[gentoo-portage-dev] [PATCH] ebuild: allow RESTRICT=network-sandbox in ebuilds

[Mike Frysinger]

From: Mike Frysinger <vapier@××××××××.org>

Some ebuilds are a bit hard to fix their use of the network in src
phases, so allow them to disable things.  This allows us to turn off
access by default and for the vast majority while we work out how to
fix the few broken packages.

URL: https://crbug.com/731905
---
 man/ebuild.5                           | 4 ++++
 pym/portage/package/ebuild/doebuild.py | 3 ++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/man/ebuild.5 b/man/ebuild.5
index 42a0599fe3a9..a8fc3f86b68a 100644
--- a/man/ebuild.5
+++ b/man/ebuild.5
@@ -689,6 +689,10 @@ binaries that are not compatible with debugedit.
 .I mirror
 files in \fBSRC_URI\fR will not be downloaded from the \fBGENTOO_MIRRORS\fR.
 .TP
+.I network-sandbox
+Disables the network namespace for specific packages.
+Should not be used in the main Gentoo tree.
+.TP
 .I preserve\-libs
 Disables preserve\-libs for specific packages. Note than when a package is
 merged, RESTRICT=preserve\-libs applies if either the new instance or the
diff --git a/pym/portage/package/ebuild/doebuild.py b/pym/portage/package/ebuild/doebuild.py
index 0be148fd408e..f75f11a1a424 100644
--- a/pym/portage/package/ebuild/doebuild.py
+++ b/pym/portage/package/ebuild/doebuild.py
@@ -148,7 +148,8 @@ def _doebuild_spawn(phase, settings, actionmap=None, **kwargs):
 	kwargs['ipc'] = 'ipc-sandbox' not in settings.features or \
 		phase in _ipc_phases
 	kwargs['networked'] = 'network-sandbox' not in settings.features or \
-		phase in _networked_phases
+		phase in _networked_phases or \
+		'network-sandbox' in settings['PORTAGE_RESTRICT'].split()
 
 	if phase == 'depend':
 		kwargs['droppriv'] = 'userpriv' in settings.features
-- 
2.15.1