[PATCH [RFC] 2/2] bitbake-worker: Call landlock_restrict_network for tasks without network

Call bb.utils.landlock_restrict_network() for tasks without the 'network'
varflag. This to support basic network restrictions in unprivileged
docker containers.

Signed-off-by: David Nyström <[email protected]>
---
 bin/bitbake-worker | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bin/bitbake-worker b/bin/bitbake-worker
index aa14ef191..5f3fd9933 100755
--- a/bin/bitbake-worker
+++ b/bin/bitbake-worker
@@ -287,6 +287,8 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask):
                         bb.utils.disable_network(uid, gid)
                     else:
                         logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid))
+                    if not bb.utils.landlock_restrict_network():
+                        logger.debug("Skipping Landlock network restriction for %s since kernel lacks ABI v4+ support." % taskname)
 
                 # exported_vars() returns a generator which *cannot* be passed to os.environ.update() 
                 # successfully. We also need to unset anything from the environment which shouldn't be there 

-- 
2.53.0