mirror of
https://github.com/systemd/systemd-stable.git
synced 2024-10-26 17:25:34 +03:00
units: Split modprobing out into a separate service unit
Devices referred to by `DeviceAllow=` sandboxing are resolved into their corresponding major numbers when the unit is loaded by looking at `/proc/devices`. If a reference is made to a device which is not yet available, the `DeviceAllow` is ignored and the unit's processes cannot access that device. In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe` in `ExecStartPre=` to load some kernel modules. Those kernel modules cause device nodes to become available when they are loaded: the device nodes may not exist when the unit itself is loaded. This means that the unit's processes will not be able to access the device since the `DeviceAllow=` will have been resolved earlier and denied it. One way to fix this would be to re-evaluate the available devices and re-apply the policy to the cgroup, but this cannot work atomically on cgroupsv1. So we fall back to a second approach: instead of running `modprobe` via `ExecStartPre`, we move this out to a separate unit and order it before the units which want the module. Closes #14322. Fixes: #13943.
This commit is contained in:
parent
7a182f1034
commit
625077264b
@ -35,6 +35,7 @@ units = [
|
||||
['local-fs.target', ''],
|
||||
['machine.slice', 'ENABLE_MACHINED'],
|
||||
['machines.target', 'ENABLE_MACHINED'],
|
||||
['modprobe@.service', ''],
|
||||
['multi-user.target', '',
|
||||
'runlevel2.target runlevel3.target runlevel4.target'],
|
||||
['network-online.target', ''],
|
||||
|
16
units/modprobe@.service
Normal file
16
units/modprobe@.service
Normal file
@ -0,0 +1,16 @@
|
||||
# SPDX-License-Identifier: LGPL-2.1+
|
||||
#
|
||||
# This file is part of systemd.
|
||||
#
|
||||
# systemd is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU Lesser General Public License as published by
|
||||
# the Free Software Foundation; either version 2.1 of the License, or
|
||||
# (at your option) any later version.
|
||||
|
||||
[Unit]
|
||||
Description=Load kernel module %i
|
||||
Documentation=man:modprobe(8)
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=-/sbin/modprobe -abq %I
|
@ -12,8 +12,8 @@ Description=Login Service
|
||||
Documentation=man:systemd-logind.service(8) man:logind.conf(5)
|
||||
Documentation=https://www.freedesktop.org/wiki/Software/systemd/logind
|
||||
Documentation=https://www.freedesktop.org/wiki/Software/systemd/multiseat
|
||||
Wants=user.slice
|
||||
After=nss-user-lookup.target user.slice
|
||||
Wants=user.slice modprobe@drm.service
|
||||
After=nss-user-lookup.target user.slice modprobe@drm.service
|
||||
|
||||
# Ask for the dbus socket.
|
||||
Wants=dbus.socket
|
||||
@ -29,7 +29,6 @@ DeviceAllow=char-input rw
|
||||
DeviceAllow=char-tty rw
|
||||
DeviceAllow=char-vcs rw
|
||||
# Make sure the DeviceAllow= lines above can work correctly when referenceing char-drm
|
||||
ExecStartPre=-/sbin/modprobe -abq drm
|
||||
ExecStart=@rootlibexecdir@/systemd-logind
|
||||
FileDescriptorStoreMax=512
|
||||
IPAddressDeny=any
|
||||
|
@ -10,14 +10,14 @@
|
||||
[Unit]
|
||||
Description=Container %i
|
||||
Documentation=man:systemd-nspawn(1)
|
||||
Wants=modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service
|
||||
PartOf=machines.target
|
||||
Before=machines.target
|
||||
After=network.target systemd-resolved.service
|
||||
After=network.target systemd-resolved.service modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service
|
||||
RequiresMountsFor=/var/lib/machines
|
||||
|
||||
[Service]
|
||||
# Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others)
|
||||
ExecStartPre=-/sbin/modprobe -abq tun loop dm-mod
|
||||
ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
|
||||
KillMode=mixed
|
||||
Type=notify
|
||||
|
Loading…
Reference in New Issue
Block a user