Network setup of builders
Seth,
is is possible to set up builders that the they will have very limited
network connections? Probably just to copr-be or copr-fe?
I'm asking because currently you can do nearly everything on builder.
For example I made evil.spec, which have
%prep
wget http://www.googl.com -O index.html
cat index.html
Which is executed without problem:
http://copr-be.cloud.fedoraproject.org/results/msuchy/copr/fedora-18-x86_...
Of course instead wget I can e.g start my own ssh server or botnet. And
I will own that machine until our timeout expire.
On Koji we do not have such problem because builders are configured to
not allow any internet connections.
Right now we need internet connection on builders, because they need to
download src.rpm. But this can be fixed that user will not provide url
to src.rpm, but they will upload it to cloud-fe. This will be save,
because we will store and behave to src.rpm just as binary file and only
store it in some directory and not parse it.
Builder can then pick it up from copr-fe. Either by downloading from
some http export or via nfs read only share.
Opinions?
Mirek