Attachment 115783 Details for Bug 90385 – patch - nspawn - DeviceAllow for block and char devices that are passed --bind/--bind-ro

[patch] patch - nspawn - DeviceAllow for block and char devices that are passed --bind/--bind-ro

nspawn-bind-cgroup-deviceallow-for-devnode.patch (text/plain), 2.57 KB, created by Stefan Junker on 2015-05-14 20:46:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Junker

Created: 2015-05-14 20:46:44 UTC

Size: 2.57 KB

patch

obsolete

>diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
>index fbf2344..8aa7b45 100644
>--- a/src/nspawn/nspawn.c
>+++ b/src/nspawn/nspawn.c
>@@ -2210,6 +2210,7 @@ static int register_machine(pid_t pid, int local_ifindex) {
>         } else {
>                 _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
>                 char **i;
>+                unsigned j;
> 
>                 r = sd_bus_message_new_method_call(
>                                 bus,
>@@ -2276,6 +2277,24 @@ static int register_machine(pid_t pid, int local_ifindex) {
>                 if (r < 0)
>                         return bus_log_create_error(r);
> 
>+                for (j = 0; j < arg_n_custom_mounts; j++) {
>+                        CustomMount *cm = &arg_custom_mounts[j];
>+
>+                        if (cm->type != CUSTOM_MOUNT_BIND)
>+                                continue;
>+
>+                        r = is_device_node(cm->source);
>+                        if (r < 0)
>+                                return log_error_errno(r, "Failed to stat %s: %m", cm->source);
>+
>+                        if (r) {
>+                                r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 1,
>+                                        cm->source, cm->read_only ? "r" : "rw");
>+                                if (r < 0)
>+                                        return log_error_errno(r, "Failed to append message arguments: %m");
>+                        }
>+                }
>+
>                 if (arg_kill_signal != 0) {
>                         r = sd_bus_message_append(m, "(sv)", "KillSignal", "i", arg_kill_signal);
>                         if (r < 0)
>diff --git a/src/shared/util.c b/src/shared/util.c
>index 72711e1..dda88bd 100644
>--- a/src/shared/util.c
>+++ b/src/shared/util.c
>@@ -5435,6 +5435,15 @@ int is_dir(const char* path, bool follow) {
>         return !!S_ISDIR(st.st_mode);
> }
> 
>+int is_device_node(const char *path) {
>+        struct stat info;
>+
>+        if (lstat(path, &info) < 0)
>+                return -errno;
>+
>+        return !!(S_ISBLK(info.st_mode) || S_ISCHR(info.st_mode));
>+}
>+
> int unquote_first_word(const char **p, char **ret, UnquoteFlags flags) {
>         _cleanup_free_ char *s = NULL;
>         size_t allocated = 0, sz = 0;
>diff --git a/src/shared/util.h b/src/shared/util.h
>index 0c81e3d..22f505c 100644
>--- a/src/shared/util.h
>+++ b/src/shared/util.h
>@@ -852,6 +852,7 @@ int take_password_lock(const char *root);
> 
> int is_symlink(const char *path);
> int is_dir(const char *path, bool follow);
>+int is_device_node(const char *path);
> 
> typedef enum UnquoteFlags {
>         UNQUOTE_RELAX     = 1,

Actions: View | Splinter Review

Attachments on bug 90385: 115666 | 115749 | 115783

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.