diff options
author | Iain Lane <iain.lane@canonical.com> | 2020-01-07 14:33:29 +0000 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2020-01-07 18:37:30 +0100 |
commit | 625077264ba01a108386eeea733ee244e6b7ff14 (patch) | |
tree | 467bc13e5b6dc3e9f323a8f9edcf51141e37e4c0 /units/modprobe@.service | |
parent | 7a182f10343796eab92a8256e347c11b4be78ea7 (diff) | |
download | systemd-625077264ba01a108386eeea733ee244e6b7ff14.tar.gz |
units: Split modprobing out into a separate service unit
Devices referred to by `DeviceAllow=` sandboxing are resolved into their
corresponding major numbers when the unit is loaded by looking at
`/proc/devices`. If a reference is made to a device which is not yet
available, the `DeviceAllow` is ignored and the unit's processes cannot
access that device.
In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe`
in `ExecStartPre=` to load some kernel modules. Those kernel modules
cause device nodes to become available when they are loaded: the device
nodes may not exist when the unit itself is loaded. This means that the
unit's processes will not be able to access the device since the
`DeviceAllow=` will have been resolved earlier and denied it.
One way to fix this would be to re-evaluate the available devices and
re-apply the policy to the cgroup, but this cannot work atomically on
cgroupsv1. So we fall back to a second approach: instead of running
`modprobe` via `ExecStartPre`, we move this out to a separate unit and
order it before the units which want the module.
Closes #14322.
Fixes: #13943.
Diffstat (limited to 'units/modprobe@.service')
-rw-r--r-- | units/modprobe@.service | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/units/modprobe@.service b/units/modprobe@.service new file mode 100644 index 0000000000..4c5bd637e3 --- /dev/null +++ b/units/modprobe@.service @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: LGPL-2.1+ +# +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Load kernel module %i +Documentation=man:modprobe(8) + +[Service] +Type=oneshot +ExecStart=-/sbin/modprobe -abq %I |