Hi,

Debian packages must be buildable without access to the internet, so
there should be a way to disable network access when running
dpkg-buildpackage.

Running schroot within an unshared network namespace does not work
because to unshare the network, sbuild needs to unshare the user
namespace too, to become root. And after that is done it cannot execute
schroot anymore because that will complain about
/etc/schroot/schroot.conf not being owned by root anymore. So the
unshare call has to be done by schroot.

Luckily, schroot already has support for it in git master! See bug
#802849.

So when this bug gets fixed, please add support for calling schroot with
"-o unshare.net=true".

Thanks!

cheers, josch

In case anybody else is interested in doing this, I made the following
hackish patch and it seems to work.  It requires schroot 1.7.0 or
later; I used 1.7.2-3 from experimental, recompiled to run on jessie.

--- sbuild-0.65.2.orig/lib/Sbuild/ChrootSchroot.pm
+++ sbuild-0.65.2/lib/Sbuild/ChrootSchroot.pm
@@ -125,6 +125,9 @@ sub get_command_internal {
 		'-c', $self->get('Session ID'),
 		'--run-session',
 		@{$self->get_conf('SCHROOT_OPTIONS')},
+		'-o', ($user eq 'root'
+		       ? 'unshare.net=false'
+		       : 'unshare.net=true'),
 		'-u', "$user", '-p', '--',
 		@$command);


For this to work, you will also need to add a line to the schroot
config file (e.g. /etc/schroot/chroot.d/jessie-amd64-sbuild-xyzzy):

user-modifiable-keys=unshare.net

Hi Johannes,

I think you implemented this some time ago in unshare ;).

Can this be closed?

Cheers Jochen

* Johannes Schauer <josch@debian.org> [2015-10-24 11:02]: