RE: [PATCH v2 00/18] Migrate to Bitbake 2.0

["Schmidt, Adriaan" <adriaan.schmidt@siemens.com>]

Anton Mikanovich, Dienstag, 19. Juli 2022 15:10:
> 19.07.2022 14:36, Schmidt, Adriaan wrote:
> > Anton Mikanovich, Freitag, 15. Juli 2022 08:04:
> >> This patchset moves Isar to use Bitbake 2.0 branch.
> > Hi Anton,
> >
> > Looks great overall!
> >
> >> scripts/contrib/convert-overrides.py is the script for overrides update
> and
> >> it
> >> needs some testing on downstream layers. Usage:
> >> $ ./scripts/contrib/convert-overrides.py meta-customlayer
> > I found a number of variables in the image(r) context in meta that we use
> with
> > overrides, and that are not yet covered by the conversion script:
> > IMAGE_FSTYPES
> > IMAGE_SRC_URI
> > IMAGE_TEMPLATE_FILES
> > IMAGE_TEMPLATE_VARS
> > IMAGE_CMD_REQUIRED_ARGS
> > IMAGE_FULLNAME
> > CONVERSION_DEPS
> > BUILDCHROOT_PREINSTALL
> > IMAGER_BUILD_DEPS
> > IMAGER_INSTALL
> >
> > And then there's the issue with the [network] flag we currently add to
> > tasks that need network, but also to those that use sudo.
> > I'm not sure if there's a reason why bitbake creates a new user namespace
> > when disabling network. We could discuss with upsteam. This patch would
> > enable sudo for Isar:
> > ---
> > diff --git a/bitbake/lib/bb/utils.py b/bitbake/lib/bb/utils.py
> > index 05adb415..d11da978 100644
> > --- a/bitbake/lib/bb/utils.py
> > +++ b/bitbake/lib/bb/utils.py
> > @@ -1618,7 +1618,7 @@ def disable_network(uid=None, gid=None):
> >       if gid is None:
> >           gid = os.getgid()
> >
> > -    ret = libc.unshare(CLONE_NEWNET)
> > +    ret = libc.unshare(CLONE_NEWNET | CLONE_NEWUSER)
> >       if ret != 0:
> >           logger.debug("System doesn't suport disabling network without
> admin privs")
> >           return
> > ---
> >
> > Adriaan
> 
> Hello, Adriaan
> 
> I've just send v3 which is already good enough to pass CI tests.
> Will look into imagetypes-related vars for the next version.
> 
> Does CLONE_NEWUSER flag disable network task checking also?
> If yes, this is not the right way, because we should keep documented
> bitbake checks.

Aah... sorry, for some reason I posted that patch above in reverse...

So, to clarify:
Currently bitbake uses "libc.unshare(CLONE_NEWNET | CLONE_NEWUSER)" on tasks
that don't have [network] = "1". The CLONE_NEWUSER is what breaks sudo for us.

Removing that (i.e., changing to "libc.unshare(CLONE_NEWNET)") would mean
we still need to set [network], but only on those tasks that actually need network,
and sudo would work in all tasks.

Adriaan