From mboxrd@z Thu Jan 1 00:00:00 1970
Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail
From: Philipp
Newsgroups: gmane.emacs.bugs
Subject: bug#46641: process-tests assume network connection
Date: Sun, 21 Feb 2021 20:40:59 +0100
Message-ID:
References: <4lpn0wndla.fsf@fencepost.gnu.org> <871rd9smip.fsf@gmail.com>
<87lfbhqtmq.fsf@gmail.com>
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.60.0.2.21\))
Content-Type: text/plain;
charset=utf-8
Content-Transfer-Encoding: quoted-printable
Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214";
logging-data="26678"; mail-complaints-to="usenet@ciao.gmane.io"
Cc: Glenn Morris , 46641@debbugs.gnu.org
To: Robert Pluim
Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sun Feb 21 20:44:39 2021
Return-path:
Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org
Original-Received: from lists.gnu.org ([209.51.188.17])
by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.92)
(envelope-from )
id 1lDuel-0006r6-BN
for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 21 Feb 2021 20:44:39 +0100
Original-Received: from localhost ([::1]:37744 helo=lists1p.gnu.org)
by lists.gnu.org with esmtp (Exim 4.90_1)
(envelope-from )
id 1lDuek-0005ig-2z
for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 21 Feb 2021 14:44:38 -0500
Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:59604)
by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.90_1) (envelope-from )
id 1lDucD-0002Gp-UY
for bug-gnu-emacs@gnu.org; Sun, 21 Feb 2021 14:42:01 -0500
Original-Received: from debbugs.gnu.org ([209.51.188.43]:43356)
by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
(Exim 4.90_1) (envelope-from )
id 1lDucD-0006ip-LS
for bug-gnu-emacs@gnu.org; Sun, 21 Feb 2021 14:42:01 -0500
Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2)
(envelope-from ) id 1lDucD-0004X7-JC
for bug-gnu-emacs@gnu.org; Sun, 21 Feb 2021 14:42:01 -0500
X-Loop: help-debbugs@gnu.org
Resent-From: Philipp
Original-Sender: "Debbugs-submit"
Resent-CC: bug-gnu-emacs@gnu.org
Resent-Date: Sun, 21 Feb 2021 19:42:01 +0000
Resent-Message-ID:
Resent-Sender: help-debbugs@gnu.org
X-GNU-PR-Message: followup 46641
X-GNU-PR-Package: emacs
Original-Received: via spool by 46641-submit@debbugs.gnu.org id=B46641.161393646817353
(code B ref 46641); Sun, 21 Feb 2021 19:42:01 +0000
Original-Received: (at 46641) by debbugs.gnu.org; 21 Feb 2021 19:41:08 +0000
Original-Received: from localhost ([127.0.0.1]:54902 helo=debbugs.gnu.org)
by debbugs.gnu.org with esmtp (Exim 4.84_2)
(envelope-from )
id 1lDubL-0004Vp-KA
for submit@debbugs.gnu.org; Sun, 21 Feb 2021 14:41:07 -0500
Original-Received: from mail-ed1-f41.google.com ([209.85.208.41]:46984)
by debbugs.gnu.org with esmtp (Exim 4.84_2)
(envelope-from ) id 1lDubK-0004VP-Qn
for 46641@debbugs.gnu.org; Sun, 21 Feb 2021 14:41:07 -0500
Original-Received: by mail-ed1-f41.google.com with SMTP id v22so19216663edx.13
for <46641@debbugs.gnu.org>; Sun, 21 Feb 2021 11:41:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=mime-version:subject:from:in-reply-to:date:cc
:content-transfer-encoding:message-id:references:to;
bh=Z19q5Ex2fol8yrbEpLg5Hfo161AMv3y3jRklAsXTWB0=;
b=idYoSgL7Upyegr/PaYQcWf7Q9cOWlEpAjoBdMUr4wkGWzEE6wV00sNRQeHEixAG2F7
sO2RiYesc7ZB+RwecaP331h9XH8CUJJUOqs9/eoHAkbg2Ikq0jVLNIKAk1PFi99NIIFw
VVoUfE2me16H1euYumi5yPMdD9G7Pc3SL6XrhvuH38l1atc6lREFxznk+nFB3M57veEK
Q+JqxgKdbz4keQ83RjfcrhrP4tqRSfpoiU/J59qYq7KbMY0HJzO5NcJZ8U8fgOu47O0F
rEwEiPk5ZDE8svkEGCGm0hVMKh3IUlsLJy9WATZQI50Jd2T/nrkZpwwv3UHIHfVzNjIk
+GVw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc
:content-transfer-encoding:message-id:references:to;
bh=Z19q5Ex2fol8yrbEpLg5Hfo161AMv3y3jRklAsXTWB0=;
b=aSLBGvO4+wnMAocX/VR9PLmjE1XYKgL5DsYcGYNBTZKlG9LGbJTqjheX+x32nCl+s4
T0Iy/8uTnmn+uvrY37uhx1nW/EFuuhQ9DAbc+kUVK+68Ha7GdyMblWWqhTog2GvOO6oy
59fHLYFMBS2TG42pJD+QLaCVvfJH7ILrp1efl+qogmtMjJWSLX/v3lGQH4Q7hfhUBvnd
x+vDX8RLkO38lD0emqvNzU5Yadmw+fk4W3vylnnufDm7OeCc/N1T7wyx4qImfe6JvPqP
4TggcOJLoy1cg5S9veNC0FGxS5OVdOzmSKJjbsBp/m4mbSSHAqdz94IrtjkZ9LTQGUjL
a8Vw==
X-Gm-Message-State: AOAM532GPaIgRgVe5YO+BuqkfOPKC7XVJYR7fP4BabWQ3iDnSkPkCfkR
8PnpM2ljkFNOvrlvbkyYdzc=
X-Google-Smtp-Source: ABdhPJw8fqmibWdfsLuOwEuOH1u5GnnbUYn3ZgXTuQ05Zv438U9bNtp15KHK8wwOWvkfcBSlC4X1Hg==
X-Received: by 2002:a50:e0c3:: with SMTP id j3mr19932541edl.32.1613936460955;
Sun, 21 Feb 2021 11:41:00 -0800 (PST)
Original-Received: from philipps-mbp.fritz.box ([46.128.208.19])
by smtp.gmail.com with ESMTPSA id z19sm10912340edr.69.2021.02.21.11.41.00
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Sun, 21 Feb 2021 11:41:00 -0800 (PST)
In-Reply-To: <87lfbhqtmq.fsf@gmail.com>
X-Mailer: Apple Mail (2.3654.60.0.2.21)
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
X-BeenThere: bug-gnu-emacs@gnu.org
List-Id: "Bug reports for GNU Emacs,
the Swiss army knife of text editors"
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org
Original-Sender: "bug-gnu-emacs"
Xref: news.gmane.io gmane.emacs.bugs:200523
Archived-At:
> Am 21.02.2021 um 17:21 schrieb Robert Pluim :
>=20
>>>>>> On Sun, 21 Feb 2021 15:37:27 +0100, Philipp =
said:
>=20
> Philipp> This is pretty common for CI systems. Accessing the =
network is a
> Philipp> security risk, and in addition tends to make tests =
unreproducible.
>=20
> I can give you the second one, but in what way is eg doing a DNS =
lookup a
> 'security risk'? We=CA=BCre not talking about setting up a listening =
server
> on a public IP here.
A CI system will typically run arbitrary code that=E2=80=99s not under =
the control of the CI system itself. Therefore, the CI system needs to =
prevent any malicious behavior of the system under test. Since the code =
being tested is opaque, the CI system can=E2=80=99t really decide =
whether it=E2=80=99s malicious or not, so it has to conservatively =
assume that any network access is malicious. While it might be possible =
to prevent more specific behavior (like creating a listening socket), =
that tends to be more complex, so the simpler and safer =E2=80=9Eno =
network at all=E2=80=9C tends to be a reasonable choice.=