units: Split modprobing out into a separate service unit

Devices referred to by `DeviceAllow=` sandboxing are resolved into their
corresponding major numbers when the unit is loaded by looking at
`/proc/devices`. If a reference is made to a device which is not yet
available, the `DeviceAllow` is ignored and the unit's processes cannot
access that device.

In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe`
in `ExecStartPre=` to load some kernel modules. Those kernel modules
cause device nodes to become available when they are loaded: the device
nodes may not exist when the unit itself is loaded. This means that the
unit's processes will not be able to access the device since the
`DeviceAllow=` will have been resolved earlier and denied it.

One way to fix this would be to re-evaluate the available devices and
re-apply the policy to the cgroup, but this cannot work atomically on
cgroupsv1. So we fall back to a second approach: instead of running
`modprobe` via `ExecStartPre`, we move this out to a separate unit and
order it before the units which want the module.

Closes #14322.
Fixes: #13943.

diff --git a/units/meson.build b/units/meson.build
index c809011fc5ea6e4dc457d5f31f708830c20bc913..4ad64d12f255f7a6fc4cb3413cc48dbadab656a6 100644 (file)
--- a/units/meson.build
+++ b/units/meson.build
@@ -35,6 +35,7 @@ units = [
         ['local-fs.target',                     ''],
         ['machine.slice',                       'ENABLE_MACHINED'],
         ['machines.target',                     'ENABLE_MACHINED'],
+        ['modprobe@.service',                   ''],
         ['multi-user.target',                   '',
          'runlevel2.target runlevel3.target runlevel4.target'],
         ['network-online.target',               ''],

diff --git a/units/modprobe@.service b/units/modprobe@.service
new file mode 100644 (file)
index 0000000..4c5bd63
--- /dev/null
+++ b/units/modprobe@.service
@@ -0,0 +1,16 @@
+#  SPDX-License-Identifier: LGPL-2.1+
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Load kernel module %i
+Documentation=man:modprobe(8)
+
+[Service]
+Type=oneshot
+ExecStart=-/sbin/modprobe -abq %I

diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in
index ccbe6315860d0107b40f8f511587fa03e3dbc12b..23aa828591c434939679b796166237fde60dcf2e 100644 (file)
--- a/units/systemd-logind.service.in
+++ b/units/systemd-logind.service.in
@@ -12,8 +12,8 @@ Description=Login Service
 Documentation=man:systemd-logind.service(8) man:logind.conf(5)
 Documentation=https://www.freedesktop.org/wiki/Software/systemd/logind
 Documentation=https://www.freedesktop.org/wiki/Software/systemd/multiseat
-Wants=user.slice
-After=nss-user-lookup.target user.slice
+Wants=user.slice modprobe@drm.service
+After=nss-user-lookup.target user.slice modprobe@drm.service
 
 # Ask for the dbus socket.
 Wants=dbus.socket
@@ -29,7 +29,6 @@ DeviceAllow=char-input rw
 DeviceAllow=char-tty rw
 DeviceAllow=char-vcs rw
 # Make sure the DeviceAllow= lines above can work correctly when referenceing char-drm
-ExecStartPre=-/sbin/modprobe -abq drm
 ExecStart=@rootlibexecdir@/systemd-logind
 FileDescriptorStoreMax=512
 IPAddressDeny=any

diff --git a/units/systemd-nspawn@.service.in b/units/systemd-nspawn@.service.in
index 669fea3c12ca0f0b01cffb82e2d5c9e008e93828..5367ee44105b3bf7dddd21e2773f5473bdee7a64 100644 (file)
--- a/units/systemd-nspawn@.service.in
+++ b/units/systemd-nspawn@.service.in
@@ -10,14 +10,14 @@
 [Unit]
 Description=Container %i
 Documentation=man:systemd-nspawn(1)
+Wants=modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service
 PartOf=machines.target
 Before=machines.target
-After=network.target systemd-resolved.service
+After=network.target systemd-resolved.service modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service
 RequiresMountsFor=/var/lib/machines
 
 [Service]
 # Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others)
-ExecStartPre=-/sbin/modprobe -abq tun loop dm-mod
 ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
 KillMode=mixed
 Type=notify