From 7f3dd4bdb8ab9b861c876c6332562cf6065a9102 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 4 May 2022 14:56:16 -0700 Subject: [PATCH] Remove tun/tap from the default device rules Looking through git blame, this was added by commit 9fac18329 aka "Initial commit of runc binary", most probably by mistake. Obviously, a container should not have access to tun/tap device, unless it is explicitly specified in configuration. Now, removing this might create a compatibility issue, but I see no other choice. Aside from the obvious misconfiguration, this should also fix the annoying > Apr 26 03:46:56 foo.bar systemd[1]: Couldn't stat device /dev/char/10:200: No such file or directory messages from systemd on every container start, when runc uses systemd cgroup driver, and the system runs an old (< v240) version of systemd (the message was presumably eliminated by [1]). [1] https://github.com/systemd/systemd/pull/10996/commits/d5aecba6e0b7c73657c4cf544ce57289115098e7 Signed-off-by: Kir Kolyshkin --- libcontainer/specconv/spec_linux.go | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go index 5ae95c6c18b..83c7a2c348c 100644 --- a/libcontainer/specconv/spec_linux.go +++ b/libcontainer/specconv/spec_linux.go @@ -302,16 +302,6 @@ var AllowedDevices = []*devices.Device{ Allow: true, }, }, - // tuntap - { - Rule: devices.Rule{ - Type: devices.CharDevice, - Major: 10, - Minor: 200, - Permissions: "rwm", - Allow: true, - }, - }, } type CreateOpts struct {