Kir Kolyshkin d84388ae10 libct/cg/sd: set the DeviceAllow property before DevicePolicy ...

Every unit created by runc need daemon reload since systemd v230.
This breaks support for NVIDIA GPUs, see
https://github.com/opencontainers/runc/issues/3708#issuecomment-2216967210

A workaround is to set DeviceAllow before DevicePolicy.

Also:
 - add a test case (which fails before the fix) by @kolyshkin
 - better explain why we need empty DeviceAllow (by @cyphar)

Fixes 4568.

Reported-by: Jian Wen <wenjianhn@gmail.com>
Co-authored-by: Jian Wen <wenjianhn@gmail.com>
Co-authored-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2025-02-05 12:16:43 -08:00

..

devices

libct/cg/sd: set the DeviceAllow property before DevicePolicy

2025-02-05 12:16:43 -08:00

fs

libct/cgroups/*: switch from configs to cgroups

2024-12-11 19:08:40 -08:00

fs2

libct/cgroups/*: switch from configs to cgroups

2024-12-11 19:08:40 -08:00

fscommon

libct/cgroups/*: switch from configs to cgroups

2024-12-11 19:08:40 -08:00

manager

libct/cgroups/*: switch from configs to cgroups

2024-12-11 19:08:40 -08:00

systemd

libct/cgroups/*: switch from configs to cgroups

2024-12-11 19:08:40 -08:00

cgroups_test.go

tree-wide: use /proc/thread-self for thread-local state

2023-12-14 11:36:41 +11:00

cgroups.go

libct/configs: move cgroup stuff to libct/cgroups

2024-12-11 19:08:40 -08:00

config_blkio_device.go

libct/configs: move cgroup stuff to libct/cgroups

2024-12-11 19:08:40 -08:00

config_hugepages.go

libct/configs: move cgroup stuff to libct/cgroups

2024-12-11 19:08:40 -08:00

config_ifprio_map.go

libct/configs: move cgroup stuff to libct/cgroups

2024-12-11 19:08:40 -08:00

config_linux.go

libct: switch from libct/devices to libct/cgroups/devices/config

2025-01-31 16:51:09 -08:00

config_rdma.go

libct/configs: move cgroup stuff to libct/cgroups

2024-12-11 19:08:40 -08:00

config_unsupported.go

libct/configs: move cgroup stuff to libct/cgroups

2024-12-11 19:08:40 -08:00

file_test.go

ci: rm "skip on CentOS 7" kludges

2024-11-07 13:16:16 -08:00

file.go

libct/cg: write unified resources line by line

2024-06-09 14:01:45 -07:00

getallpids_test.go

libct/*: remove linux build tag from some pkgs

2021-08-30 20:52:07 -07:00

getallpids.go

libct/cg: rm go 1.15 compatibility

2021-12-14 13:08:47 -08:00

stats.go

Merge pull request #4010 from HeRaNO/use-peak

2023-10-25 22:18:02 +08:00

utils_test.go

libct/cg: add test for remove a non-existent dir in a ro mount point

2024-11-14 23:58:35 +00:00

utils.go

libct/cg: RemovePath: improve comments

2024-11-11 23:17:42 -08:00

v1_utils.go

tree-wide: use /proc/thread-self for thread-local state

2023-12-14 11:36:41 +11:00