kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #40291 from akhilerm/privileged-device

Browse source 
35991- make `--device` works at privileged mode
This commit is contained in:
Brian Goff 2020-01-02 10:09:31 -08:00 committed by GitHub
commit 03163f6825
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
daemon/container.go
View file

@ -275,6 +275,7 @@ func validateHostConfig(hostConfig *containertypes.HostConfig, platform string)
if hostConfig == nil { if hostConfig == nil {
return nil return nil
} }
if hostConfig.AutoRemove && !hostConfig.RestartPolicy.IsNone() { if hostConfig.AutoRemove && !hostConfig.RestartPolicy.IsNone() {
return errors.Errorf("can't create 'AutoRemove' container with restart policy") return errors.Errorf("can't create 'AutoRemove' container with restart policy")
} }

20
daemon/oci_linux.go
View file

@ -805,6 +805,7 @@ func WithDevices(daemon *Daemon, c *container.Container) coci.SpecOpts {
// Build lists of devices allowed and created within the container. // Build lists of devices allowed and created within the container.
var devs []specs.LinuxDevice var devs []specs.LinuxDevice
devPermissions := s.Linux.Resources.Devices devPermissions := s.Linux.Resources.Devices
if c.HostConfig.Privileged && !rsystem.RunningInUserNS() { if c.HostConfig.Privileged && !rsystem.RunningInUserNS() {
hostDevices, err := devices.HostDevices() hostDevices, err := devices.HostDevices()
if err != nil { if err != nil {
@ -813,6 +814,25 @@ func WithDevices(daemon *Daemon, c *container.Container) coci.SpecOpts {
for _, d := range hostDevices { for _, d := range hostDevices {
devs = append(devs, oci.Device(d)) devs = append(devs, oci.Device(d))
} }
// adding device mappings in privileged containers
for _, deviceMapping := range c.HostConfig.Devices {
// issue a warning that custom cgroup permissions are ignored in privileged mode
if deviceMapping.CgroupPermissions != "rwm" {
logrus.WithField("container", c.ID).Warnf("custom %s permissions for device %s are ignored in privileged mode", deviceMapping.CgroupPermissions, deviceMapping.PathOnHost)
}
// issue a warning that the device path already exists via /dev mounting in privileged mode
if deviceMapping.PathOnHost == deviceMapping.PathInContainer {
logrus.WithField("container", c.ID).Warnf("path in container %s already exists in privileged mode", deviceMapping.PathInContainer)
continue
}
d, _, err := oci.DevicesFromPath(deviceMapping.PathOnHost, deviceMapping.PathInContainer, "rwm")
if err != nil {
return err
}
devs = append(devs, d...)
}
devPermissions = []specs.LinuxDeviceCgroup{ devPermissions = []specs.LinuxDeviceCgroup{
{ {
Allow: true, Allow: true,