Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-13 Thread Luis Ressel
On Mon, 12 May 2014 19:39:09 +0200 Michał Górny mgo...@gentoo.org wrote: I don't know postgresql well enough but does the test db reside in temporary build directory? That is, can you guarantee that: 1) it will never ever collide with user's database, 2) it will be properly cleaned up

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-13 Thread Michał Górny
Dnia 2014-05-13, o godz. 09:28:49 Andrew Savchenko birc...@gmail.com napisał(a): I tried network-sandbox — this is a disaster. It brokes distcc completely since distcc client can't connect to remote servers (and even to a local one if any). Calling something a disaster just because it breaks

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Justin (jlec)
On 12/05/14 02:18, Davide Pesavento wrote: On Sun, May 11, 2014 at 11:42 PM, Michał Górny mgo...@gentoo.org wrote: Hi, everyone. Almost 9 months ago I've committed three new FEATURES for portage: cgroup, ipc-sandbox and network-sandbox. Today I'd like to propose enabling at least the latter

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Alexander Berntsen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 - -1 from me until Portage is capable of detecting if the user's operating system supports the FEATUREs, and informing them of this. I also agree with Ryan that the relevant Linux options should be added to the Gentoo Linux menu. - -- Alexander

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Andreas K. Huettel
Am Montag, 12. Mai 2014, 13:15:35 schrieb Alexander Berntsen: -1 from me until Portage is capable of detecting if the user's operating system supports the FEATUREs, and informing them of this. I also agree with Ryan that the relevant Linux options should be added to the Gentoo Linux menu.

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Mike Gilbert
On Mon, May 12, 2014 at 8:59 AM, Andreas K. Huettel dilfri...@gentoo.org wrote: Am Montag, 12. Mai 2014, 13:15:35 schrieb Alexander Berntsen: -1 from me until Portage is capable of detecting if the user's operating system supports the FEATUREs, and informing them of this. I also agree with

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Ciaran McCreesh
On Mon, 12 May 2014 13:15:35 +0200 Alexander Berntsen berna...@gentoo.org wrote: - -1 from me until Portage is capable of detecting if the user's operating system supports the FEATUREs, and informing them of this. A flag being present or not in FEATURES does not mean anything, and if you're

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Alexander Berntsen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 12/05/14 17:23, Ciaran McCreesh wrote: A flag being present or not in FEATURES does not mean anything, and if you're assuming that it does then you have a bug. Please try to stay on topic, and don't obfuscate your posts needlessly. Note that I

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Ciaran McCreesh
On Mon, 12 May 2014 17:46:57 +0200 Alexander Berntsen berna...@gentoo.org wrote: On 12/05/14 17:23, Ciaran McCreesh wrote: A flag being present or not in FEATURES does not mean anything, and if you're assuming that it does then you have a bug. Please try to stay on topic, and don't obfuscate

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Rick Zero_Chaos Farina
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/11/2014 05:42 PM, Michał Górny wrote: Hi, everyone. Almost 9 months ago I've committed three new FEATURES for portage: cgroup, ipc-sandbox and network-sandbox. Today I'd like to propose enabling at least the latter two by default.

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Rich Freeman
On Mon, May 12, 2014 at 12:07 PM, Rick Zero_Chaos Farina zeroch...@gentoo.org wrote: What about talking to local network resources? In my metasploit ebuild it has tests available which talk to a local database and are perfectly safe, however, if postgresql is started on the system the tests

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Mike Gilbert
On Mon, May 12, 2014 at 11:59 AM, Ciaran McCreesh ciaran.mccre...@googlemail.com wrote: On Mon, 12 May 2014 17:46:57 +0200 Alexander Berntsen berna...@gentoo.org wrote: On 12/05/14 17:23, Ciaran McCreesh wrote: A flag being present or not in FEATURES does not mean anything, and if you're

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Ciaran McCreesh
On Mon, 12 May 2014 12:44:38 -0400 Mike Gilbert flop...@gentoo.org wrote: On Mon, May 12, 2014 at 11:59 AM, Ciaran McCreesh ciaran.mccre...@googlemail.com wrote: On Mon, 12 May 2014 17:46:57 +0200 Alexander Berntsen berna...@gentoo.org wrote: On 12/05/14 17:23, Ciaran McCreesh wrote: A

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Mike Gilbert
On Mon, May 12, 2014 at 12:46 PM, Ciaran McCreesh ciaran.mccre...@googlemail.com wrote: On Mon, 12 May 2014 12:44:38 -0400 Mike Gilbert flop...@gentoo.org wrote: On Mon, May 12, 2014 at 11:59 AM, Ciaran McCreesh ciaran.mccre...@googlemail.com wrote: On Mon, 12 May 2014 17:46:57 +0200

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Peter Stuge
Mike Gilbert wrote: On Mon, May 12, 2014 at 12:46 PM, Ciaran McCreesh ciaran.mccre...@googlemail.com wrote: Why, though? We should probably emit an error message advising the user to enable the kernel option or disable the network-sandbox feature. This should happen when we call

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Michał Górny
Dnia 2014-05-12, o godz. 12:40:42 Rich Freeman ri...@gentoo.org napisał(a): However, I don't know if portage actually makes the network namespace that it creates useful - I don't know if it contains any interfaces, or if they are initialized/etc. It sets up a private loopback (alike 'ifconfig

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Michał Górny
Dnia 2014-05-12, o godz. 12:07:11 Rick \Zero_Chaos\ Farina zeroch...@gentoo.org napisał(a): What about talking to local network resources? In my metasploit ebuild it has tests available which talk to a local database and are perfectly safe, however, if postgresql is started on the system the

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Rick Zero_Chaos Farina
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/12/2014 01:08 PM, Michał Górny wrote: Dnia 2014-05-12, o godz. 12:07:11 Rick \Zero_Chaos\ Farina zeroch...@gentoo.org napisał(a): What about talking to local network resources? In my metasploit ebuild it has tests available which talk to

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Michał Górny
Dnia 2014-05-12, o godz. 13:22:20 Rick \Zero_Chaos\ Farina zeroch...@gentoo.org napisał(a): -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/12/2014 01:08 PM, Michał Górny wrote: Dnia 2014-05-12, o godz. 12:07:11 Rick \Zero_Chaos\ Farina zeroch...@gentoo.org napisał(a): What

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Rich Freeman
On Mon, May 12, 2014 at 1:22 PM, Rick Zero_Chaos Farina zeroch...@gentoo.org wrote: That would be nice, can we do the network namespaces so that I at least don't have to bind to a random port? That alone would be a major improvement in usability. From my very limited understanding of network

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-12 Thread Andrew Savchenko
Hello, On Sun, 11 May 2014 23:42:38 +0200 Michał Górny wrote: Hi, everyone. Almost 9 months ago I've committed three new FEATURES for portage: cgroup, ipc-sandbox and network-sandbox. Today I'd like to propose enabling at least the latter two by default. Firstly, I'd like to shortly

[gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-11 Thread Michał Górny
Hi, everyone. Almost 9 months ago I've committed three new FEATURES for portage: cgroup, ipc-sandbox and network-sandbox. Today I'd like to propose enabling at least the latter two by default. Firstly, I'd like to shortly remind you what they do: 1. cgroup -- puts all processes spawned by

Re: [gentoo-dev] RFC: enabling ipc-sandbox network-sandbox by default

2014-05-11 Thread Davide Pesavento
On Sun, May 11, 2014 at 11:42 PM, Michał Górny mgo...@gentoo.org wrote: Hi, everyone. Almost 9 months ago I've committed three new FEATURES for portage: cgroup, ipc-sandbox and network-sandbox. Today I'd like to propose enabling at least the latter two by default. +1 I've been using all