Re: [bitbake-devel] [PATCH RFC 0/2] bitbake: Add basic landlock support

--832332988958181617842170541250322
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: QUOTED-PRINTABLE



On Thu, 16 Jul 2026, Richard Purdie wrote:

> Hi David,
>
> On Fri, 2026-06-12 at 13:38 +0200, David Nystr=C3=B6m via lists.openembed=
ded.org wrote:
>> When current implementation runs in an unprivileged docker container,
>> basic networking will be allowed by default in all steps, ignoring the
>> network varflags intention.
>> Introduce support for landlock blocking of bind and connect, providing
>> basic support for blocking TCP.
>> UDP is corrently beeing worked on upstream, but not yet supported.
>>
>> Landlock requires PR_SET_NO_NEW_PRIVS to prevent escape,
>> which is also attempted, this prevents privilege escalation from child.
>> devshell and related are already tagged with network varflag and
>> can sudo at will.
>>
>> syscall ABI is asm-generic, 5.13+ for all archs except alpha.
>> On alpha, we leak 2 fd:s in the childs context before graceful exit,
>> which is cleaned up at child termination.
>> Don't have an alpha target, so this is not tested, evaluated via
>> static analysis only.
>>
>> Landlock also provides a future possibility for filesystem
>> limitations with the purpose of catching bugs, and preventing
>> persistance of supply chain releated payloads. writes to f.ex.
>> .bashrc and friends.
>>
>> Signed-off-by: David Nystr=C3=B6m <[email protected]>
>> ---
>> David Nystr=C3=B6m (2):
>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 utils: Add landlock_restrict_network func=
tion
>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 bitbake-worker: Call landlock_restrict_ne=
twork for tasks without network
>>
>> =C2=A0bin/bitbake-worker |=C2=A0 2 ++
>> =C2=A0lib/bb/utils.py=C2=A0=C2=A0=C2=A0 | 26 ++++++++++++++++++++++++++
>> =C2=A02 files changed, 28 insertions(+)
>
> I think this has generally has positive comments, we just need to take
> Paul's review comments into account about the magic numbers. Would you
> be able to send a version with those tweaks?

Yes, thanks for the review, and sorry for the late reply.
Will reroll with comments.

> Thanks,
>
> Richard
>=

--832332988958181617842170541250322--