Source: pbuilder Version: 0.215 Severity: important Tags: patch Hi,
network is not available on a Debian buildd during package build time. This was untrue in pbuilder until I patched it to do that – see the attached debdiff. Please apply and upload. I intend to NMU otherwise. I made this because I was appalled that a coworker was proud of their Debian package of some software that just ran “mvn install” in the d/rules file… I need to show them that that does n̲o̲t̲ work ;-) This introduces a new pbuilderrc option USENETWORK=no (“no” being the default, “yes” the way to disable it), patches the manpage to document it (important ☺) and doesn’t anger either kFreeBSD or Hurd porters as it checks for the “unshare” tool (from util-linux so Essential: yes) before using it, and warns if unavailable, but only informs on nōn-Linux. -- System Information: Debian Release: jessie/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable') Architecture: i386 (i686) Kernel: Linux 3.14-1-amd64 (SMP w/4 CPU cores) Locale: LANG=C, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/lksh
diff -Nru pbuilder-0.215/debian/changelog pbuilder-0.215+nmu1/debian/changelog --- pbuilder-0.215/debian/changelog 2013-03-30 03:06:05.000000000 +0100 +++ pbuilder-0.215+nmu1/debian/changelog 2014-05-22 19:02:15.000000000 +0200 @@ -1,3 +1,10 @@ +pbuilder (0.215+nmu1) unstable; urgency=low + + * Non-maintainer upload. + * Disable network access during build by default on Linux + + -- Thorsten Glaser <[email protected]> Thu, 22 May 2014 18:51:30 +0200 + pbuilder (0.215) unstable; urgency=low * Do not try to use /dev/shm if /run/shm is not present. (closes: #702811, #702102) diff -Nru pbuilder-0.215/pbuilder-buildpackage pbuilder-0.215+nmu1/pbuilder-buildpackage --- pbuilder-0.215/pbuilder-buildpackage 2012-03-13 09:25:15.000000000 +0100 +++ pbuilder-0.215+nmu1/pbuilder-buildpackage 2014-05-22 19:01:25.000000000 +0200 @@ -49,6 +49,28 @@ BUILDUSERNAME=root fi +case $USENETWORK in +yes) + if [ "$DEB_BUILD_ARCH_OS" = "linux" ]; then + # omit the warning when running on kFreeBSD or Hurd + log "W: pbuilder: network will not be disabled during build!" + fi + ;; +*) + if $CHROOTEXEC /usr/bin/unshare -n true; then + USENETWORK=no + SUTOUSER="/usr/bin/unshare -n -- $SUTOUSER" + log "I: pbuilder: network access will be disabled during build" + else + USENETWORK=yes + if [ "$DEB_BUILD_ARCH_OS" = "linux" ]; then + log "W: pbuilder: unshare CLONE_NEWNET not available" + fi + log "I: pbuilder: network access is available during build!" + fi + ;; +esac + # created files should have these UID/GIDs outside of chroot. BUILDRESULTUID="${BUILDRESULTUID:-${SUDO_UID:-0}}" diff -Nru pbuilder-0.215/pbuilderrc pbuilder-0.215+nmu1/pbuilderrc --- pbuilder-0.215/pbuilderrc 2013-03-26 09:49:45.000000000 +0100 +++ pbuilder-0.215+nmu1/pbuilderrc 2014-05-22 18:43:55.000000000 +0200 @@ -10,6 +10,7 @@ #export http_proxy=http://your-proxy:8080/ USEPROC=yes USEDEVPTS=yes +USENETWORK=no USERUNSHM=yes USEDEVFS=no BUILDRESULT=/var/cache/pbuilder/result/ diff -Nru pbuilder-0.215/pbuilderrc.5 pbuilder-0.215+nmu1/pbuilderrc.5 --- pbuilder-0.215/pbuilderrc.5 2013-03-26 10:04:06.000000000 +0100 +++ pbuilder-0.215+nmu1/pbuilderrc.5 2014-05-22 18:44:48.000000000 +0200 @@ -380,6 +380,14 @@ .B /dev/pts being mounted. .TP +.BI "USENETWORK=" "no" +Specify +.B yes +when you do not want to disable network access during build. +Network is not available on a Debian buildd, so you might +want to keep the default. +Disabling network access currently only works on Linux. +.TP .BI "USERUNSHM=" "yes" Specify .B yes
