diff options
| author | Iain Lane <iain.lane@canonical.com> | 2020-01-07 14:33:29 +0000 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2020-01-07 18:37:30 +0100 |
| commit | 625077264ba01a108386eeea733ee244e6b7ff14 (patch) | |
| tree | 467bc13e5b6dc3e9f323a8f9edcf51141e37e4c0 /units/systemd-logind.service.in | |
| parent | 7a182f10343796eab92a8256e347c11b4be78ea7 (diff) | |
| download | systemd-625077264ba01a108386eeea733ee244e6b7ff14.tar.gz | |
units: Split modprobing out into a separate service unit
Devices referred to by `DeviceAllow=` sandboxing are resolved into their
corresponding major numbers when the unit is loaded by looking at
`/proc/devices`. If a reference is made to a device which is not yet
available, the `DeviceAllow` is ignored and the unit's processes cannot
access that device.
In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe`
in `ExecStartPre=` to load some kernel modules. Those kernel modules
cause device nodes to become available when they are loaded: the device
nodes may not exist when the unit itself is loaded. This means that the
unit's processes will not be able to access the device since the
`DeviceAllow=` will have been resolved earlier and denied it.
One way to fix this would be to re-evaluate the available devices and
re-apply the policy to the cgroup, but this cannot work atomically on
cgroupsv1. So we fall back to a second approach: instead of running
`modprobe` via `ExecStartPre`, we move this out to a separate unit and
order it before the units which want the module.
Closes #14322.
Fixes: #13943.
Diffstat (limited to 'units/systemd-logind.service.in')
| -rw-r--r-- | units/systemd-logind.service.in | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index ccbe631586..23aa828591 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -12,8 +12,8 @@ Description=Login Service Documentation=man:systemd-logind.service(8) man:logind.conf(5) Documentation=https://www.freedesktop.org/wiki/Software/systemd/logind Documentation=https://www.freedesktop.org/wiki/Software/systemd/multiseat -Wants=user.slice -After=nss-user-lookup.target user.slice +Wants=user.slice modprobe@drm.service +After=nss-user-lookup.target user.slice modprobe@drm.service # Ask for the dbus socket. Wants=dbus.socket @@ -29,7 +29,6 @@ DeviceAllow=char-input rw DeviceAllow=char-tty rw DeviceAllow=char-vcs rw # Make sure the DeviceAllow= lines above can work correctly when referenceing char-drm -ExecStartPre=-/sbin/modprobe -abq drm ExecStart=@rootlibexecdir@/systemd-logind FileDescriptorStoreMax=512 IPAddressDeny=any |