<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - nspawn: block devices passed to --bind/bind-ro are not accessible inside the container" href="https://bugs.freedesktop.org/show_bug.cgi?id=90385#c1">Comment # 1</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - nspawn: block devices passed to --bind/bind-ro are not accessible inside the container" href="https://bugs.freedesktop.org/show_bug.cgi?id=90385">bug 90385</a> from <a class="email" href="mailto:lennart@poettering.net" title="Lennart Poettering <lennart@poettering.net>"> Lennart Poettering</a> <pre>Hmm, so in general I am not really too keen on pretending we could support device access from inside nspawn correctly, given that that's hardly just about raw device nodes, it's also a matter of enumeration, udev/sysfs metadata and probing, and all that won't work without proper device virtualization in the kernel. That said, I figure supporting whitelisting things for device nodes listed in --bind= is probably an OK thing to do. Hence I generally agree with the proposed patch. A few notes though: I'd like to avoid registering the container first, and then adjusting the whitelist in a second method call. Please, let's add them to the whitelist right at the time when we register the machine, in register_machine(). TO implement this the nspawn parent should probably simply iterate through all bind mounts in register_machine(), stat() them, and adding all char and block devices it finds to the list of whitelisted devices.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> <li>You are the assignee for the bug.</li> </ul> </body> </html>