[PATCH RFC 0/2] bitbake: Add basic landlock support

["David Nyström" <david.nystrom@est.tech>]

When current implementation runs in an unprivileged docker container,
basic networking will be allowed by default in all steps, ignoring the
network varflags intention.
Introduce support for landlock blocking of bind and connect, providing
basic support for blocking TCP.
UDP is corrently beeing worked on upstream, but not yet supported.

Landlock requires PR_SET_NO_NEW_PRIVS to prevent escape, 
which is also attempted, this prevents privilege escalation from child.
devshell and related are already tagged with network varflag and
can sudo at will.

syscall ABI is asm-generic, 5.13+ for all archs except alpha.
On alpha, we leak 2 fd:s in the childs context before graceful exit,
which is cleaned up at child termination.
Don't have an alpha target, so this is not tested, evaluated via 
static analysis only.

Landlock also provides a future possibility for filesystem
limitations with the purpose of catching bugs, and preventing
persistance of supply chain releated payloads. writes to f.ex. 
.bashrc and friends.

Signed-off-by: David Nyström <david.nystrom@est.tech>
---
David Nyström (2):
      utils: Add landlock_restrict_network function
      bitbake-worker: Call landlock_restrict_network for tasks without network

 bin/bitbake-worker |  2 ++
 lib/bb/utils.py    | 26 ++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)
---
base-commit: a0158cc8d8f29233a9ade63a4c3ce2e939c4bf16
change-id: 20260611-landlock-621bc1a15305

Best regards,
-- 
David Nyström <david.nystrom@est.tech>