Reland "scripts: build_image: Disable network access"
This is a reland of commit c88eba3b61ce26a2a8cf2102997f43d2ba6964a8
Specify preserve_env so that the envvars we need get passed along for
re-execution.
Original change's description:
> scripts: build_image: Disable network access
>
> Call ReExecuteWithNamespace for build_image to disable network access
> by enabling the network namespace as the root user.
>
> BUG=b:233635037
> TEST=CQ
>
> Cq-Depend: chromium:3710502
> Change-Id: I60db80499fa4341782e1a3916dfa6cbd87b08394
> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/chromite/+/3836499
> Tested-by: Cindy Lin <xcl@google.com>
> Commit-Queue: Cindy Lin <xcl@google.com>
> Reviewed-by: Mike Frysinger <vapier@chromium.org>
BUG=b:233635037
TEST=cros tryjob {release,full,factory}, manual verification of envvars, CQ
Cq-Depend: chromium:3880985
Change-Id: Id6a61fed57429c3e4f50a86adbfebcbe71ca3500
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/chromite/+/3869174
Tested-by: Cindy Lin <xcl@google.com>
Reviewed-by: Ram Chandrasekar <rchandrasekar@google.com>
Commit-Queue: Cindy Lin <xcl@google.com>
diff --git a/scripts/build_image.py b/scripts/build_image.py
index 0324316..a7afd67 100644
--- a/scripts/build_image.py
+++ b/scripts/build_image.py
@@ -31,11 +31,13 @@
import argparse
import os
from pathlib import Path
+import sys
from typing import List, Optional, Tuple
from chromite.lib import commandline
from chromite.lib import constants
from chromite.lib import cros_build_lib
+from chromite.lib import namespaces
from chromite.service import image
from chromite.utils import timer
@@ -412,6 +414,10 @@
@timer.timed("Elapsed time (build_image)")
def main(argv: Optional[List[str]] = None) -> Optional[int]:
commandline.RunInsideChroot()
+
+ # Make sure we run with network disabled to prevent leakage.
+ namespaces.ReExecuteWithNamespace(sys.argv, preserve_env=True)
+
parser, opts = parse_args(argv)
# If the opts.board is not set, then it means user hasn't specified a default