diff options
| author | Iain Lane <iain.lane@canonical.com> | 2020-01-07 14:33:29 +0000 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2020-01-07 18:37:30 +0100 |
| commit | 625077264ba01a108386eeea733ee244e6b7ff14 (patch) | |
| tree | 467bc13e5b6dc3e9f323a8f9edcf51141e37e4c0 /units | |
| parent | 7a182f10343796eab92a8256e347c11b4be78ea7 (diff) | |
| download | systemd-625077264ba01a108386eeea733ee244e6b7ff14.tar.gz | |
units: Split modprobing out into a separate service unit
Devices referred to by `DeviceAllow=` sandboxing are resolved into their
corresponding major numbers when the unit is loaded by looking at
`/proc/devices`. If a reference is made to a device which is not yet
available, the `DeviceAllow` is ignored and the unit's processes cannot
access that device.
In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe`
in `ExecStartPre=` to load some kernel modules. Those kernel modules
cause device nodes to become available when they are loaded: the device
nodes may not exist when the unit itself is loaded. This means that the
unit's processes will not be able to access the device since the
`DeviceAllow=` will have been resolved earlier and denied it.
One way to fix this would be to re-evaluate the available devices and
re-apply the policy to the cgroup, but this cannot work atomically on
cgroupsv1. So we fall back to a second approach: instead of running
`modprobe` via `ExecStartPre`, we move this out to a separate unit and
order it before the units which want the module.
Closes #14322.
Fixes: #13943.
Diffstat (limited to 'units')
| -rw-r--r-- | units/meson.build | 1 | ||||
| -rw-r--r-- | units/modprobe@.service | 16 | ||||
| -rw-r--r-- | units/systemd-logind.service.in | 5 | ||||
| -rw-r--r-- | units/systemd-nspawn@.service.in | 4 |
4 files changed, 21 insertions, 5 deletions
diff --git a/units/meson.build b/units/meson.build index c809011fc5..4ad64d12f2 100644 --- a/units/meson.build +++ b/units/meson.build @@ -35,6 +35,7 @@ units = [ ['local-fs.target', ''], ['machine.slice', 'ENABLE_MACHINED'], ['machines.target', 'ENABLE_MACHINED'], + ['modprobe@.service', ''], ['multi-user.target', '', 'runlevel2.target runlevel3.target runlevel4.target'], ['network-online.target', ''], diff --git a/units/modprobe@.service b/units/modprobe@.service new file mode 100644 index 0000000000..4c5bd637e3 --- /dev/null +++ b/units/modprobe@.service @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: LGPL-2.1+ +# +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Load kernel module %i +Documentation=man:modprobe(8) + +[Service] +Type=oneshot +ExecStart=-/sbin/modprobe -abq %I diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index ccbe631586..23aa828591 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -12,8 +12,8 @@ Description=Login Service Documentation=man:systemd-logind.service(8) man:logind.conf(5) Documentation=https://www.freedesktop.org/wiki/Software/systemd/logind Documentation=https://www.freedesktop.org/wiki/Software/systemd/multiseat -Wants=user.slice -After=nss-user-lookup.target user.slice +Wants=user.slice modprobe@drm.service +After=nss-user-lookup.target user.slice modprobe@drm.service # Ask for the dbus socket. Wants=dbus.socket @@ -29,7 +29,6 @@ DeviceAllow=char-input rw DeviceAllow=char-tty rw DeviceAllow=char-vcs rw # Make sure the DeviceAllow= lines above can work correctly when referenceing char-drm -ExecStartPre=-/sbin/modprobe -abq drm ExecStart=@rootlibexecdir@/systemd-logind FileDescriptorStoreMax=512 IPAddressDeny=any diff --git a/units/systemd-nspawn@.service.in b/units/systemd-nspawn@.service.in index 669fea3c12..5367ee4410 100644 --- a/units/systemd-nspawn@.service.in +++ b/units/systemd-nspawn@.service.in @@ -10,14 +10,14 @@ [Unit] Description=Container %i Documentation=man:systemd-nspawn(1) +Wants=modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service PartOf=machines.target Before=machines.target -After=network.target systemd-resolved.service +After=network.target systemd-resolved.service modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service RequiresMountsFor=/var/lib/machines [Service] # Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others) -ExecStartPre=-/sbin/modprobe -abq tun loop dm-mod ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i KillMode=mixed Type=notify |