Re: [bitbake-devel] [PATCH RFC 0/2] bitbake: Add basic landlock support

Hi David,

On Fri, 2026-06-12 at 13:38 +0200, David Nystr=C3=B6m via lists.openembedde=
d.org wrote:
> When current implementation runs in an unprivileged docker container,
> basic networking will be allowed by default in all steps, ignoring the
> network varflags intention.
> Introduce support for landlock blocking of bind and connect, providing
> basic support for blocking TCP.
> UDP is corrently beeing worked on upstream, but not yet supported.
>=20
> Landlock requires PR_SET_NO_NEW_PRIVS to prevent escape,=20
> which is also attempted, this prevents privilege escalation from child.
> devshell and related are already tagged with network varflag and
> can sudo at will.
>=20
> syscall ABI is asm-generic, 5.13+ for all archs except alpha.
> On alpha, we leak 2 fd:s in the childs context before graceful exit,
> which is cleaned up at child termination.
> Don't have an alpha target, so this is not tested, evaluated via=20
> static analysis only.
>=20
> Landlock also provides a future possibility for filesystem
> limitations with the purpose of catching bugs, and preventing
> persistance of supply chain releated payloads. writes to f.ex.=20
> .bashrc and friends.
>=20
> Signed-off-by: David Nystr=C3=B6m <[email protected]>
> ---
> David Nystr=C3=B6m (2):
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 utils: Add landlock_restrict_network funct=
ion
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 bitbake-worker: Call landlock_restrict_net=
work for tasks without network
>=20
> =C2=A0bin/bitbake-worker |=C2=A0 2 ++
> =C2=A0lib/bb/utils.py=C2=A0=C2=A0=C2=A0 | 26 ++++++++++++++++++++++++++
> =C2=A02 files changed, 28 insertions(+)

I think this has generally has positive comments, we just need to take
Paul's review comments into account about the magic numbers. Would you
be able to send a version with those tweaks?

Thanks,

Richard