cgroup: support prefix "-" in cgroups whitelisting entries (#4687)

System Internals / systemd - Dongsu Park [endocode.com] - 29 November 2016 13:16 UTC

So far systemd-nspawn container has been creating files under /run/systemd/inaccessible, no matter whether it's running in user namespace or not. That's fine for regular files, dirs, socks, fifos. However, it's not for block and character devices, because kernel doesn't allow them to be created under user namespace. It results in warnings at booting like that:


Couldn't stat device /run/systemd/inaccessible/chr Couldn't stat device /run/systemd/inaccessible/blk


Thus we need to have the cgroups whitelisting handler to silently ignore a file, when the device path is prefixed with "-". That's exactly the same convention used in directives like ReadOnlyPaths=. Also insert the prefix "-" to inaccessible entries.

e7330df cgroup: support prefix "-" in cgroups whitelisting entries (#4687)
src/core/cgroup.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)

Upstream: github.com

  • Share