RE: [PATCH v6 10/21] meta: mark network and sudo tasks

["Schmidt, Adriaan" <adriaan.schmidt@siemens.com>]

Henning Schild, Freitag, 16. Dezember 2022 16:05:
> Am Fri, 16 Dec 2022 17:52:22 +0300
> schrieb Anton Mikanovich <amikan@ilbers.de>:
> 
> > 16.12.2022 17:49, Henning Schild wrote:
> > > Am Tue, 13 Dec 2022 15:52:54 +0300
> > > schrieb Anton Mikanovich <amikan@ilbers.de>:
> > >
> > >> Network access from tasks is now disabled by default. This means
> > >> that tasks accessing the network need to be marked as such with
> > >> the network flag.
> > > Will these tasks really somehow be blocked from the network?
> > >
> > > We do use BB_NO_NETWORK in several places. Especially in
> > > isar_export_proxies we use it to block network with a deadend_proxy.
> > > That might not be needed any longer.
> > >
> > > Any maybe we find a way to automatically call isar_export_proxies
> > > when we set [network] = 1 in any given task. Otherwise we kind of
> > > have two lines marking a task as network user, and it is easy to
> > > forget the proxies since not everyone has to deal with them.
> > >
> > > Henning
> >
> > Untagged tasks will not be blocked, but failed during the build
> > instead. So this will not cover BB_NO_NETWORK use case.
> 
> Can you explain what you mean with "failed during the build". If it
> gets killed the moment it tries to network ... that is what i called
> "blocking".

Quoting from an email I sent earlier this year:

- new task flag "[network]", which is needed on tasks requiring network
  access. If it is not set, networking is disabled by cloning into a new
  namespace. The current bitbake implementation creates a new namespace for
  network and user, with the latter breaking use of sudo. p1 would be
  the corresponding upstream change in bitbake to make sudo work, as an alternative
  to adding "[network] = 1" to all tasks (which I tested, and which also works).

Adriaan

> And for the proxy that this is kind of what we want with this deadend.
> Make sure a task does not access the network when we want to run the
> whole build offline. We make it fail ... we block it.
> 
> Henning
>