2 Commits

Author	SHA1	Message	Date
Lennart Poettering	d5016c21d7	units: tweaks to modprobe@.service ... Let's use uppercase wording in the description string, like we usually do. Let's allow using this service in early boot. If it's pulled into the initial transaction it's better to finish loading this before sysinit.target. Don't bother with this in containers that lack CAP_SYS_MODULE	2020-01-07 18:54:24 +01:00
Iain Lane	625077264b	units: Split modprobing out into a separate service unit ... Devices referred to by `DeviceAllow=` sandboxing are resolved into their corresponding major numbers when the unit is loaded by looking at `/proc/devices`. If a reference is made to a device which is not yet available, the `DeviceAllow` is ignored and the unit's processes cannot access that device. In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe` in `ExecStartPre=` to load some kernel modules. Those kernel modules cause device nodes to become available when they are loaded: the device nodes may not exist when the unit itself is loaded. This means that the unit's processes will not be able to access the device since the `DeviceAllow=` will have been resolved earlier and denied it. One way to fix this would be to re-evaluate the available devices and re-apply the policy to the cgroup, but this cannot work atomically on cgroupsv1. So we fall back to a second approach: instead of running `modprobe` via `ExecStartPre`, we move this out to a separate unit and order it before the units which want the module. Closes #14322. Fixes: #13943.	2020-01-07 18:37:30 +01:00