Gentoo Archives: gentoo-dev

From: Mike Gilbert <floppym@g.o>
To: Gentoo Dev <gentoo-dev@l.g.o>
Subject: Re: [gentoo-dev] RFC: enabling ipc-sandbox & network-sandbox by default
Date: Mon, 12 May 2014 16:50:37
Message-Id: CAJ0EP4099sWz6aUCjzCEiEpHaGRSDWvEN0YHkxXwp6C=hENvGw@mail.gmail.com
In Reply to: Re: [gentoo-dev] RFC: enabling ipc-sandbox & network-sandbox by default by Ciaran McCreesh
1 On Mon, May 12, 2014 at 12:46 PM, Ciaran McCreesh
2 <ciaran.mccreesh@××××××××××.com> wrote:
3 > On Mon, 12 May 2014 12:44:38 -0400
4 > Mike Gilbert <floppym@g.o> wrote:
5 >> On Mon, May 12, 2014 at 11:59 AM, Ciaran McCreesh
6 >> <ciaran.mccreesh@××××××××××.com> wrote:
7 >> > On Mon, 12 May 2014 17:46:57 +0200
8 >> > Alexander Berntsen <bernalex@g.o> wrote:
9 >> >> On 12/05/14 17:23, Ciaran McCreesh wrote:
10 >> >> > A flag being present or not in FEATURES does not mean anything,
11 >> >> > and if you're assuming that it does then you have a bug.
12 >> >> Please try to stay on topic, and don't obfuscate your posts
13 >> >> needlessly.
14 >> >
15 >> > This is on-topic, and it tells you exactly what you need to know to
16 >> > understand why your objection is irrelevant. But if you would like
17 >> > it made simpler, but less precise: if you are looking at FEATURES
18 >> > for anything that is not purely Portage internals, you are doing
19 >> > something wrong.
20 >>
21 >> The idea would be to check for the necessary kernel features from
22 >> portage backend code, not from ebuild code.
23 >
24 > Why, though? FEATURES doesn't give meaningful information to anything
25 > other than Portage internals, so it doesn't matter.
26 >
27
28 I'm not sure what you mean, but maybe we are just thinking about it differently.
29
30 When FEATURES="network-sandbox", the kernel must have CONFIG_NET_NS
31 enabled or the unshare(2) call will fail.
32
33 We should probably emit an error message advising the user to enable
34 the kernel option or disable the network-sandbox feature. This should
35 happen when we call unshare() and that fails with errno == EINVAL.

Replies

Subject Author
Re: [gentoo-dev] RFC: enabling ipc-sandbox & network-sandbox by default Peter Stuge <peter@×××××.se>