Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-27 Thread Michał Górny
Dnia 2015-01-25, o godz. 16:44:20 Thomas D. whi...@whissi.de napisał(a): Hi, Michał Górny wrote: I see two generic approaches possible here: 1. proxying distcc from within the build environment, or 2. moving distcc-spawned processes back to parent's namespace. distcc

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-27 Thread Michał Górny
Dnia 2015-01-27, o godz. 03:03:31 Andrew Savchenko birc...@gentoo.org napisał(a): On Sat, 24 Jan 2015 12:03:27 +0100 Michał Górny wrote: Dnia 2015-01-21, o godz. 11:05:34 Michał Górny mgo...@gentoo.org napisał(a): Parent namespace solution - The

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-27 Thread Michał Górny
Dnia 2015-01-27, o godz. 02:46:37 Andrew Savchenko birc...@gentoo.org napisał(a): Hi, On Sun, 25 Jan 2015 14:59:01 +0100 Michał Górny wrote: Dnia 2015-01-21, o godz. 11:05:34 Michał Górny mgo...@gentoo.org napisał(a): Generic proxy solution -- The

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-26 Thread Andrew Savchenko
On Sat, 24 Jan 2015 12:03:27 +0100 Michał Górny wrote: Dnia 2015-01-21, o godz. 11:05:34 Michał Górny mgo...@gentoo.org napisał(a): Parent namespace solution - The alternative is to wrap distcc so that parent network namespace is regained. Sadly, for a start

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-26 Thread Andrew Savchenko
Hi, On Sun, 25 Jan 2015 14:59:01 +0100 Michał Górny wrote: Dnia 2015-01-21, o godz. 11:05:34 Michał Górny mgo...@gentoo.org napisał(a): Generic proxy solution -- The simplest solution so far seems to be setting a generic SOCKS proxy inside the build environment,

RE: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-25 Thread Thomas D.
Hi, Michał Górny wrote: I see two generic approaches possible here: 1. proxying distcc from within the build environment, or 2. moving distcc-spawned processes back to parent's namespace. distcc client/server solution - The most obvious solution to me

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-25 Thread Michał Górny
Dnia 2015-01-21, o godz. 11:05:34 Michał Górny mgo...@gentoo.org napisał(a): Generic proxy solution -- The simplest solution so far seems to be setting a generic SOCKS proxy inside the build environment, and wrapping distcc so that it will use it for network access.

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-24 Thread Michał Górny
Dnia 2015-01-22, o godz. 00:34:35 Luis Ressel ara...@aixah.de napisał(a): On Wed, 21 Jan 2015 10:38:20 -0500 Rich Freeman ri...@gentoo.org wrote: On Wed, Jan 21, 2015 at 10:00 AM, Alexis Ballier aball...@gentoo.org wrote: On Wed, 21 Jan 2015 11:05:34 +0100 Michał Górny

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-24 Thread Michał Górny
Dnia 2015-01-21, o godz. 11:05:34 Michał Górny mgo...@gentoo.org napisał(a): Parent namespace solution - The alternative is to wrap distcc so that parent network namespace is regained. Sadly, for a start this requires SYS_CAP_ADMIN and access to parent's /proc entry

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-21 Thread Michał Górny
Dnia 2015-01-21, o godz. 16:00:55 Alexis Ballier aball...@gentoo.org napisał(a): On Wed, 21 Jan 2015 11:05:34 +0100 Michał Górny mgo...@gentoo.org wrote: Hello, developers. As you may recall, the main blocker for wide-establishment of FEATURES=network-sandbox prohibiting network

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-21 Thread Rich Freeman
On Wed, Jan 21, 2015 at 10:00 AM, Alexis Ballier aball...@gentoo.org wrote: On Wed, 21 Jan 2015 11:05:34 +0100 Michał Górny mgo...@gentoo.org wrote: Hello, developers. As you may recall, the main blocker for wide-establishment of FEATURES=network-sandbox prohibiting network access within

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-21 Thread Michał Górny
Dnia 2015-01-21, o godz. 09:40:41 Michael Orlitzky m...@gentoo.org napisał(a): On 01/21/2015 05:05 AM, Michał Górny wrote: Hello, developers. As you may recall, the main blocker for wide-establishment of FEATURES=network-sandbox prohibiting network access within the build environment

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-21 Thread Luis Ressel
On Wed, 21 Jan 2015 10:38:20 -0500 Rich Freeman ri...@gentoo.org wrote: On Wed, Jan 21, 2015 at 10:00 AM, Alexis Ballier aball...@gentoo.org wrote: On Wed, 21 Jan 2015 11:05:34 +0100 Michał Górny mgo...@gentoo.org wrote: Hello, developers. As you may recall, the main blocker for

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-21 Thread Alexis Ballier
On Wed, 21 Jan 2015 11:05:34 +0100 Michał Górny mgo...@gentoo.org wrote: Hello, developers. As you may recall, the main blocker for wide-establishment of FEATURES=network-sandbox prohibiting network access within the build environment is distcc. Since all connectivity is disabled, distcc

Re: [gentoo-dev] Figuring out the solution to in-network-sandbox distcc

2015-01-21 Thread Michael Orlitzky
On 01/21/2015 05:05 AM, Michał Górny wrote: Hello, developers. As you may recall, the main blocker for wide-establishment of FEATURES=network-sandbox prohibiting network access within the build environment is distcc. Since all connectivity is disabled, distcc can no longer reach other