Add an experimental --restricted option, based on code by Michael Scherer

(bug #16610)

3 files changed, 21 insertions, 4 deletions

diff --git a/urpm.pm b/urpm.pm
index dd1b9130..f054e602 100644
--- a/urpm.pm
+++ b/urpm.pm
@@ -1802,7 +1802,7 @@ this could happen if you mounted manually the directory when creating the medium
 			$error = 1, $urpm->{error}(N("nothing written in list file for \"%s\"", $medium->{name}));
 		    }
 		} else {
-		    #- the flag is no more necessary.
+		    #- the flag is no longer necessary.
 		    if ($medium->{list}) {
 			unlink "$urpm->{statedir}/$medium->{list}";
 			delete $medium->{list};
@@ -1864,7 +1864,7 @@ this could happen if you mounted manually the directory when creating the medium
 		if ($medium->{list}) {
 		    urpm::util::move("$urpm->{cachedir}/partial/$medium->{list}", "$urpm->{statedir}/$medium->{list}");
 		}
-		$medium->{md5sum} = $retrieved_md5sum; #- anyway, keep it, the previous one is no more useful.
+		$medium->{md5sum} = $retrieved_md5sum; #- anyway, keep it, the previous one is no longer useful.
 
 		#- and create synthesis file associated.
 		$medium->{modified_synthesis} = !$medium->{synthesis};
@@ -1957,7 +1957,7 @@ this could happen if you mounted manually the directory when creating the medium
 	$options{callback} && $options{callback}('done', $medium->{name});
     }
 
-    #- clean headers cache directory to remove everything that is no more
+    #- clean headers cache directory to remove everything that is no longer
     #- useful according to the depslist.
     if ($urpm->{modified}) {
 	if ($options{noclean}) {
@@ -3370,6 +3370,11 @@ sub opendir_safe {
     return $d;
 }
 
+sub error_restricted ($) {
+    my ($urpm) = @_;
+    $urpm->{fatal}(2, N("Error, this operation is forbidden while running in restricted mode"));
+}
+
 sub DESTROY {}
 
 1;
diff --git a/urpm/args.pm b/urpm/args.pm
index 56d39718..a6d7275e 100644
--- a/urpm/args.pm
+++ b/urpm/args.pm
@@ -118,6 +118,7 @@ my %options_spec = (
 	'more-choices' => sub { $urpm->{options}{morechoices} = 1 },
 	'expect-install!' => \$::expect_install,
 	'nolock' => \$::nolock,
+	restricted => \$::restricted,
 	a => \$::all,
 	q => sub { --$::verbose; $::rpm_opt = '' },
 	v => sub { ++$::verbose; $::rpm_opt = 'vh' },
diff --git a/urpmi b/urpmi
index dc3ab3fe..d9de5ab4 100755
--- a/urpmi
+++ b/urpmi
@@ -22,7 +22,7 @@ use strict;
 use urpm;
 use urpm::args;
 use urpm::msg;
-use urpm::util qw/untaint/;
+use urpm::util qw(untaint);
 use MDK::Common;
 
 #- contains informations to parse installed system.
@@ -57,6 +57,7 @@ our $use_provides = 1;
 our $verbose = 0;
 our $usedistrib = 0;
 our $log = '';
+our $restricted = 0;
 our $nolock = 0;
 
 my @files;
@@ -184,6 +185,16 @@ if ($install_src) {
     @names = ();
 }
 
+#- rurpmi checks
+if ($restricted) {
+    urpm::error_restricted($urpm) if @src_files || @files;
+    $urpm->{options}{keep} = 1;
+    $urpm->{options}{'verify-rpm'} = 1;
+    urpm::error_restricted($urpm) if $::root || $::usedistrib || $::force || $::env || $::parallel;
+    foreach (qw(allow-nodeps allow-force)) { urpm::error_restricted($urpm) if $urpm->{options}{$_} }
+    foreach (qw(verify-rpm))               { urpm::error_restricted($urpm) unless $urpm->{options}{$_} }
+}
+
 #- prepare bug report.
 my $bug = $urpm::args::options{bug};
 if ($bug) {