mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4612 from kolyshkin/fix-systemd-reload

Browse Source 
libct/cg/sd: set the DeviceAllow property before DevicePolicy
This commit is contained in:
Akihiro Suda
2025-02-07 11:37:10 +09:00
committed by GitHub
parent a509935304 d84388ae10
commit dadea505df
2 changed files with 23 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/cgroups/devices/systemd.go
+11 -3
View File
@@ -23,10 +23,18 @@ func systemdProperties(r *cgroups.Resources, sdVer int) ([]systemdDbus.Property,
}
properties := []systemdDbus.Property{
// When we later add DeviceAllow=/dev/foo properties, we are
// appending devices to the allow list for the unit. However,
// if this is an existing unit, it already has DeviceAllow=
// entries, and we need to clear them all before applying the
// new set. (We also do this for new units, mainly for safety
// to ensure we only enable the devices we expect.)
//
// To clear any existing DeviceAllow= rules, we have to add an
// empty DeviceAllow= property.
newProp("DeviceAllow", []deviceAllowEntry{}),
// Always run in the strictest white-list mode.
newProp("DevicePolicy", "strict"),
// Empty the DeviceAllow array before filling it.
newProp("DeviceAllow", []deviceAllowEntry{}),
}
// Figure out the set of rules.
@@ -239,7 +247,7 @@ func allowAllDevices() []systemdDbus.Property {
// Setting mode to auto and removing all DeviceAllow rules
// results in allowing access to all devices.
return []systemdDbus.Property{
newProp("DevicePolicy", "auto"),
newProp("DeviceAllow", []deviceAllowEntry{}),
newProp("DevicePolicy", "auto"),
}
}