pkgcheck.sandbox module

Confinement of scanning runs, on top of pkgcore.landlock.

Scanning a repo is a read-only operation, but generating metadata means sourcing ebuilds with bash, which runs code from the repo under scan. This works out what a scan legitimately writes and hands that to pkgcore, which takes away the rest along with outgoing TCP.

Confinement cannot be lifted and is inherited by child processes, so this only ever runs from a command’s main function – never from pkgcheck.api.scan(), whose caller goes on living afterwards.

pkgcheck.sandbox.confine(options) → None

Drop write and network access that scanning doesn’t need.

Best effort by default, so an old or unconfigurable kernel just leaves the run unconfined. Requesting --sandbox=y explicitly turns that into an error instead, and --sandbox=n skips this entirely.