diff options
| author | Iain Lane <iain.lane@canonical.com> | 2020-01-07 14:33:29 +0000 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2020-01-07 18:37:30 +0100 |
| commit | 625077264ba01a108386eeea733ee244e6b7ff14 (patch) | |
| tree | 467bc13e5b6dc3e9f323a8f9edcf51141e37e4c0 /units/systemd-nspawn@.service.in | |
| parent | 7a182f10343796eab92a8256e347c11b4be78ea7 (diff) | |
| download | systemd-625077264ba01a108386eeea733ee244e6b7ff14.tar.gz | |
units: Split modprobing out into a separate service unit
Devices referred to by `DeviceAllow=` sandboxing are resolved into their
corresponding major numbers when the unit is loaded by looking at
`/proc/devices`. If a reference is made to a device which is not yet
available, the `DeviceAllow` is ignored and the unit's processes cannot
access that device.
In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe`
in `ExecStartPre=` to load some kernel modules. Those kernel modules
cause device nodes to become available when they are loaded: the device
nodes may not exist when the unit itself is loaded. This means that the
unit's processes will not be able to access the device since the
`DeviceAllow=` will have been resolved earlier and denied it.
One way to fix this would be to re-evaluate the available devices and
re-apply the policy to the cgroup, but this cannot work atomically on
cgroupsv1. So we fall back to a second approach: instead of running
`modprobe` via `ExecStartPre`, we move this out to a separate unit and
order it before the units which want the module.
Closes #14322.
Fixes: #13943.
Diffstat (limited to 'units/systemd-nspawn@.service.in')
| -rw-r--r-- | units/systemd-nspawn@.service.in | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/units/systemd-nspawn@.service.in b/units/systemd-nspawn@.service.in index 669fea3c12..5367ee4410 100644 --- a/units/systemd-nspawn@.service.in +++ b/units/systemd-nspawn@.service.in @@ -10,14 +10,14 @@ [Unit] Description=Container %i Documentation=man:systemd-nspawn(1) +Wants=modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service PartOf=machines.target Before=machines.target -After=network.target systemd-resolved.service +After=network.target systemd-resolved.service modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service RequiresMountsFor=/var/lib/machines [Service] # Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others) -ExecStartPre=-/sbin/modprobe -abq tun loop dm-mod ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i KillMode=mixed Type=notify |