From: Richard Purdie <richard.purdie@linuxfoundation.org>
To: bitbake-devel@lists.openembedded.org
Subject: [PATCH 1/2] utils: Add disable_network function
Date: Wed, 22 Dec 2021 23:19:06 +0000 [thread overview]
Message-ID: <20211222231907.1036709-1-richard.purdie@linuxfoundation.org> (raw)
Add a function which uses the unshare glibc call to disable networking
in the current process. This doesn't work on older distros/kernels
but will on more recent ones so for now we simply ignore the cases we
can't execute on. uid/gid can be passed in externally so this can
work with pseudo/fakeroot contexts.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
lib/bb/utils.py | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/lib/bb/utils.py b/lib/bb/utils.py
index d890ea832e..8006f7bd2d 100644
--- a/lib/bb/utils.py
+++ b/lib/bb/utils.py
@@ -26,6 +26,7 @@ import errno
import signal
import collections
import copy
+import ctypes
from subprocess import getstatusoutput
from contextlib import contextmanager
from ctypes import cdll
@@ -1594,6 +1595,36 @@ def set_process_name(name):
except:
pass
+def disable_network(uid=None, gid=None):
+ """
+ Disable networking in the current process if the kernel supports it, else
+ just return after logging to debug. To do this we need to create a new user
+ namespace, then map back to the original uid/gid.
+ """
+ libc = ctypes.CDLL('libc.so.6')
+
+ # From sched.h
+ # New user namespace
+ CLONE_NEWUSER = 0x10000000
+ # New network namespace
+ CLONE_NEWNET = 0x40000000
+
+ if uid is None:
+ uid = os.getuid()
+ if gid is None:
+ gid = os.getgid()
+
+ ret = libc.unshare(CLONE_NEWNET | CLONE_NEWUSER)
+ if ret != 0:
+ logger.debug("System doesn't suport disabling network without admin privs")
+ return
+ with open("/proc/self/uid_map", "w") as f:
+ f.write("%s %s 1" % (uid, uid))
+ with open("/proc/self/setgroups", "w") as f:
+ f.write("deny")
+ with open("/proc/self/gid_map", "w") as f:
+ f.write("%s %s 1" % (gid, gid))
+
def export_proxies(d):
""" export common proxies variables from datastore to environment """
import os
--
2.32.0
next reply other threads:[~2021-12-22 23:19 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-22 23:19 Richard Purdie [this message]
2021-12-22 23:19 ` [PATCH 2/2] bitbake-worker: Respect nonetwork task flag Richard Purdie
2021-12-23 12:18 ` [bitbake-devel] " Quentin Schulz
2021-12-23 15:10 ` [bitbake-devel] [PATCH 1/2] utils: Add disable_network function Jose Quaresma
[not found] ` <3a672c37d4cd375fed43b59d887c9dcd17c60ee8.camel@linuxfoundation.org>
2022-02-02 12:38 ` Jose Quaresma
[not found] ` <1699ebd54f3414641b7ff78e1cec2bc546b658cf.camel@linuxfoundation.org>
2022-02-02 14:59 ` Jose Quaresma
2023-03-13 4:57 ` ChenQi
2022-01-07 23:15 Richard Purdie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211222231907.1036709-1-richard.purdie@linuxfoundation.org \
--to=richard.purdie@linuxfoundation.org \
--cc=bitbake-devel@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.