vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Merge pull request #6097 from timthelion/consistentdevices

Browse source 
Refactor device handling code
This commit is contained in:
unclejack 2014-05-31 03:34:52 +03:00
commit 000552944e
11 changed files with 377 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

34
libcontainer/cgroups/fs/devices.go
View file

@ -11,41 +11,13 @@ func (s *devicesGroup) Set(d *data) error {
return err
}
if !d.c.DeviceAccess {
if !d.c.AllowAllDevices {
if err := writeFile(dir, "devices.deny", "a"); err != nil {
return err
}
allow := []string{
// allow mknod for any device
"c *:* m",
"b *:* m",
// /dev/null, zero, full
"c 1:3 rwm",
"c 1:5 rwm",
"c 1:7 rwm",
// consoles
"c 5:1 rwm",
"c 5:0 rwm",
"c 4:0 rwm",
"c 4:1 rwm",
// /dev/urandom,/dev/random
"c 1:9 rwm",
"c 1:8 rwm",
// /dev/pts/ - pts namespaces are "coming soon"
"c 136:* rwm",
"c 5:2 rwm",
// tuntap
"c 10:200 rwm",
}
for _, val := range allow {
if err := writeFile(dir, "devices.allow", val); err != nil {
for _, dev := range d.c.AllowedDevices {
if err := writeFile(dir, "devices.allow", dev.GetCgroupAllowString()); err != nil {
return err
}
}