Bug 481450 – sys-apps/portage: FEATURES=network-sandbox to unshare() networking in ebuilds

• Product: Portage Development
• Status: RESOLVED FIXED

[Description Michał Górny 2013-08-17 10:49:29 UTC]

Since ebuilds are not supposed to access network directly, except for very special cases, let's ensure they don't.

I'm attaching a patch that uses Linux's unshare() syscall to detach phases other than pkg_*() and src_unpack() from host networking.

What still needs to be done:

1. Some FEATURES key should be added for it. So we could start testing and deploying it without causing world-spread breakage.

2. 'ifconfig lo up' or equivalent should be put somewhere. unshare() creates a new, local loopback that needs to be up'ed to let apps use it.


Advantages:

1. We no longer have to wait for Diego to point out that tests use network :).

2. The ugly things like setuptools fetching itself are caught before they do damage.

3. Tests no longer can interfere with host's daemons -- like mongodb front-end tests writing to the production database running on the host (not that mongodb is suitable for anything production).

4. Daemons spawned during tests can not be accessed outside of the namespace. That is, random broken tests don't spawn security holes.

[Comment 1 Michał Górny 2013-08-17 10:50:35 UTC]

Created attachment 356282 [details, diff]
Unshare networking in ebuilds

[Comment 2 Michał Górny 2013-08-17 20:16:42 UTC]

Created attachment 356320 [details, diff]
2. Add FEATURES=network-sandbox

[Comment 3 Michał Górny 2013-08-17 20:16:59 UTC]

Created attachment 356322 [details, diff]
3. Cache libc find_library()

[Comment 4 Michał Górny 2013-08-17 20:17:10 UTC]

Created attachment 356324 [details, diff]
4. Enable loopback after unshare()

[Comment 5 Zac Medico 2013-08-17 20:46:06 UTC]

Thanks, this is in git:

http://git.overlays.gentoo.org/gitweb/?p=proj/portage.git;a=commit;h=39db5201e087156ed46f6cac4dc9a69a2f3cc81c

[Comment 6 Zac Medico 2013-08-22 04:51:00 UTC]

This is fixed in 2.2.1.