Can I forbid Internet access while building with `makepkg`?

lilydjwg · 2014-04-30 03:34:46

Hi, there, I'm always annoyed by unexpected downloading when building something. I don't like duplicate libraries, and sometimes I have limited bandwidth, or I must use a proxy to access the required file. I want to find a way to make sure, when running the build function, any program it invokes won't be able to access the Internet, failing immediately (i.e. not waiting for a long time before timeout) if it must to. I don't want a seperate system (virtual or chroot that has many duplicates) either, but I have aufs ready. Anyone has some ideas?

fukawi2 · 2014-04-30 03:37:50

iptables -I OUTPUT -m state --state NEW -j REJECT

or (assuming you're not running a proxy on your local machine:

export HTTP_PROXY='http://localhost'
export HTTPS_PROXY='http://localhost'
export FTP_PROXY='http://localhost'

EDIT: I had a derp.

Last edited by fukawi2 (2014-04-30 23:21:27)

lilydjwg · 2014-04-30 04:11:55

fukawi2 wrote:

iptables -I OUTPUT -m state --state NEW -j ACCEPT

Maybe you mean 'REJECT'? But this will affect other things.

fukawi2 wrote:

or (assuming you're not running a proxy on your local machine:
export HTTP_PROXY='http://localhost'
export HTTPS_PROXY='http://localhost'
export FTP_PROXY='http://localhost'

This is a great idea :-) Except that wget needs lowercase ones. I expect it works with most tools. But I think I have to run `makepkg -g` first :-)

Last edited by lilydjwg (2014-04-30 04:12:40)

HalosGhost · 2014-04-30 05:54:39

I don't really understand this. You should be looking at every PKGBUILD you make to make sure that it does not do anything malicious anyway. Why not simply look to see if the build function would attempt to do something and head it off?

Don't get me wrong, I don't have anything against being sure, but I still don't really understand it.

All the best,

-HG

fukawi2 · 2014-04-30 23:21:00

lilydjwg wrote:

Maybe you mean 'REJECT'? But this will affect other things.

Derp, yes I did, sorry.

lilydjwg wrote:

Except that wget needs lowercase ones. I expect it works with most tools.

Yeah, it's a pain some tools use upper and some user lower. I have a little .profile file that I can source to handle it:

function prx_none() {
	proxy_uri=''
	proxy_bypass=()
}

function prx_work() {
	proxy_uri='http://proxy.workdomain.com.au:3128'
	proxy_bypass=(
		'172.31.0.0/16'
		'127.0.0.0/8'
		'localhost'
	)
}

function prx_home() {
	proxy_uri='http://proxy.homedomain.com.au:3128'
	proxy_bypass=(
		'192.168.42.0/24'
		'127.0.0.0/8'
		'localhost'
	)
}

# cmdline args from user?
if [ -n "$1" ] ; then
	HN="$1"
else
	HN="$(hostname -f)"
fi

# try and work out where we are logged in
case $HN in
	external-server.workdomain.com.au)
		prx_none
	;;
	*.workdomain.com.au)
		prx_work
		;;
	*.homedomain.com.au)
		prx_home
		;;
	*)
		prx_none
		;;
esac

# export the new environment vars
echo "INFO: Setting proxy to $proxy_uri"
export HTTP_PROXY="$proxy_uri"
export http_proxy="$proxy_uri"
export HTTPS_PROXY="$proxy_uri"
export https_proxy="$proxy_uri"
export FTP_PROXY="$proxy_uri"
export ftp_proxy="$proxy_uri"
export no_proxy="$(echo ${proxy_bypass[@]} | tr ' ' ',')"

lilydjwg · 2014-05-01 12:29:39

HalosGhost wrote:

I don't really understand this. You should be looking at every PKGBUILD you make to make sure that it does not do anything malicious anyway. Why not simply look to see if the build function would attempt to do something and head it off?
Don't get me wrong, I don't have anything against being sure, but I still don't really understand it.
All the best,
-HG

Yes, I read PKGBUILDs. But the source it fetches may download something during building, which is not easy to see.

lilydjwg · 2014-05-01 12:33:08

fukawi2 wrote:

Yeah, it's a pain some tools use upper and some user lower. I have a little .profile file that I can source to handle it:

I've just added one more alias :-)

alias nonet="HTTP_PROXY='http://localhost:1' HTTPS_PROXY='http://localhost:1' FTP_PROXY='http://localhost:1' http_proxy='http://localhost:1' https_proxy='http://localhost:1' ftp_proxy='http://localhost:1'"

I use port 1 because I don't think I'll ever use that one :-)

Lone_Wolf · 2014-05-01 14:00:01

lilydjwg wrote:

Yes, I read PKGBUILDs. But the source it fetches may download something during building, which is not easy to see.

That is typical installer behaviour (especially on windows), but i don't think i've ever seen an archlinux PKGBUILD do that.
Or do you mean makepkg -r & -s flags ?
those flags try to download not-installed dependencies, in your case you should avoid them.

Sidenote :
it's ok to answer multiple people in 1 post.
As long as you make clear part of a post was added/changed later, it's also ok to edit posts.

Scimmia · 2014-05-01 14:30:17

Lone_Wolf wrote:

lilydjwg wrote:
Yes, I read PKGBUILDs. But the source it fetches may download something during building, which is not easy to see.
That is typical installer behaviour (especially on windows), but i don't think i've ever seen an archlinux PKGBUILD do that.

I have, especially dealing with things like go or ant.

Arch Linux

#1 2014-04-30 03:34:46

Can I forbid Internet access while building with `makepkg`?

#2 2014-04-30 03:37:50

Re: Can I forbid Internet access while building with `makepkg`?

#3 2014-04-30 04:11:55

Re: Can I forbid Internet access while building with `makepkg`?

#4 2014-04-30 05:54:39

Re: Can I forbid Internet access while building with `makepkg`?

#5 2014-04-30 23:21:00

Re: Can I forbid Internet access while building with `makepkg`?

#6 2014-05-01 12:29:39

Re: Can I forbid Internet access while building with `makepkg`?

#7 2014-05-01 12:33:08

Re: Can I forbid Internet access while building with `makepkg`?

#8 2014-05-01 14:00:01

Re: Can I forbid Internet access while building with `makepkg`?

#9 2014-05-01 14:30:17

Re: Can I forbid Internet access while building with `makepkg`?

Board footer