SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core/cgroup: introduce cgroup_context_has_device_policy() helper

Browse Source
This commit is contained in:
Mike Yuan
2025-07-07 17:55:12 +02:00
parent f26d5d76e9
commit f3393148a5
4 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/cgroup.c
+1 -2
View File
@@ -1720,8 +1720,7 @@ static CGroupMask unit_get_cgroup_mask(Unit *u) {
unit_has_memory_config(u))
mask |= CGROUP_MASK_MEMORY;
if (c->device_allow ||
c->device_policy != CGROUP_DEVICE_POLICY_AUTO)
if (cgroup_context_has_device_policy(c))
mask |= CGROUP_MASK_DEVICES | CGROUP_MASK_BPF_DEVICES;
if (c->tasks_accounting ||
src/core/cgroup.h
+7
View File
@@ -359,6 +359,13 @@ static inline bool cgroup_context_want_memory_pressure(const CGroupContext *c) {
(c->memory_pressure_watch == CGROUP_PRESSURE_WATCH_AUTO && c->memory_accounting);
}
static inline bool cgroup_context_has_device_policy(const CGroupContext *c) {
assert(c);
return c->device_policy != CGROUP_DEVICE_POLICY_AUTO ||
c->device_allow;
}
int cgroup_context_add_device_allow(CGroupContext *c, const char *dev, CGroupDevicePermissions p);
int cgroup_context_add_or_update_device_allow(CGroupContext *c, const char *dev, CGroupDevicePermissions p);
int cgroup_context_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *path);
src/core/exec-credential.c
+1 -2
View File
@@ -445,8 +445,7 @@ static bool device_nodes_restricted(
if (c->private_devices)
return true;
if (cgroup_context->device_policy != CGROUP_DEVICE_POLICY_AUTO ||
cgroup_context->device_allow)
if (cgroup_context_has_device_policy(cgroup_context))
return true;
return false;
src/core/unit.c
+1 -1
View File
@@ -4425,7 +4425,7 @@ int unit_patch_contexts(Unit *u) {
cc->device_policy = CGROUP_DEVICE_POLICY_CLOSED;
/* Only add these if needed, as they imply that everything else is blocked. */
if (cc->device_policy != CGROUP_DEVICE_POLICY_AUTO || cc->device_allow) {
if (cgroup_context_has_device_policy(cc)) {
if (ec->root_image || ec->mount_images) {
/* When RootImage= or MountImages= is specified, the following devices are touched. */