From: Alessandro Puccetti <alessandro@kinvolk.io>
Date: Fri, 22 Jul 2016 10:00:49 +0000 (+0200)
Subject: cgroup: whitelist inaccessible devices for "auto" and "closed" DevicePolicy.
X-Git-Tag: v231~25^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F3779%2Fhead;p=thirdparty%2Fsystemd.git

cgroup: whitelist inaccessible devices for "auto" and "closed" DevicePolicy.

https://github.com/systemd/systemd/pull/3685 introduced
/run/systemd/inaccessible/{chr,blk} to map inacessible devices,
this patch allows systemd running inside a nspawn container to create
/run/systemd/inaccessible/{chr,blk}.
---

diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 8b0f11ed500..c19e43f571c 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -800,7 +800,10 @@ static void cgroup_context_apply(Unit *u, CGroupMask mask, ManagerState state) {
                                 "/dev/random\0" "rwm\0"
                                 "/dev/urandom\0" "rwm\0"
                                 "/dev/tty\0" "rwm\0"
-                                "/dev/pts/ptmx\0" "rw\0"; /* /dev/pts/ptmx may not be duplicated, but accessed */
+                                "/dev/pts/ptmx\0" "rw\0" /* /dev/pts/ptmx may not be duplicated, but accessed */
+                                /* Allow /run/systemd/inaccessible/{chr,blk} devices for mapping InaccessiblePaths */
+                                "/run/systemd/inaccessible/chr\0" "rwm\0"
+                                "/run/systemd/inaccessible/blk\0" "rwm\0";
 
                         const char *x, *y;