Bug 659582

Summary:	sys-apps/portage: support FEATURES=pid-sandbox
Product:	Portage Development	Reporter:	Zac Medico <zmedico>
Component:	Core	Assignee:	Portage team <dev-portage>
Status:	RESOLVED FIXED
Severity:	normal	CC:	poncho
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	All
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=602706 https://bugs.gentoo.org/show_bug.cgi?id=677890 https://bugs.gentoo.org/show_bug.cgi?id=344555 https://bugs.gentoo.org/show_bug.cgi?id=675312
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	671498

Description Zac Medico gentoo-dev

2018-06-29 08:03:03 UTC

In util-linux-2.32, unshare --pid --kill-child uses a pid namespace to implement behavior like FEATURES=cgroup, which has the advantage that there's no need for special interaction with systemd as discussed in bug 602706.

Comment 1 Larry the Git Cow gentoo-dev

2018-11-18 12:25:30 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/proj/portage.git/commit/?id=88ba0f45b54609666445c7f8008ff699eef52b39

commit 88ba0f45b54609666445c7f8008ff699eef52b39
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2018-11-11 11:48:24 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2018-11-18 12:24:52 +0000

    Support FEATURES=pid-sandbox
    
    Supporting using PID namespace in order to isolate the ebuild processes
    from host system, and make it possible to kill them all easily
    (similarly to cgroups but easier to use).
    
    Bug: https://bugs.gentoo.org/659582
    Reviewed-by: Zac Medico <zmedico@gentoo.org>
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 lib/portage/const.py                   |  1 +
 lib/portage/package/ebuild/doebuild.py |  8 ++++--
 lib/portage/process.py                 | 48 ++++++++++++++++++++++++++++++----
 man/make.conf.5                        |  7 +++++
 4 files changed, 57 insertions(+), 7 deletions(-)

Comment 2 Zac Medico gentoo-dev

2019-04-10 04:35:41 UTC

Fixed in portage-2.3.62.