[lxc-devel] [lxc/lxc] 8d6ee0: autodev: adapt to changes in Linux 4.18
GitHub
noreply at github.com
Fri Jun 29 16:32:33 UTC 2018
Branch: refs/heads/stable-3.0
Home: https://github.com/lxc/lxc
Commit: 8d6ee0ca9df061d998c2496501481b9914e23119
https://github.com/lxc/lxc/commit/8d6ee0ca9df061d998c2496501481b9914e23119
Author: Christian Brauner <christian.brauner at ubuntu.com>
Date: 2018-06-29 (Fri, 29 Jun 2018)
Changed paths:
M src/lxc/conf.c
Log Message:
-----------
autodev: adapt to changes in Linux 4.18
Starting with commit
55956b59df33 ("vfs: Allow userns root to call mknod on owned filesystems.")
Linux will allow mknod() in user namespaces for userns root if CAP_MKNOD is
available.
However, these device nodes are useless since
static struct super_block *alloc_super(struct file_system_type *type, int flags,
struct user_namespace *user_ns)
{
/* <snip> */
if (s->s_user_ns != &init_user_ns)
s->s_iflags |= SB_I_NODEV;
/* <snip> */
}
will set the SB_I_NODEV flag on the filesystem. When a device node created in
non-init userns is open()ed the call chain will hit:
bool may_open_dev(const struct path *path)
{
return !(path->mnt->mnt_flags & MNT_NODEV) &&
!(path->mnt->mnt_sb->s_iflags & SB_I_NODEV);
}
which will cause an EPERM because the device node is located on an fs
owned by non-init-userns and thus doesn't grant access to device nodes due to
SB_I_NODEV.
The solution is straightforward. Unless you're real root you should bind-mount
device nodes.
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
**NOTE:** This service been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/
Functionality will be removed from GitHub.com on January 31st, 2019.
More information about the lxc-devel
mailing list