vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

cgroups: Allow mknod for any device in systemd cgroup backend

Browse source 
Without this any container startup fails:
2014/05/20 09:20:36 setup mount namespace copy additional dev nodes mknod fuse operation not permitted

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
This commit is contained in:
Alexander Larsson 2014-05-20 09:28:44 +02:00
parent f06ca4fdd2
commit 0f44c2849c
1 changed files with 15 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
libcontainer/cgroups/systemd/apply_systemd.go
View file

@ -174,13 +174,22 @@ func Apply(c *cgroups.Cgroup, pid int) (cgroups.ActiveCgroup, error) {
path := filepath.Join(mountpoint, cgroup)
// /dev/pts/*
if err := ioutil.WriteFile(filepath.Join(path, "devices.allow"), []byte("c 136:* rwm"), 0700); err != nil {
allow := []string{
// allow mknod for any device
"c *:* m",
"b *:* m",
// /dev/pts/ - pts namespaces are "coming soon"
"c 136:* rwm",
// tuntap
"c 10:200 rwm",
}
for _, val := range allow {
if err := ioutil.WriteFile(filepath.Join(path, "devices.allow"), []byte(val), 0700); err != nil {
return nil, err
}
// tuntap
if err := ioutil.WriteFile(filepath.Join(path, "devices.allow"), []byte("c 10:200 rwm"), 0700); err != nil {
return nil, err
}
}