From 7d711efb9c6fd6d025cb688aa8317ce6a78db711 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 19 Mar 2014 22:00:43 +0100 Subject: core: make sure we can combine DevicePolicy=closed with PrivateDevices=yes if PrivateDevices=yes is used we need to make sure we can still create /dev/null and so on. --- src/core/cgroup.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/core/cgroup.c b/src/core/cgroup.c index 9cc8544fc7..3dd4c9129c 100644 --- a/src/core/cgroup.c +++ b/src/core/cgroup.c @@ -364,16 +364,22 @@ void cgroup_context_apply(CGroupContext *c, CGroupControllerMask mask, const cha if (c->device_policy == CGROUP_CLOSED || (c->device_policy == CGROUP_AUTO && c->device_allow)) { static const char auto_devices[] = - "/dev/null\0" "rw\0" - "/dev/zero\0" "rw\0" - "/dev/full\0" "rw\0" - "/dev/random\0" "rw\0" - "/dev/urandom\0" "rw\0"; + "/dev/null\0" "rwm\0" + "/dev/zero\0" "rwm\0" + "/dev/full\0" "rwm\0" + "/dev/random\0" "rwm\0" + "/dev/urandom\0" "rwm\0" + "/dev/tty\0" "rwm\0" + "/dev/pts/ptmx\0" "rw\0"; /* /dev/pts/ptmx may not be duplicated, but accessed */ const char *x, *y; NULSTR_FOREACH_PAIR(x, y, auto_devices) whitelist_device(path, x, y); + + whitelist_major(path, "pts", 'c', "rw"); + whitelist_major(path, "kdbus", 'c', "rw"); + whitelist_major(path, "kdbus/*", 'c', "rw"); } LIST_FOREACH(device_allow, a, c->device_allow) { -- cgit v1.2.3-54-g00ecf