Re: [PATCH v6 10/21] meta: mark network and sudo tasks

[Henning Schild <henning.schild@siemens.com>]

Am Fri, 16 Dec 2022 16:09:44 +0100
schrieb "Schmidt, Adriaan (T CED SES-DE)" <adriaan.schmidt@siemens.com>:

> Henning Schild, Freitag, 16. Dezember 2022 16:05:
> > Am Fri, 16 Dec 2022 17:52:22 +0300
> > schrieb Anton Mikanovich <amikan@ilbers.de>:
> >   
> > > 16.12.2022 17:49, Henning Schild wrote:  
> > > > Am Tue, 13 Dec 2022 15:52:54 +0300
> > > > schrieb Anton Mikanovich <amikan@ilbers.de>:
> > > >  
> > > >> Network access from tasks is now disabled by default. This
> > > >> means that tasks accessing the network need to be marked as
> > > >> such with the network flag.  
> > > > Will these tasks really somehow be blocked from the network?
> > > >
> > > > We do use BB_NO_NETWORK in several places. Especially in
> > > > isar_export_proxies we use it to block network with a
> > > > deadend_proxy. That might not be needed any longer.
> > > >
> > > > Any maybe we find a way to automatically call
> > > > isar_export_proxies when we set [network] = 1 in any given
> > > > task. Otherwise we kind of have two lines marking a task as
> > > > network user, and it is easy to forget the proxies since not
> > > > everyone has to deal with them.
> > > >
> > > > Henning  
> > >
> > > Untagged tasks will not be blocked, but failed during the build
> > > instead. So this will not cover BB_NO_NETWORK use case.  
> > 
> > Can you explain what you mean with "failed during the build". If it
> > gets killed the moment it tries to network ... that is what i called
> > "blocking".  
> 
> Quoting from an email I sent earlier this year:
> 
> - new task flag "[network]", which is needed on tasks requiring
> network access. If it is not set, networking is disabled by cloning
> into a new namespace. The current bitbake implementation creates a
> new namespace for network and user, with the latter breaking use of
> sudo. p1 would be the corresponding upstream change in bitbake to
> make sudo work, as an alternative to adding "[network] = 1" to all
> tasks (which I tested, and which also works).

Ouch. The network part is nice, but sudo really is not.

Maybe we need

I_USE_SUDO = 1
I USE_NETWORK = 1
I_USE_SUDO_AND_NETWORK = 1

and try to set [network] accordingly ... in the end it will always be 1
but we remember why we set it to 1.

Henning

> Adriaan
> 
> > And for the proxy that this is kind of what we want with this
> > deadend. Make sure a task does not access the network when we want
> > to run the whole build offline. We make it fail ... we block it.
> > 
> > Henning
> >   
>