[systemd-bugs] [Bug 90385] nspawn: block devices passed to --bind/bind-ro are not accessible inside the container

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=90385

--- Comment #1 from Lennart Poettering <lennart at poettering.net> ---
Hmm, so in general I am not really too keen on pretending we could support
device access from inside nspawn correctly, given that that's hardly just about
raw device nodes, it's also a matter of enumeration, udev/sysfs metadata and
probing, and all that won't work without proper device virtualization in the
kernel.

That said, I figure supporting whitelisting things for device nodes listed in
--bind= is probably an OK thing to do. Hence I generally agree with the
proposed patch. 

A few notes though:

I'd like to avoid registering the container first, and then adjusting the
whitelist in a second method call. Please, let's add them to the whitelist
right at the time when we register the machine, in register_machine(). TO
implement this the nspawn parent should probably simply iterate through all
bind mounts in register_machine(), stat() them, and adding all char and block
devices it finds to the list of whitelisted devices.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/systemd-bugs/attachments/20150513/c860df9e/attachment.html>