Kir Kolyshkin 2ce40b6ad7 Remove tun/tap from the default device rules ...

Looking through git blame, this was added by commit 9fac18329
aka "Initial commit of runc binary", most probably by mistake.

Obviously, a container should not have access to tun/tap device, unless
it is explicitly specified in configuration.

Now, removing this might create a compatibility issue, but I see no
other choice.

Aside from the obvious misconfiguration, this should also fix the
annoying

> Apr 26 03:46:56 foo.bar systemd[1]: Couldn't stat device /dev/char/10:200: No such file or directory

messages from systemd on every container start, when runc uses systemd
cgroup driver, and the system runs an old (< v240) version of systemd
(the message was presumably eliminated by [1]).

[1] https://github.com/systemd/systemd/pull/10996/commits/d5aecba6e0b7c73657c4cf544ce57289115098e7

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2022-05-04 15:38:58 -07:00

..

example.go

Fix cgroup2 mount for rootless case

2021-04-20 12:35:40 -07:00

spec_linux_test.go

libct/seccomp/config: add missing KillThread, KillProcess

2022-05-04 16:22:09 +02:00

spec_linux.go

Remove tun/tap from the default device rules

2022-05-04 15:38:58 -07:00