1 |
On Tue, 6 Oct 2015 16:32:53 -0400 |
2 |
Mike Frysinger <vapier@g.o> wrote: |
3 |
|
4 |
> This helps isolate the catalyst builds from the rest of the system |
5 |
> and allows us to build as non-root user in more cases. This might |
6 |
> not work everywhere, but it's a start (snapshot generation works). |
7 |
> --- |
8 |
> catalyst/main.py | 9 +++++++++ |
9 |
> 1 file changed, 9 insertions(+) |
10 |
> |
11 |
> diff --git a/catalyst/main.py b/catalyst/main.py |
12 |
> index 65e1431..f984653 100644 |
13 |
> --- a/catalyst/main.py |
14 |
> +++ b/catalyst/main.py |
15 |
> @@ -10,6 +10,8 @@ import argparse |
16 |
> import os |
17 |
> import sys |
18 |
> |
19 |
> +from snakeoil.process import namespaces |
20 |
> + |
21 |
> __selfpath__ = os.path.abspath(os.path.dirname(__file__)) |
22 |
> |
23 |
> from DeComp.definitions import (COMPRESS_DEFINITIONS, |
24 |
> DECOMPRESS_DEFINITIONS, @@ -336,6 +338,13 @@ def main(): |
25 |
> if "target" not in addlargs: |
26 |
> raise CatalystError("Required value \"target\" not |
27 |
> specified.") |
28 |
> + # Start off by creating unique namespaces to run in. |
29 |
> + namespaces.simple_unshare( |
30 |
> + mount=True, uts=True, ipc=True, pid=True, net=False, |
31 |
> user=True, |
32 |
> + hostname='catalyst') |
33 |
> + |
34 |
> + # We should be root now, either a real root, or in a userns |
35 |
> as root. |
36 |
> + # If we aren't, then we've failed, and need to abort. |
37 |
> if os.getuid() != 0: |
38 |
> # catalyst cannot be run as a normal user due to |
39 |
> chroots, mounts, etc print "!!! catalyst: This script requires root |
40 |
> privileges to operate" |
41 |
|
42 |
I was hoping to get a release out before merging much more, but, I |
43 |
doubt this will affect stability. |
44 |
|
45 |
looks good |
46 |
|
47 |
-- |
48 |
Brian Dolbec <dolsen> |