Re: [PATCH 1/1] Add proxy support to isar-image-*.bb and buildchroot.bb

[Henning Schild <henning.schild@siemens.com>]

Am Mon, 11 Sep 2017 12:55:00 +0200
schrieb Andreas Reichel <andreas.reichel.ext@siemens.com>:

> On Fri, Sep 08, 2017 at 10:02:04AM +0200, Henning Schild wrote:
> > Am Fri, 8 Sep 2017 09:37:38 +0200
> > schrieb "[ext] Henning Schild" <henning.schild@siemens.com>:
> >   
> > > Thanks for looking into this and finally finding a solution. More
> > > comments inline.
> > > 
> > > Am Thu, 7 Sep 2017 17:03:35 +0200
> > > schrieb "Andreas J. Reichel" <andreas.reichel.ext@siemens.com>:
> > >   
> > > > From: Andreas Reichel <andreas.reichel.ext@siemens.com>
> > > >   
> > > 
> > > I know that the env was already cleared and that it should be
> > > safe to use "sudo -E". What about the following?
> > > 
> > > sudo http_proxy=$http_proxy ... no_proxy=$no_proxy
> > > multistrap ...  
> > 
> > Well this would actually be pretty dangerous. The right side of the
> > 4 assignments needs to get quoted and we should be safe.
> > 
> > sudo http_proxy="$http_proxy" ... no_proxy="$no_proxy"
> > multistrap ... 
> 
> Why so complicated. As you said, you know that environment is cleared.
> So there is no point in hardcoding proxy settings variables here.

From my Mail:
It makes truly clear which variables should be set. There is not risk
to keep anything in addition and the comment can go away.

But yeah, not too important.

Henning

> > Problem without the quotes, one could put commands into the
> > variables and execute them with sudo:  
> 
> Security concerns are out of topic here. The problem is always given
> when using sudo - as already known and already thought about. So in my
> opinion it is not useful to introduce variable exports with extra
> security concerns here instead of just relying on bitbake's
> environment clearing. Because that's what bitbake's implementation is
> about.
> 
> Andreas
>