Skip to content

Commit

Permalink
Fixes inability to use /dev/null when inside a container
Browse files Browse the repository at this point in the history
The original code depended on the origin filesystem to have
/dev/{block,char} populated. This is done by udev normally and while is
very common non-containerized systemd installs, it's very easy to start
systemd in a container created by runc itself and not have
/dev/{block,char} populated. When this occurs, the following error
output is observed:

$ docker run hello-world
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error reopening /dev/null inside container: open /dev/null: operation not permitted: unknown.

/dev/null can't be opened because it was not added to the
deviceAllowList, as there was no /dev/char directory. The change here
utilizes the fact that when sysfs in in use, there is a
/sys/dev/{block,char} that is kernel maintained that we can check.

Signed-off-by: Evan Phoenix <evan@phx.io>
  • Loading branch information
evanphx committed Oct 13, 2022
1 parent 28fa513 commit 7fa15e0
Showing 1 changed file with 12 additions and 2 deletions.
14 changes: 12 additions & 2 deletions libcontainer/cgroups/systemd/common.go
Original file line number Diff line number Diff line change
Expand Up @@ -293,8 +293,18 @@ func generateDeviceProperties(r *configs.Resources) ([]systemdDbus.Property, err
// rules separately to systemd) we can safely skip entries that don't
// have a corresponding path.
if _, err := os.Stat(entry.Path); err != nil {
logrus.Debugf("skipping device %s for systemd: %s", entry.Path, err)
continue
// Also check /sys/dev so that we don't depend on /dev/{block,char}
// being populated. (/dev/{block,char} is populated by udev, which
// isn't strictly required for systemd). Ironically, this happens most
// easily when starting containerd within a runc created container
// itself.

// We don't bother with securejoin here because we create entry.Path
// right above here, so we know it's safe.
if _, err := os.Stat("/sys" + entry.Path); err != nil {
logrus.Warnf("skipping device %s for systemd: %s", entry.Path, err)
continue
}
}
}
deviceAllowList = append(deviceAllowList, entry)
Expand Down

0 comments on commit 7fa15e0

Please sign in to comment.