[systemd-bugs] [Bug 90385] New: nspawn: block devices passed to --bind/bind-ro are not accessible inside the container

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=90385

            Bug ID: 90385
           Summary: nspawn: block devices passed to --bind/bind-ro are not
                    accessible inside the container
           Product: systemd
           Version: unspecified
          Hardware: Other
                OS: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: general
          Assignee: systemd-bugs at lists.freedesktop.org
          Reporter: code at stefanjunker.de
        QA Contact: systemd-bugs at lists.freedesktop.org

Created attachment 115666
  --> https://bugs.freedesktop.org/attachment.cgi?id=115666&action=edit
patch - nspawn - DeviceAllow for block devices that are passed --bind/--bind-ro

When systemd-nspawn is called with the --bind or --bind-ro arguments and passed
a block device, e.g. /dev/mmcblk0p1, the device is not accessible inside the
container due to cgroup restrictions.

Testing or more generally running software that is only supposed to access
specific block devices would be a convenient use-case for containers, with
virtual machines being the conservative method for this. The fact that
--bind/--bind-ro supports renaming paths for mounting them inside the container
could be useful for running predefined routines that use a fixed device name,
which can be swapped very easily by simply changing an argument for the
specific container instance.

Blocking access to all system block devices is a good safety measure. Providing
users with the possibility to override this for specific devices is a good
feature.

I've attached a patch which adds detection of block devices to the
mount_bind(). For every blockdevice source file the DeviceAllow property will
be set for the scope of the machine that is being started.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/systemd-bugs/attachments/20150510/3c313063/attachment.html>