Re: [gentoo-dev] RFC: enabling ipc-sandbox & network-sandbox by default

[Michał Górny]

Dnia 2014-05-12, o godz. 12:07:11
"Rick \"Zero_Chaos\" Farina" <zerochaos@g.o> napisał(a):

> What about talking to local network resources?  In my metasploit ebuild
> it has tests available which talk to a local database and are perfectly
> safe, however, if postgresql is started on the system the tests don't
> work, the ebuild needs to start it's own postgresql to run the tests.

How can you assume that the tests are perfectly safe? What do the tests
do exactly?

> This seems a bit needless in my package, but likely saves others from
> poorly written tests.  Do we want to allow access to system network
> services or block them? Right now they are blocked, and that's going to
> make the src_test function on my ebuild expand into near insanity to fix.

I'd rather not get into allowing exceptions for the rule without
knowing a good use case first. I can expand on that once the previous
question is answered.

I wouldn't call spawning a daemon that close to insanity. For those who
haven't seen such a thing yet -- dev-python/pymongo is an example where
I fixed a similar issue (writing into production database). Though it's
bit hacky since I needed a way to bind to a random free port -- with
network namespaces it'd be easier as Rich noted, since the ebuild would
have all ports free.

-- 
Best regards,
Michał Górny