Network setup of builders

Miroslav Suchy msuchy at redhat.com
Wed Jun 26 14:43:39 UTC 2013


Seth,
is is possible to set up builders that the they will have very limited 
network connections? Probably just to copr-be or copr-fe?

I'm asking because currently you can do nearly everything on builder. 
For example I made evil.spec, which have

%prep
wget http://www.googl.com -O index.html
cat index.html

Which is executed without problem:
http://copr-be.cloud.fedoraproject.org/results/msuchy/copr/fedora-18-x86_64/evil-1-1.fc19/build.log

Of course instead wget I can e.g start my own ssh server or botnet. And 
I will own that machine until our timeout expire.

On Koji we do not have such problem because builders are configured to 
not allow any internet connections.

Right now we need internet connection on builders, because they need to 
download src.rpm. But this can be fixed that user will not provide url 
to src.rpm, but they will upload it to cloud-fe. This will be save, 
because we will store and behave to src.rpm just as binary file and only 
store it in some directory and not parse it.

Builder can then pick it up from copr-fe. Either by downloading from 
some http export or via nfs read only share.

Opinions?

Mirek


More information about the copr-devel mailing list