{"action":"created","issue":{"url":"https://api.github.com/repos/iocage/libiocage/issues/562","repository_url":"https://api.github.com/repos/iocage/libiocage","labels_url":"https://api.github.com/repos/iocage/libiocage/issues/562/labels{/name}","comments_url":"https://api.github.com/repos/iocage/libiocage/issues/562/comments","events_url":"https://api.github.com/repos/iocage/libiocage/issues/562/events","html_url":"https://github.com/iocage/libiocage/issues/562","id":372089334,"node_id":"MDU6SXNzdWUzNzIwODkzMzQ=","number":562,"title":"ioc defaults leak into temporary (upgrade) jail when downloading (upgrading) releases","user":{"login":"igalic","id":497249,"node_id":"MDQ6VXNlcjQ5NzI0OQ==","avatar_url":"https://avatars1.githubusercontent.com/u/497249?v=4","gravatar_id":"","url":"https://api.github.com/users/igalic","html_url":"https://github.com/igalic","followers_url":"https://api.github.com/users/igalic/followers","following_url":"https://api.github.com/users/igalic/following{/other_user}","gists_url":"https://api.github.com/users/igalic/gists{/gist_id}","starred_url":"https://api.github.com/users/igalic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/igalic/subscriptions","organizations_url":"https://api.github.com/users/igalic/orgs","repos_url":"https://api.github.com/users/igalic/repos","events_url":"https://api.github.com/users/igalic/events{/privacy}","received_events_url":"https://api.github.com/users/igalic/received_events","type":"User","site_admin":false},"labels":[{"id":666636437,"node_id":"MDU6TGFiZWw2NjY2MzY0Mzc=","url":"https://api.github.com/repos/iocage/libiocage/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-10-19T19:36:21Z","updated_at":"2018-10-19T21:38:34Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"same as https://github.com/iocage/libiocage/issues/558 — but for `ioc fetch`\r\nwhen setting global defaults that influence `exec_*` they will leak into the temporary upgrade jail when doing ioc fetch"},"comment":{"url":"https://api.github.com/repos/iocage/libiocage/issues/comments/431506626","html_url":"https://github.com/iocage/libiocage/issues/562#issuecomment-431506626","issue_url":"https://api.github.com/repos/iocage/libiocage/issues/562","id":431506626,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMTUwNjYyNg==","user":{"login":"igalic","id":497249,"node_id":"MDQ6VXNlcjQ5NzI0OQ==","avatar_url":"https://avatars1.githubusercontent.com/u/497249?v=4","gravatar_id":"","url":"https://api.github.com/users/igalic","html_url":"https://github.com/igalic","followers_url":"https://api.github.com/users/igalic/followers","following_url":"https://api.github.com/users/igalic/following{/other_user}","gists_url":"https://api.github.com/users/igalic/gists{/gist_id}","starred_url":"https://api.github.com/users/igalic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/igalic/subscriptions","organizations_url":"https://api.github.com/users/igalic/orgs","repos_url":"https://api.github.com/users/igalic/repos","events_url":"https://api.github.com/users/igalic/events{/privacy}","received_events_url":"https://api.github.com/users/igalic/received_events","type":"User","site_admin":false},"created_at":"2018-10-19T21:38:34Z","updated_at":"2018-10-19T21:38:34Z","author_association":"CONTRIBUTOR","body":"so, let's see, right now we have two:\r\n\r\n```python\r\n    @property\r\n    def temporary_jail(self) -> 'iocage.Jail.JailGenerator':\r\n        \"\"\"Temporary jail instance that will be created to run the update.\"\"\"\r\n        if hasattr(self, \"_temporary_jail\") is False:\r\n            temporary_name = self.resource.name.replace(\".\", \"-\") + \"_u\"\r\n            temporary_jail = iocage.Jail.JailGenerator(\r\n                {\r\n                    \"name\": temporary_name,\r\n                    \"basejail\": False,\r\n                    \"allow_mount_nullfs\": \"1\",\r\n                    \"release\": self.release.name,\r\n                    \"exec_start\": None,\r\n                    \"exec_prestart\": None,\r\n                    \"exec_poststart\": None,\r\n                    \"exec_prestop\": None,\r\n                    \"exec_poststop\": None,\r\n                    \"exec_timeout\": 600,\r\n                    \"securelevel\": \"0\",\r\n                    \"allow_chflags\": True,\r\n                    \"vnet\": False,\r\n                    \"ip4_addr\": None,\r\n                    \"ip6_addr\": None,\r\n                    \"defaultrouter\": None,\r\n                    \"mount_devfs\": True,\r\n                    \"mount_fdescfs\": False\r\n                },\r\n                new=True,\r\n                logger=self.resource.logger,\r\n                zfs=self.resource.zfs,\r\n                host=self.resource.host,\r\n                dataset=self.resource.dataset\r\n            )\r\n            temporary_jail.config.file = \"config_update.json\"\r\n\r\n            root_path = temporary_jail.root_path\r\n            destination_dir = f\"{root_path}{self.local_release_updates_dir}\"\r\n            temporary_jail.fstab.file = \"fstab_update\"\r\n            temporary_jail.fstab.new_line(\r\n                source=self.host_updates_dir,\r\n                destination=destination_dir,\r\n                options=\"rw\"\r\n            )\r\n            if os.path.isdir(destination_dir) is False:\r\n                os.makedirs(destination_dir, 0o755)\r\n            temporary_jail.fstab.save()\r\n            self._temporary_jail = temporary_jail\r\n        return self._temporary_jail\r\n```\r\n\r\n```\r\n    def _get_temporary_jail(\r\n        self,\r\n        source_jail: 'iocage.Jail.JailGenerator'\r\n    ) -> 'iocage.Jail.JailGenerator':\r\n        temporary_name = source_jail.name + \"_pkg\"\r\n        temporary_jail = iocage.Jail.JailGenerator(\r\n            {\r\n                \"name\": temporary_name,\r\n                \"basejail\": source_jail.config[\"basejail\"],\r\n                \"release\": source_jail.release.name,\r\n                \"exec_start\": None,\r\n                \"exec_prestart\": None,\r\n                \"exec_poststart\": None,\r\n                \"exec_prestop\": None,\r\n                \"exec_poststop\": None,\r\n                \"exec_timeout\": 600,\r\n                \"vnet\": False,\r\n                \"ip4_addr\": None,\r\n                \"ip6_addr\": None,\r\n                \"defaultrouter\": None,\r\n                \"mount_devfs\": True,\r\n                \"mount_fdescfs\": False\r\n            },\r\n            new=True,\r\n            fstab=source_jail.fstab,\r\n            logger=self.logger,\r\n            zfs=source_jail.zfs,\r\n            host=source_jail.host,\r\n            dataset=source_jail.dataset\r\n        )\r\n\r\n        root_path = temporary_jail.root_path\r\n        destination_dir = f\"{root_path}{self.package_source_directory}\"\r\n\r\n        release_major_version = math.floor(source_jail.release.version_number)\r\n        repo_ds = self._get_release_pkg_dataset(release_major_version)\r\n        cache_ds = self.zfs.get_or_create_dataset(f\"{repo_ds.name}/cache\")\r\n        try:\r\n            temporary_jail.fstab.new_line(\r\n                source=cache_ds.mountpoint,\r\n                destination=f\"{destination_dir}\",\r\n                options=\"ro\",\r\n                auto_create_destination=True,\r\n                replace=True\r\n            )\r\n            temporary_jail.fstab.save()\r\n        except iocage.errors.FstabDestinationExists:\r\n            pass\r\n\r\n        return temporary_jail\r\n```\r\n\r\nthey have several things in common:\r\n\r\n- return type (`'iocage.Jail.JailGenerator`)\r\n- generate a jail name\r\n- use a set of defaults (distinct from global defaults)\r\n- mount some fstabs\r\n- no own network (this might be something to discuss)\r\n\r\nthey are almost always used to:\r\n\r\n- execute a command\r\n- process its output\r\n\r\nwhich should also give us a clue!"}}
{"actor":{"display_login":"igalic"}}