From dcc1cf7c1c9d9e366d7d7e28c57506a591b747fc Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 12 May 2021 15:54:31 +1000 Subject: [PATCH] devices: add emulator.Rules shorthand The devices cgroup emulator is also useful for removing unneeded rules as well as computing what the final default-allow state of the filter will be (allow-list or deny-list). Signed-off-by: Aleksa Sarai --- libcontainer/cgroups/devices/devices_emulator.go | 9 +++++++++ libcontainer/cgroups/systemd/common.go | 3 +-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/libcontainer/cgroups/devices/devices_emulator.go b/libcontainer/cgroups/devices/devices_emulator.go index 3572a5eae..6f29ef037 100644 --- a/libcontainer/cgroups/devices/devices_emulator.go +++ b/libcontainer/cgroups/devices/devices_emulator.go @@ -371,3 +371,12 @@ func (source *Emulator) Transition(target *Emulator) ([]*devices.Rule, error) { } return transitionRules, nil } + +// Rules returns the minimum set of rules necessary to convert a *deny-all* +// cgroup to the emulated filter state (note that this is not the same as a +// default cgroupv1 cgroup -- which is allow-all). This is effectively just a +// wrapper around Transition() with the source emulator being an empty cgroup. +func (e *Emulator) Rules() ([]*devices.Rule, error) { + defaultCgroup := &Emulator{defaultAllow: false} + return defaultCgroup.Transition(e) +} diff --git a/libcontainer/cgroups/systemd/common.go b/libcontainer/cgroups/systemd/common.go index de69617ee..e17339452 100644 --- a/libcontainer/cgroups/systemd/common.go +++ b/libcontainer/cgroups/systemd/common.go @@ -203,8 +203,7 @@ func generateDeviceProperties(rules []*devices.Rule) ([]systemdDbus.Property, er // Now generate the set of rules we actually need to apply. Unlike the // normal devices cgroup, in "strict" mode systemd defaults to a deny-all // whitelist which is the default for devices.Emulator. - baseEmu := &cgroupdevices.Emulator{} - finalRules, err := baseEmu.Transition(configEmu) + finalRules, err := configEmu.Rules() if err != nil { return nil, errors.Wrap(err, "get simplified rules for systemd") }