From 75a92ea615c81ae837165a42f553167a1124dede Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 22 Apr 2020 11:05:10 -0700 Subject: [PATCH] cgroupv2: allow to set EnableAllDevices=true In this case we just do not install any eBPF rules checking the devices. Signed-off-by: Kir Kolyshkin --- libcontainer/cgroups/fs2/devices.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libcontainer/cgroups/fs2/devices.go b/libcontainer/cgroups/fs2/devices.go index e0fd68540..6e45c7879 100644 --- a/libcontainer/cgroups/fs2/devices.go +++ b/libcontainer/cgroups/fs2/devices.go @@ -40,11 +40,15 @@ func canSkipEBPFError(cgroup *configs.Cgroup) bool { func setDevices(dirPath string, cgroup *configs.Cgroup) error { devices := cgroup.Devices + // never set by OCI specconv if allowAllDevices := cgroup.Resources.AllowAllDevices; allowAllDevices != nil { - // never set by OCI specconv, but *allowAllDevices=false is still used by the integration test if *allowAllDevices == true { - return errors.New("libcontainer AllowAllDevices is not supported, use Devices") + if len(cgroup.Resources.DeniedDevices) != 0 { + return errors.New("libcontainer: can't use DeniedDevices together with AllowAllDevices") + } + return nil } + // *allowAllDevices=false is still used by the integration test for _, ad := range cgroup.Resources.AllowedDevices { d := *ad d.Allow = true