Skip to content

RFE: prevent scriptlet network access #2632

Description

@pmatilai

Network access in both build and install scriptlets is basically a packaging bug (and a security risk) as the result depends on external factors, and various build-systems already enforce this on top of rpmbuild. I see no reason we could or could not do this on the rpm-level already, both for build and install-time scriptlets. If it turns out to break too much we can always add an configurable option for it.

This is expected to be a Linux-only feature (unshare network namespace from the scriptlets), but other platforms with similar technologies could be supported too.

Metadata

Metadata

Assignees

Labels

RFEcontainersContainers and related technologies

Type

No type

Projects

Status
Done
Status
Done

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions