mirrors/systemd
0
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-23 02:03:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

nspawn: sync DeviceAllow= setting with systemd-nspawn@.service

Browse Source 
Follow-up for dc3223919f.
Addresses https://github.com/systemd/systemd/pull/34067#discussion_r1748592958.

Otherwise, containers started with and without --keep-unit option run in
different device policies.
This commit is contained in:
Yu Watanabe 2024-09-10 03:38:13 +09:00
parent 8b29949a41
commit b86b90cec5
2 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/nspawn/nspawn-register.c
View File

@ -43,7 +43,7 @@ static int append_machine_properties(
return bus_log_create_error(r);
if (enable_fuse) {
r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 1,
"/dev/fuse", "rw");
"/dev/fuse", "rwm");
if (r < 0)
return bus_log_create_error(r);
}

3
units/systemd-nspawn@.service.in
View File

@ -36,9 +36,6 @@ TasksMax=16384
DevicePolicy=closed
DeviceAllow=/dev/net/tun rwm
DeviceAllow=char-pts rw
{# /dev/fuse gets 'm' here even though it doesn't in nspawn-register.c, since
# efedb6b0f3 (nspawn: refuse to bind mount device node from host when
# --private-users= is specified, 2024-09-05) #}
DeviceAllow=/dev/fuse rwm
# nspawn itself needs access to /dev/loop-control and /dev/loop, to implement