build_image: disable network access
There's no need for build_image to access the network as it has all
the files already downloaded, so enforce it by turning off access.
BUG=chromium:1068391
TEST=CQ passes
Change-Id: I0da4d96635464f7dd0daf05c2e26d359188476b3
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosutils/+/2137982
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Alex Klein <saklein@chromium.org>
Commit-Queue: Mike Frysinger <vapier@chromium.org>
diff --git a/build_image b/build_image
index 3fd2e3a..9075304 100755
--- a/build_image
+++ b/build_image
@@ -13,6 +13,14 @@
# shellcheck source=build_library/build_common.sh
. "${SCRIPT_ROOT}/build_library/build_common.sh" || exit 1
+# Make sure we run with network disabled to prevent leakage.
+if [[ -z ${UNSHARE} ]]; then
+ if [[ $(id -u) -ne 0 ]]; then
+ exec sudo -E env PATH="${PATH}" "$0" "$@"
+ fi
+ exec unshare -n -- sudo -E UNSHARE=true -u "${SUDO_USER}" -- "$0" "$@"
+fi
+
# Developer-visible flags.
DEFINE_string adjust_part "" \
"Adjustments to apply to partition table (LABEL:[+-=]SIZE) e.g. ROOT-A:+1G"
