP8pJGd55/WqNvX43cxSf+x1D76fOEjcZtx60a9C7xDpCchZmS5PdoZuEIoUUoeYceVr/OZ7Z+JMbl6mhPPirVXi6XJ2dTsk0BXqojfR0xid2AXlL3RgO19c+N4n1G1wLRBhR3gKb/O//wRz8Zxye7+4hGx+abTCP4hNW8u7/4QYHcn1x/GtEWKpd+kRFPoy7Vb4lMFnFYZohipPPgkcWpSq8T/cUplY+zzoNBaSNBbQdBIN1zGOLypgnx0kJofSLLPhvDNb8Y1ryzfmz9i6slav3exCqUb9fe2xeVrwbyf5bnzsQ2eKa38OtdmNcqDmhplT41AmXu+Ej7M/f7UKfLz6VpeBRB9PmDkLn6sRIrDwCGIYTxYvUDhj+vIkZrvBdVkd2ooz/WfdxHqdp5ogbZEk+66xlX4TmMoZtvEylKE4TjbPOBAFjD7v7Py/h2Q3m41Snr8HJCAmcDJLtv1HRC9qCJng8kr1ou7uGCgWWuRGDFbtvW3MBexi7NeoiWa+URhfTgMB7U6rtFTn/qQOmXWJdcLlWKkyu1ghCLs+aAUJ9fWn5/0/HMgN73C/HUaqqOiec9hQx26Tx9tvI+1k3wYfE5HGfktUm9Nj2YRZZtFiAHlGB3U9LhYq6+hfZi3WV7ShQUZ508zp3i+DGhZ7t/MJ9LpmdkNBrsmmbewzKaVSkJ3IsCrsTyxH9XjTX7FjKlIfpIMFKgyrBooqa2flQ12Sro6GZPtLKgCvFkAldu13z4R4bUVVQY9CcZMJ4MUn4AecLNYlObZAp8ZUh1YvXkW/3nPHjUFvyjL7Nhnqlq6lI0z5txJtfiOqEp99K/PTiebvy7LoBkrLh2mNUaRQSiVI90GnfVjLKUUaar8Phz+6WYXUSdVOeSIgwvHsCE6BqxklYzLwQ0J2Uc3TJP+Aa2TFqLhUukn/OgS9vhkh1/MlzcJCkZ0bHZi/ipg4/GhPIrI9e+YuteakJfELJc1ZKKgsLjd0yk97NCisNEj5m3cVSSTWHhpx9ZBIhSdA6Ay0OjqDvWTuQ+VVBJFqCfh4thO3fX3KWPaJKCLTE52V6TDf/prCoEXyVH02jfeb2bZMCcNz4L+r X-MS-Exchange-AntiSpam-MessageData-1: m51Uj2634FKLZNq5qU7bUmKBxiJx3j+kYCY= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 52cf9b06-a96e-4c5f-e536-08df128d1757 X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:22:10.2302 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: TcjzI/aq4t9siwqvjVNfxCQ4idGNBGMPliPiDBgupXdgheZGTLJAsT4wmeRqhbu30T7d1TNG1RbwpAh7DqCJ0Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P189MB1302 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 19:29:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/bitbake-devel/message/20203 Document the change in default tasks behaviour. The "network" tag is now needed for usage of setcap:ed binaries. Signed-off-by: David Nyström --- doc/bitbake-user-manual/bitbake-user-manual-metadata.rst | 3 +++ 1 file changed, 3 insertions(+) diff --git a/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst b/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst index 9cac793d3..621aab253 100644 --- a/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst +++ b/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst @@ -1791,6 +1791,9 @@ functionality of the task: shouldn't access the network outside of ``do_fetch`` as it usually undermines fetcher source mirroring, image and licence manifests, software auditing and supply chain security. + Tasks without the network flag will run with PR_SET_NO_NEW_PRIVS, + which prevents executables from gaining privileges through + file capabilities. - ``[noexec]``: When set to "1", marks the task as being empty, with no execution required. You can use the ``[noexec]`` flag to set up From patchwork Mon Sep 14 18:21:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98234 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11D42C88E72 for ; Mon, 14 Sep 2026 19:30:03 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.64]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4388.1789410138144222308 for ; Mon, 14 Sep 2026 11:22:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@est.tech header.s=selector1 header.b=g8t2yoNG; spf=pass (domain: est.tech, ip: 52.101.69.64, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jcZzt0tqkcYW3CrmVLdiODamauwEaeLvewZuCkHIIQDws3r+8mZCTsQnaDsjo4kTFpJv1h3u/aQesc4yF5/Bv26vF5Q8cqnxeuJYKn9viEVOGZ3i8RcOFH+7e1O7oMghl9Jud4HQYR/nLZI2YZW50fwLtggyc35I63mP1FonOH08wiEZfGv9+GQ2ZIVdysf+/bchhzIkn/uuQS6g91I2kCwlz1jIN0W7Ohw530cjzEBYfDv5QEHeEe1gE6Fp+BGxFIszS1Tx/se/O2I9RYADXsKHCekc6IWyrsMN9J/m0smbBGJsthZBXCSMMj33d22AWtBPnynGj6xzanoONVPFkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=c0rZllqUst3ccBn24Jt3r7rDewJmP9jAN43f/dLmUnk=; b=yFd4Bj0ViPJLosIEEm5F85LZwUQs2oE7qWI2jaQReJCKyqo79T4jxuL7B0rrdJAWwv5/66kd+2B51muEO49eI0GmvSsvmvGq1gc4LZnuTg2uWmyPOZbmb5zjf70t5DFzhGASObsk77mW4Nv3A+C8+v27fFAuaBvbCeBwIJ9UA1mSEzzpX1iuG4VctUfWm82HTzSU+KrN1n8spfEMGSIus8TT+rB3Fl6Io84Gl0nM9Hb5wkukcbjWgE+1IZbmLC/nFBaNUTSyjM1ZELwuVxOMpABSbL/zH7EeH/fTpVdJyUBImY8hQCRMFxIldMWZ+dzUledAJx56q158g+JNfc+zCg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=c0rZllqUst3ccBn24Jt3r7rDewJmP9jAN43f/dLmUnk=; b=g8t2yoNGTLSX9aF9HsEgV9dAFx2EFAEiWHuXyJn/A2OtrLuwfdwcoZMGtgSneVfd/69T0z9x+XcnfkTMhn3zN1CTGdaMjyT658Tv7IxDKGjjAC/j9M8BZ8f0cXtYcjoTnpqzrde2zWmtvhD/GnkPaUHsfdGMKPYB1u7GnbXzScwPD7VmzitJaWfDEei4e3/ICtKqqZ4hCs3zCDGrCee25WZN++XSnm1UMyd01tYvirdNQzKEA5Os2/JyroNpTh+S/8ejJ1sNLH/9jL+slLki4BhXR5PcwNQgcykn5z+dDKYXav1HopyHT+PPyFff+yVgMUIFhIhsd4zXwOZ/gYk4Ng== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by DU0P189MB3184.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:59f::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:22:13 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:22:13 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:21:43 +0200 Subject: [PATCH v2 4/5] bitbake-worker: Allow tasks to disable Landlock restrictions Message-Id: <20260914-landlock_try2-v2-4-0a1bad3579ec@est.tech> References: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> In-Reply-To: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> To: bitbake-devel@lists.openembedded.org Cc: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789410117; l=1175; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=5m8xZkun4kXpNzoeNSMFv6rl+zaoXnBmb89UPGpqhZg=; b=xpVGJ4PXGtJiS1pSsxCXbPjyE5UPjPa+xFylzTZDdLVwe4G9c+mV3VUHKZue7lJBesvEELgGB pYjM2C9TyRxBbkh7lCCAipdVENlsQ592kYwzsOF9HiEvb/IWVqtWM7d X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GVZP280CA0019.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:272::13) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|DU0P189MB3184:EE_ X-MS-Office365-Filtering-Correlation-Id: 8832c907-42e6-4eef-d6d7-08df128d1984 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|10070799003|18002099003|22082099003|10067099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: KWboYo/glFuHuYlibrk/vBfm1hD/TTzHIrc0+1AZA7mJQh6yP4H/Mn1l/r+TvenXOBzNn+iV2jZffZuyxx46JL14BNsnNHL+UbI5o/iF9QfeQ+3CLoLa6r9fJjmroSPFJZfS75N6/xwwVt6cSDqaGNOF7OHTbJOeXhVE/uFVnDsVVxdOFwsBqnlqF2u0zgleXNAwXJ4mdEImtsTD6kodjHC/J0Al39mFtk2HkX/7RMTOj7J6jfJRriivvvaSLfEHMgH+yNA5yyUk0QvwMGbdV+gaf0ETwNR2Z74ZTqZ1w1wMIbPMRtnyiUnIHV1QOpZYh9gHQE/ewfqnXdblN4sW05mylWFzgJF9xfeDtCiFhsRpvAUEO8Dgn5KxiBA1dj8Zbuhsy/YElbDLLBCBhCRf7gPwbi1Vg9RdUnLCVGQx7USM4GENH9IK4Fnjvae4firx1WVH8Ym88e/BusAamw3rXzEvw8SRH+UO+NKtiQE459G3/lP3ieBnCE2iwj3OE7t01B4U+8jbeJhP7PuODC57W2S7Y4pKVitxMCCSgpxP+iEaugjvtirN99QUcHL4OocuwYhXIBDU5MJaCOTFpU5bz/ZQ881kxqXYGxUS/QMeEQIgVJdAZjJwaug8hIMAOoXILxQrJf2pJg+ZFGlwy/RfLZgr112VOb1CMLU/TqRryhk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(10070799003)(18002099003)(22082099003)(10067099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?y2eH5k7wcgh88j+FF7ff91IKh60e?= =?utf-8?q?EVbo7tdqwouXMk4gQ1L+8nopWpJVxhtV3yhJPGQnwNWuVU66cOovIpjXTrqaeLTWN?= =?utf-8?q?6EqkYim5mYkEG3WbEEUba5sBFcweWlad+IQzCPpnfzTLcleedmiy+RI+8Yr32S7DI?= =?utf-8?q?LwqvY0Ez5Y2ryqoXTKR/jCBPvFtt/B4CUDUfffSbbvNj7lgm4+o9ZbaOIGeX/+Rm+?= =?utf-8?q?rxkd+8jmGZ0Ki12zUuvGaQO9cGdYS0asAn8urkvHa+ccrtuKSU3kO6dJXuq5pZJwn?= =?utf-8?q?Hupskubwvqmi+qbQERk17usEdK53uESfiPSNzfdomt8FYjvB/na+22ESpSa79hOKL?= =?utf-8?q?PFaoJq5Exh5HsAIcM4JvV0hTvtZgilrc17Hg6sG4IN4muo9vj+ZJLCqe0ri/OP9NH?= =?utf-8?q?NFdDXAehHOUHWwvGRM9xO3bD9wwVoT2ssJ/fLcV50BPWxxmyFHpioLjx+9n8touv9?= =?utf-8?q?m01XohlGbgM1+J6Tra7de7yahySkngfMJCNjwE/i3CVR7jqoZCk/M1GkBwxLvfk5y?= =?utf-8?q?daXYnjkKcAs/+O7ITi8VrKJ4k1rqLcJoUd0tYzjBw+HOD4XnZ/onqS7fRxv1sDwYI?= =?utf-8?q?4YJdNkFHh4hSWEuIx8jcHvuVnqYizmk/jvqlLtWwaOUBy1FC/aNmkmoDT4hV9Hz3q?= =?utf-8?q?YLBA3qlBu6zVZnjemytchAt9RnQIccEs/5SRm+o+qI0SRuFEXyCTeswhbFmBhniPt?= =?utf-8?q?MEaQ1+zKnxb8QxZ0f9iPsl+7OkCAdunZa/vCdprKSX3a0ZHbXZ604cE+/0CcO5xS4?= =?utf-8?q?QnttOPBPrHlf53DC8KyWHh/pY/uN6UCNQVSX/GFbhgDho2P14sjcG7fA+GmrzwQBW?= =?utf-8?q?hLxunVweAsWmnLKsTS49SHpioTMb7idVnx+Yw5bzMeYFG1T8Apge7P3ekTsG6cIjz?= =?utf-8?q?aEaZf1Fm0D2SWxbn5d/NxA+2aAv32s7d29auz4WsHrSVJdAhdtcoQW/irgblt2can?= =?utf-8?q?x1tcS4LIDbqFRmXdd+DStDe1GMCvTJcu3jiLcWBMkfvi5yD3dqcVzO5fBKQDIo00B?= =?utf-8?q?Cz602hXj4a22EY4+omkEHqEi5qHSJGWVZCagK1SWusHX5KYU6kA42hw6a8SsQYO/B?= =?utf-8?q?qGcXUR9Zu4TFBYwjU9b8mlu6FYJ/PLoFR+QxzFtkmJQuZ6d/wQY0eC8xN+KnF00b5?= =?utf-8?q?wnctwREH5aqObGHqo/cVhnzETtkFZ7N7u3V205pGSh5ob9zSywSWL/NdHc3OC/Xnd?= =?utf-8?q?lpRglfYRMUfxsqjSKQMxQ7KHcKnN/UDR2bBX9id3WdlUYRWk6HIsIeal1O9JQcDm8?= =?utf-8?q?WMUtD1qnhf8QshgnHlbz6kXkzKSXvJpcidUv7vIBxKd1XytHfzNCtAquQhrtx2iDx?= =?utf-8?q?7sstyl21D+aczQFt4qdl4OjAPp6gh1ys/wzWBhvSELFlkIfvp4Pf0QzuvF1uohI0h?= =?utf-8?q?KzF3itnng4naabaH0omPiagqwTbw9Xt5sz0DEZln+xb+OcNbJuoWrppq6FzYVD2ZA?= =?utf-8?q?HIIIkG80LuPBpZ1JV+9m+j8+IJ+9amN+aQVqoG24bGMU1wQc9F2XdKeFJxgPVb7Yp?= =?utf-8?q?DyCQL47lTX0LgYDTJ6pnmY8QgMduXIyI9P90VWBQ2o3NxcjKzCtH4vJJue57juW3P?= =?utf-8?q?5tzYbo3lYvlaHpf/tiGvztq9UauoNxFqKekGYo1UHtu3noHYje9vtMgS4cJMl5qEz?= =?utf-8?q?RSx24AFDk+urg9JpYgNIx98kx8izdchLOQtRWL0COyQODmBpxeMWmsoVKqrUgMSO4?= =?utf-8?q?p38D/ja9LFvpH+qkZ?= X-MS-Exchange-AntiSpam-MessageData-1: 3zHYdmEbkw9IxLlf23boqrFtorVFJbLyasc= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 8832c907-42e6-4eef-d6d7-08df128d1984 X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:22:13.8370 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 5eW9OuWKb2CIn8uc9zl9E0Qk+kon9atEWqQ/5IPlkuJy2Y8Iurc2mVDnCN9NOqh1k33DNwYkXkDXMFUgPMjlFQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0P189MB3184 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 19:30:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/bitbake-devel/message/20204 Honor a landlock-disable task varflag so individual tasks can opt out when PR_SET_NO_NEW_PRIVS is incompatible with their operation. Network namespace isolation remains enabled when available. AI-Generated: gpt-sol-5.6 --- bin/bitbake-worker | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bin/bitbake-worker b/bin/bitbake-worker index 50380201c..9a744ce56 100755 --- a/bin/bitbake-worker +++ b/bin/bitbake-worker @@ -293,7 +293,8 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask): bb.utils.disable_network(uid, gid) else: logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid)) - bb.utils.landlock_restrict_network() + if not bb.utils.to_boolean(the_data.getVarFlag(taskname, 'landlock-disable')): + bb.utils.landlock_restrict_network() # exported_vars() expands each value, so it must be called before # empty_environment() below: an expansion that shells out needs the From patchwork Mon Sep 14 18:21:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?David_Nystr=C3=B6m?= X-Patchwork-Id: 98235 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0DDD4C88E6F for ; Mon, 14 Sep 2026 19:30:13 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.31]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4568.1789410146914145815 for ; Mon, 14 Sep 2026 11:22:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@est.tech header.s=selector1 header.b=QHUoW/4R; spf=pass (domain: est.tech, ip: 52.101.65.31, mailfrom: david.nystrom@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sQNYNHR5B4sIjw1XVKuLMXPD398qc5K+rBTHTyhJC4DT5HmBqIVv2ez80YYbtWnrCfKuCsFqIPF/EUzht4FkvTJdk9AA01MrAErZpFlqF/DyfcOh0Z2pGIV18BRokNeimQtScpFLFqnWQhpwJmpH7EK4qqgeYC1UZ9d4HsU12ubLpm+Vrv6Z3sbEiNlhDdS79/08tvC5JvjiPkNjfBBzu0cO5/IrMakBR+HUl3pHNycPc3zPb4vz5J4lqEiUcNknVBBLjULzAuYM/6vS73aL1e24d47CoV0+ZD+pexank6UPx1hqj5kgJa8tJ38RdbHE4DZHPm35zzxdDZyobWRHfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=D2fUMcUWAfJJgsLCxF8S4VfObF+ZeJE2Kr1b8AGs2zM=; b=wscda+kams4JcS4XgQF5/U80lXNFs7RdxhrB841ZY1BMs5o91SoNbcWz+k5brHUp5E+xib/0e5p+FvA+Kwz7lsY/FGi6k6wGx4/fpdi4NwC5ezHB4/vDnbk60EzSOg7fqXJW4zlkevsA3Q8OF3KSjNV6OLWRkm2VLjefnENSDlG2wK7U0JZwcd7adSwkeNcqMZmWgntnAAjC6S4PflV4abr+DVukNLjB60p9JcXQsbsw1QGPED5T55HXFUyxnZF3H8Qkb+bl3mQKAeSvf6NXNlNxnEKutDPawACAFAr/8Y/Jq9ak8tDaZbtP/Po3y0YDfmGbkmx+KRuWh2GoTlDXqA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=D2fUMcUWAfJJgsLCxF8S4VfObF+ZeJE2Kr1b8AGs2zM=; b=QHUoW/4RG3feJosK4S0L0IfyF9dT7q32Ixq2GgzLhW+bQpxa9NzB35ZejDWVqgVhH29i/9AodUzoVFqTcHbLXFe7bcr844oFKqFSUvP3INhF3epaQDJXkchu3tlHhJyMY77IUtigAVNus0ZNg90MRcw233ai/8qhHOnLEJWUp7DIWuE+E+60p+FvZxemd3oIeHYtpPzNHKTHr88qIsvD6pfODblGPklMbeV78jZf14I9A1awJloAdfIMRUE0aesPmbKq0TqHNJoCz60Ytf+TYqxCGiTU21YVLoeyQPaP9SbZCFg8rsYbDKBitT5H0wCh/sqS0VbX0RsVRBIuvb0OGw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) by DU0P189MB3184.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:59f::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Mon, 14 Sep 2026 18:22:23 +0000 Received: from VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec]) by VI0P189MB3589.EURP189.PROD.OUTLOOK.COM ([fe80::149:d9cc:d017:c9ec%5]) with mapi id 15.21.0406.007; Mon, 14 Sep 2026 18:22:23 +0000 From: =?utf-8?q?David_Nystr=C3=B6m?= Date: Mon, 14 Sep 2026 20:21:44 +0200 Subject: [PATCH v2 5/5] doc: Document the landlock-disable task varflag Message-Id: <20260914-landlock_try2-v2-5-0a1bad3579ec@est.tech> References: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> In-Reply-To: <20260914-landlock_try2-v2-0-0a1bad3579ec@est.tech> To: bitbake-devel@lists.openembedded.org Cc: =?utf-8?q?David_Nystr=C3=B6m?= , docs@lists.yoctoproject.org, bruce.ashfield@gmail.com, mattias.jernberg@axis.com, peter.kjellerstedt@axis.com X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1789410117; l=1990; i=david.nystrom@est.tech; s=20251215; h=from:subject:message-id; bh=+uGR07Sz+MTefqsxiXqRPZ4WOHRmLR9sn/dPelhGNRg=; b=IZK46gl3Dml3/LeeKU9XJrHGL9iugVhmZVbGfRO3NWGZSkR+5oDjCfyzEP0hO6XaSzM7LLOi2 kQVsL9uO0r6BZBESifTS0vwKwZ1Fu8g4qN9WZ6Rz9v9FPAPpGbe0RVu X-Developer-Key: i=david.nystrom@est.tech; a=ed25519; pk=4E3iRjA+3w+a4ykfCHDoL5z4ONs9OcY4IN3pTwIG7Bs= X-ClientProxiedBy: GVZP280CA0057.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:271::11) To VI0P189MB3589.EURP189.PROD.OUTLOOK.COM (2603:10a6:800:2db::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0P189MB3589:EE_|DU0P189MB3184:EE_ X-MS-Office365-Filtering-Correlation-Id: 92fd87e4-16cb-4129-01b1-08df128d1f60 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|10070799003|6133799003|18002099003|22082099003|3023799007|10067099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: 0ZQhRBw+xgkjAyxD6DNlSu2pGiKlab02KA3C05sFl6JL4jWcOp0pSMI1xgkxt6sB28UudC3Pl1igTVTWrLHpGTjLKecMOgTYmHhOWwsNQq4KhRCo/7GHQrWOG9RdJb/iuX+gns0GXdsUjx9CH6XbcS30FKARlOSHzuKF782sqmC4h4Q2XBtjY8CSXLgt1IhvGPbKlvNyheO5qS5D/FCAg8B5kt46BknWHKnJcZTmaSHcOzhLdY3JQMXcvsH9dFy92ZH4/cSNKQ77Bsx3rzr7p7CyFzDtWLINv3mYiDuslcQ8jnvsl0x4AEBrIbZPgzdK2sYvkH50HAkpzAbDW93xSWFijDEkEVEfwZ9b9la3hFTAmZZEdUb5OCkuKIG3ZnNXzhvpkDqro2HjZBsL+2jF8sdtskXpcOPTGHnRJHiu4B168/oNwzW4cKyRtIHi0WiFnrIROKMXUHhxxI9XcqvwNnOzsYNfAaJNPhIGUDU8SX/RqDQgdlFchMBORLvnbKMKNrhkpozmkAaoOvA9UVWP2GFy6n+JeGwQ9wuIxGAsPQsEyLP1q8l1wLRUtMhK1QBAMedsnbJg5kKRwZqwVl7iDbSosFxLs1MqQQseonZn7Bcjkjy21Q2JCwBGSLGDYlVBQljbgPJ2hlg3XixXGsAEFuiRQPn3h56dhpxU/zJefVI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0P189MB3589.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(10070799003)(6133799003)(18002099003)(22082099003)(3023799007)(10067099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?ZBGT3NQs+32FJzYIekHUtGBGEdsf?= =?utf-8?q?ZWwwSGxXOJ+X/u4oAgnl/BE+yKGJURy1OWnI3Zfy+taliKOl6y9/HVZbAOXbKjvb5?= =?utf-8?q?lk+YL4Mvqw4ZtbYv41Bs+UVkPfelNNy33+RBbXoyWkhQdVvPqSM20Da2qPncc3fgU?= =?utf-8?q?jq06n+4cpyEhLeo0tO9VmWZ0j3dfwckRe7vKO/ChiL1rnpKR1sD/bWbEy7vD/KNYh?= =?utf-8?q?uTrYVhlE95Oh/XDHQgXbFfGPyTOWYYJyr0yhbOdhljf3uqTCPg98zhPdAsjKSspkw?= =?utf-8?q?ix24J7R7ZtVjpu6jHgQ0SM67YawQmDUO2QYw26IF+vzqT3GuF/eTi5w/3herGF8gd?= =?utf-8?q?w1fYx8jmI0KlU5EM+ZycVevr2K2p4GNxIE3a7fiYMm0c+fUg661fbjy8T8Njhdol5?= =?utf-8?q?y58HU4kvJR+wjnkEfBPTbv+gOkXdF1GWI9UvdB1YlEkJG8Pfn/qCH52tKO3fSrAHJ?= =?utf-8?q?sg4CoZGvPjyo2MSjMl5/vrUSoWRdRBE23VPKqTrCTV9OpiFYKGQKJqmwxBKyCWrmd?= =?utf-8?q?f353qjBgriNgsOwniD9nj3cRlPYmRp2N/56YP8LN3EwnDQXwqUWK3M2eVJLl+Nl+C?= =?utf-8?q?VoNJZQjsiJR0P1zUX0d+3BEu3A2aOJOQvnYluagF49h7uu7iwoZujC+il2/uCVYMA?= =?utf-8?q?ymH2AFNLLtBkir2B0kH9F82CcS9/hUgCalzl0tFd4pb1orP3cpNQ9yavpaAqv3Puc?= =?utf-8?q?dLIl7C82QWfURzEoS2ogGXe6gax9kpovUBwZlcE67CA+xDvQxSX1qOFtTUc/9SaJK?= =?utf-8?q?DYENK0JMsU2hdj8nbKMa+O1hShJ3RmJ7z1KIGHO4wvWCIahA71WfrGDA9H7TkmYSd?= =?utf-8?q?0R6luA2uldGcfDePnmbCe7amaAvopvGCTBd7mqIRyHIHOl08XofXVYHDGSFpGxSr0?= =?utf-8?q?eD4IbCcf01/7urRgPG8Ro8LhKzcDUhjIDXmke50u9DusjdFruvsGYKOlYLrODqdt/?= =?utf-8?q?YXnh4a7LrgYc59dROFw8BRuujpUS/afgTu5k9WpfhT4UmxBW8PfHRe72C9DxDAMK/?= =?utf-8?q?Zy37bgpF+6tyfZZ245KywEjz1K4litiJdl0LBaXwxl6eksBx1PxCxyVAGn7VoBhfC?= =?utf-8?q?tIVg87H5KdB7NAvRPzy6IWDa/AzG93uI0X7gJ/XghqmQ2yR6xLjP7VfKINlZ3fYig?= =?utf-8?q?F2v2IGkWlu/FWcidWEbawgRW8rdvUISCMnDQrENYBK/OBYL96DGoseoMHH0EfS+mx?= =?utf-8?q?jVtvBrS5Nt+3eRufOF+Di5Kth3bKDB2CanoOmkCqpCu2a6IQWK4GSvVGjzloDwo3R?= =?utf-8?q?+V9DZ0x3J7OJvLZ559q52lASUT8isDZfJVs/gSM6TSRCG7sf08ihwm/HFkr3ZzqmA?= =?utf-8?q?HHsVNWu6Lo2LomDDZJfATF4JfRRibPoYG8KwyfxbzvsYmr7CNy4K9SYrbz/2zhDzj?= =?utf-8?q?bPBgu8gQw5k1+EiBJYhsRfp8+sbXpXlLQBV0KPd6Yz3IcCBh0hcbT4L8nTAecCa5D?= =?utf-8?q?eEJBsAo5dx31dhfmJF4OqI3A6yPMscavjhzaGctLkBHpdwGjk2VAED9nhtm+M975T?= =?utf-8?q?av9SU5ttUe6cvA3IzoUW4SDB1hQHkCVLJQTDZ7vlChc2Ex2jE8NVAYUv+dKS4vynq?= =?utf-8?q?68xJWK+q4vc4f+Y6Dzq61b3/IU+9om0pa97cpxZQhzQV4moMc0sNTr/vSGpd0qosI?= =?utf-8?q?xq8pUSQB1ROdJVE31FTkzvB+KZQ4nngjXkN15RH4HaliClMEDoNpYP6KVr5MDv5hk?= =?utf-8?q?B2yW1uzTYzROlE5Fa?= X-MS-Exchange-AntiSpam-MessageData-1: 4SmE+L2z87zMhvyxqMpivNNV3VuZOM5ApOg= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 92fd87e4-16cb-4129-01b1-08df128d1f60 X-MS-Exchange-CrossTenant-AuthSource: VI0P189MB3589.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2026 18:22:23.6893 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 1/Mj+iKZWdUCLszocB/TJxKTjLFvQn9fAipmtM63e2oqxcjwHgwGwZuaMYy/W8veobXSu4GwV8EkTUhrS/lbOA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0P189MB3184 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 19:30:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/bitbake-devel/message/20205 Document how tasks can opt out of Landlock restrictions and clarify the resulting exception to PR_SET_NO_NEW_PRIVS behavior. Also, needed by users of enable_loopback_networking AI-Generated: gpt-5.6-sol --- doc/bitbake-user-manual/bitbake-user-manual-metadata.rst | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst b/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst index 621aab253..b67320f47 100644 --- a/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst +++ b/doc/bitbake-user-manual/bitbake-user-manual-metadata.rst @@ -1780,6 +1780,11 @@ functionality of the task: "exists" True or False value after the path allows this to be handled. +- ``[landlock-disable]``: When set to "1", disables Landlock + restrictions for the task. This can be used for tasks that need features + incompatible with Landlock, such as gaining privileges through file + capabilities. + - ``[lockfiles]``: Specifies one or more lockfiles to lock while the task executes. Only one task may hold a lockfile, and any task that attempts to lock an already locked file will block until the lock is @@ -1791,9 +1796,9 @@ functionality of the task: shouldn't access the network outside of ``do_fetch`` as it usually undermines fetcher source mirroring, image and licence manifests, software auditing and supply chain security. - Tasks without the network flag will run with PR_SET_NO_NEW_PRIVS, - which prevents executables from gaining privileges through - file capabilities. + Unless the ``landlock-disable`` flag is set, tasks without the network + flag run with PR_SET_NO_NEW_PRIVS, which prevents executables from gaining + privileges through file capabilities. - ``[noexec]``: When set to "1", marks the task as being empty, with no execution required. You can use the ``[noexec]`` flag to set up