From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Philipp Newsgroups: gmane.emacs.bugs Subject: bug#46641: process-tests assume network connection Date: Sun, 21 Feb 2021 20:40:59 +0100 Message-ID: References: <4lpn0wndla.fsf@fencepost.gnu.org> <871rd9smip.fsf@gmail.com> <87lfbhqtmq.fsf@gmail.com> Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.60.0.2.21\)) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="26678"; mail-complaints-to="usenet@ciao.gmane.io" Cc: Glenn Morris , 46641@debbugs.gnu.org To: Robert Pluim Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sun Feb 21 20:44:39 2021 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lDuel-0006r6-BN for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 21 Feb 2021 20:44:39 +0100 Original-Received: from localhost ([::1]:37744 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lDuek-0005ig-2z for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 21 Feb 2021 14:44:38 -0500 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:59604) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lDucD-0002Gp-UY for bug-gnu-emacs@gnu.org; Sun, 21 Feb 2021 14:42:01 -0500 Original-Received: from debbugs.gnu.org ([209.51.188.43]:43356) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lDucD-0006ip-LS for bug-gnu-emacs@gnu.org; Sun, 21 Feb 2021 14:42:01 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1lDucD-0004X7-JC for bug-gnu-emacs@gnu.org; Sun, 21 Feb 2021 14:42:01 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Philipp Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 21 Feb 2021 19:42:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 46641 X-GNU-PR-Package: emacs Original-Received: via spool by 46641-submit@debbugs.gnu.org id=B46641.161393646817353 (code B ref 46641); Sun, 21 Feb 2021 19:42:01 +0000 Original-Received: (at 46641) by debbugs.gnu.org; 21 Feb 2021 19:41:08 +0000 Original-Received: from localhost ([127.0.0.1]:54902 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lDubL-0004Vp-KA for submit@debbugs.gnu.org; Sun, 21 Feb 2021 14:41:07 -0500 Original-Received: from mail-ed1-f41.google.com ([209.85.208.41]:46984) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lDubK-0004VP-Qn for 46641@debbugs.gnu.org; Sun, 21 Feb 2021 14:41:07 -0500 Original-Received: by mail-ed1-f41.google.com with SMTP id v22so19216663edx.13 for <46641@debbugs.gnu.org>; Sun, 21 Feb 2021 11:41:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Z19q5Ex2fol8yrbEpLg5Hfo161AMv3y3jRklAsXTWB0=; b=idYoSgL7Upyegr/PaYQcWf7Q9cOWlEpAjoBdMUr4wkGWzEE6wV00sNRQeHEixAG2F7 sO2RiYesc7ZB+RwecaP331h9XH8CUJJUOqs9/eoHAkbg2Ikq0jVLNIKAk1PFi99NIIFw VVoUfE2me16H1euYumi5yPMdD9G7Pc3SL6XrhvuH38l1atc6lREFxznk+nFB3M57veEK Q+JqxgKdbz4keQ83RjfcrhrP4tqRSfpoiU/J59qYq7KbMY0HJzO5NcJZ8U8fgOu47O0F rEwEiPk5ZDE8svkEGCGm0hVMKh3IUlsLJy9WATZQI50Jd2T/nrkZpwwv3UHIHfVzNjIk +GVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Z19q5Ex2fol8yrbEpLg5Hfo161AMv3y3jRklAsXTWB0=; b=aSLBGvO4+wnMAocX/VR9PLmjE1XYKgL5DsYcGYNBTZKlG9LGbJTqjheX+x32nCl+s4 T0Iy/8uTnmn+uvrY37uhx1nW/EFuuhQ9DAbc+kUVK+68Ha7GdyMblWWqhTog2GvOO6oy 59fHLYFMBS2TG42pJD+QLaCVvfJH7ILrp1efl+qogmtMjJWSLX/v3lGQH4Q7hfhUBvnd x+vDX8RLkO38lD0emqvNzU5Yadmw+fk4W3vylnnufDm7OeCc/N1T7wyx4qImfe6JvPqP 4TggcOJLoy1cg5S9veNC0FGxS5OVdOzmSKJjbsBp/m4mbSSHAqdz94IrtjkZ9LTQGUjL a8Vw== X-Gm-Message-State: AOAM532GPaIgRgVe5YO+BuqkfOPKC7XVJYR7fP4BabWQ3iDnSkPkCfkR 8PnpM2ljkFNOvrlvbkyYdzc= X-Google-Smtp-Source: ABdhPJw8fqmibWdfsLuOwEuOH1u5GnnbUYn3ZgXTuQ05Zv438U9bNtp15KHK8wwOWvkfcBSlC4X1Hg== X-Received: by 2002:a50:e0c3:: with SMTP id j3mr19932541edl.32.1613936460955; Sun, 21 Feb 2021 11:41:00 -0800 (PST) Original-Received: from philipps-mbp.fritz.box ([46.128.208.19]) by smtp.gmail.com with ESMTPSA id z19sm10912340edr.69.2021.02.21.11.41.00 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 21 Feb 2021 11:41:00 -0800 (PST) In-Reply-To: <87lfbhqtmq.fsf@gmail.com> X-Mailer: Apple Mail (2.3654.60.0.2.21) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:200523 Archived-At: > Am 21.02.2021 um 17:21 schrieb Robert Pluim : >=20 >>>>>> On Sun, 21 Feb 2021 15:37:27 +0100, Philipp = said: >=20 > Philipp> This is pretty common for CI systems. Accessing the = network is a > Philipp> security risk, and in addition tends to make tests = unreproducible. >=20 > I can give you the second one, but in what way is eg doing a DNS = lookup a > 'security risk'? We=CA=BCre not talking about setting up a listening = server > on a public IP here. A CI system will typically run arbitrary code that=E2=80=99s not under = the control of the CI system itself. Therefore, the CI system needs to = prevent any malicious behavior of the system under test. Since the code = being tested is opaque, the CI system can=E2=80=99t really decide = whether it=E2=80=99s malicious or not, so it has to conservatively = assume that any network access is malicious. While it might be possible = to prevent more specific behavior (like creating a listening socket), = that tends to be more complex, so the simpler and safer =E2=80=9Eno = network at all=E2=80=9C tends to be a reasonable choice.=