From 5a7f87a9e0f7c272a272976fa76a17b54e6f7903 Mon Sep 17 00:00:00 2001 From: Alan Jenkins Date: Thu, 18 Jan 2018 12:07:31 +0000 Subject: [PATCH 1/2] core: un-break PrivateDevices= by allowing it to mknod /dev/ptmx #7886 caused PrivateDevices= to silently fail-open. https://github.com/systemd/systemd/pull/7886#issuecomment-358542849 Allow PrivateDevices= to succeed, in creating /dev/ptmx, even though DeviceControl=closed applies. No specific justification was given for blocking mknod of /dev/ptmx. Only that we didn't seem to need it, because we weren't creating it correctly as a device node. --- src/core/cgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/core/cgroup.c b/src/core/cgroup.c index d08b4a0787..c2c4ef1b42 100644 --- a/src/core/cgroup.c +++ b/src/core/cgroup.c @@ -978,7 +978,7 @@ static void cgroup_context_apply( "/dev/random\0" "rwm\0" "/dev/urandom\0" "rwm\0" "/dev/tty\0" "rwm\0" - "/dev/pts/ptmx\0" "rw\0" /* /dev/pts/ptmx may not be duplicated, but accessed */ + "/dev/ptmx\0" "rwm\0" /* Allow /run/systemd/inaccessible/{chr,blk} devices for mapping InaccessiblePaths */ "-/run/systemd/inaccessible/chr\0" "rwm\0" "-/run/systemd/inaccessible/blk\0" "rwm\0"; @@ -988,6 +988,7 @@ static void cgroup_context_apply( NULSTR_FOREACH_PAIR(x, y, auto_devices) whitelist_device(path, x, y); + /* PTS (/dev/pts) devices may not be duplicated, but accessed */ whitelist_major(path, "pts", 'c', "rw"); } From 225874dc9c40190cf58662e663c9b599c9e55c8c Mon Sep 17 00:00:00 2001 From: Alan Jenkins Date: Thu, 18 Jan 2018 13:58:13 +0000 Subject: [PATCH 2/2] core: clone_device_node(): add debug message For people who use debug messages, maybe it is helpful to know that PrivateDevices= failed due to mknod(), and which device node. (The other (un-logged) failures could be while mounting filesystems e.g. no CAP_SYS_ADMIN which is the common case, or missing /dev/shm or /dev/pts, or missing /dev/ptmx). --- src/core/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/namespace.c b/src/core/namespace.c index d6c1b1b2fc..e1a9d7a92d 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -523,7 +523,7 @@ static int clone_device_node(const char *d, const char *temporary_mount) { mac_selinux_create_file_clear(); if (r < 0) - return -errno; + return log_debug_errno(errno, "mknod failed for %s: %m", d); return 0; }