Re: [PATCH v2 00/18] Migrate to Bitbake 2.0

[Anton Mikanovich <amikan@ilbers.de>]

19.07.2022 14:36, Schmidt, Adriaan wrote:
> Anton Mikanovich, Freitag, 15. Juli 2022 08:04:
>> This patchset moves Isar to use Bitbake 2.0 branch.
> Hi Anton,
>
> Looks great overall!
>
>> scripts/contrib/convert-overrides.py is the script for overrides update and
>> it
>> needs some testing on downstream layers. Usage:
>> $ ./scripts/contrib/convert-overrides.py meta-customlayer
> I found a number of variables in the image(r) context in meta that we use with
> overrides, and that are not yet covered by the conversion script:
> IMAGE_FSTYPES
> IMAGE_SRC_URI
> IMAGE_TEMPLATE_FILES
> IMAGE_TEMPLATE_VARS
> IMAGE_CMD_REQUIRED_ARGS
> IMAGE_FULLNAME
> CONVERSION_DEPS
> BUILDCHROOT_PREINSTALL
> IMAGER_BUILD_DEPS
> IMAGER_INSTALL
>
> And then there's the issue with the [network] flag we currently add to
> tasks that need network, but also to those that use sudo.
> I'm not sure if there's a reason why bitbake creates a new user namespace
> when disabling network. We could discuss with upsteam. This patch would
> enable sudo for Isar:
> ---
> diff --git a/bitbake/lib/bb/utils.py b/bitbake/lib/bb/utils.py
> index 05adb415..d11da978 100644
> --- a/bitbake/lib/bb/utils.py
> +++ b/bitbake/lib/bb/utils.py
> @@ -1618,7 +1618,7 @@ def disable_network(uid=None, gid=None):
>       if gid is None:
>           gid = os.getgid()
>   
> -    ret = libc.unshare(CLONE_NEWNET)
> +    ret = libc.unshare(CLONE_NEWNET | CLONE_NEWUSER)
>       if ret != 0:
>           logger.debug("System doesn't suport disabling network without admin privs")
>           return
> ---
>
> Adriaan

Hello, Adriaan

I've just send v3 which is already good enough to pass CI tests.
Will look into imagetypes-related vars for the next version.

Does CLONE_NEWUSER flag disable network task checking also?
If yes, this is not the right way, because we should keep documented 
bitbake checks.