4 ms·
This is the reason I wrote "bash-drop-network-access" [0]. I use it as part of my package building system so that downloads are only done in the "download" pha
by rkeene2 5y ago
This is the reason I wrote "bash-drop-network-access" [0]. I use it as part of my package building system so that downloads are only done in the "download" phase of building where I validate and cache all objects. This means I can fully verify that I can build the whole thing air-gapped and far into the future with the set of files identified by the SHA256 in each package's buildinfo.
This is important because I support each release of the distribution for up to 10 years, and have some customers who may need to build it in an air-gapped environment.
[0] https://chiselapp.com/user/rkeene/repository/bash-drop-network-access/ https://chiselapp.com/user/rkeene/repository/bash-drop-netwo...
- delta1 5y agoSafari is reporting your TLS certificate has expired
- no_time 5y agoVery interesting. First time I heard about loading bash "builtins" from a shared library. How does this compare to LD_PRELOAD? Personally, I just run things in network namespaces with "ip netns exec offline|wireguard $COMMAND" to restrict net access.
- rkeene2 5y agoUsing LD_PRELOAD you only affect dynamically linked executables, where using kernel enforcement using syscall filtering, every process is affected. Also, things are allowed to unset LD_PRELOAD, but not remove filtering. I thought about using a network namespace, but that would make things more complicated since I would need to re-call my shell script to pick-up where I left off (because it requires creating a new process). I initially tried to implement this using network namespaces, but you cannot "unshare" the current process, you must spawn a new process. With dropnet I can do download() enable -f ./dropnet.so dropnet configure() build() install() With "unshare" I would need to do more work to get to "configure()" in a new process.