Re: [bitbake-devel] [PATCH [RFC] 2/2] bitbake-worker: Call landlock_restrict_network for tasks without network

Paul Barker <[email protected]> Mon, 15 Jun 2026 09:30:00 +0100

Newsgroups	org.openembedded.lists.bitbake-devel
Message-ID	<[email protected]>

On Fri, 2026-06-12 at 13:38 +0200, David Nyström wrote:
> Call bb.utils.landlock_restrict_network() for tasks without the 'network'
> varflag. This to support basic network restrictions in unprivileged
> docker containers.
> 
> Signed-off-by: David Nyström <[email protected]>
> ---
>  bin/bitbake-worker | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/bin/bitbake-worker b/bin/bitbake-worker
> index aa14ef191..5f3fd9933 100755
> --- a/bin/bitbake-worker
> +++ b/bin/bitbake-worker
> @@ -287,6 +287,8 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask):
>                          bb.utils.disable_network(uid, gid)
>                      else:
>                          logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid))
> +                    if not bb.utils.landlock_restrict_network():
> +                        logger.debug("Skipping Landlock network restriction for %s since kernel lacks ABI v4+ support." % taskname)

In disable_network, the logger.debug() calls for failure are handled
within the function instead of by the caller. We should do the same for
landlock_restrict_network() as suggested in my reply to patch 1/2 and
drop the debug print from here.

>  
>                  # exported_vars() returns a generator which *cannot* be passed to os.environ.update() 
>                  # successfully. We also need to unset anything from the environment which shouldn't be there 

Best regards,

-- 
Paul Barker

signature.asc (application/pgp-signature, 252 B)