units: Split modprobing out into a separate service unit
Devices referred to by `DeviceAllow=` sandboxing are resolved into their corresponding major numbers when the unit is loaded by looking at `/proc/devices`. If a reference is made to a device which is not yet available, the `DeviceAllow` is ignored and the unit's processes cannot access that device. In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe` in `ExecStartPre=` to load some kernel modules. Those kernel modules cause device nodes to become available when they are loaded: the device nodes may not exist when the unit itself is loaded. This means that the unit's processes will not be able to access the device since the `DeviceAllow=` will have been resolved earlier and denied it. One way to fix this would be to re-evaluate the available devices and re-apply the policy to the cgroup, but this cannot work atomically on cgroupsv1. So we fall back to a second approach: instead of running `modprobe` via `ExecStartPre`, we move this out to a separate unit and order it before the units which want the module. Closes #14322. Fixes: #13943.
This commit is contained in:
parent
7a182f1034
commit
625077264b
|
@ -35,6 +35,7 @@ units = [
|
||||||
['local-fs.target', ''],
|
['local-fs.target', ''],
|
||||||
['machine.slice', 'ENABLE_MACHINED'],
|
['machine.slice', 'ENABLE_MACHINED'],
|
||||||
['machines.target', 'ENABLE_MACHINED'],
|
['machines.target', 'ENABLE_MACHINED'],
|
||||||
|
['modprobe@.service', ''],
|
||||||
['multi-user.target', '',
|
['multi-user.target', '',
|
||||||
'runlevel2.target runlevel3.target runlevel4.target'],
|
'runlevel2.target runlevel3.target runlevel4.target'],
|
||||||
['network-online.target', ''],
|
['network-online.target', ''],
|
||||||
|
|
|
@ -0,0 +1,16 @@
|
||||||
|
# SPDX-License-Identifier: LGPL-2.1+
|
||||||
|
#
|
||||||
|
# This file is part of systemd.
|
||||||
|
#
|
||||||
|
# systemd is free software; you can redistribute it and/or modify it
|
||||||
|
# under the terms of the GNU Lesser General Public License as published by
|
||||||
|
# the Free Software Foundation; either version 2.1 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
|
||||||
|
[Unit]
|
||||||
|
Description=Load kernel module %i
|
||||||
|
Documentation=man:modprobe(8)
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
ExecStart=-/sbin/modprobe -abq %I
|
|
@ -12,8 +12,8 @@ Description=Login Service
|
||||||
Documentation=man:systemd-logind.service(8) man:logind.conf(5)
|
Documentation=man:systemd-logind.service(8) man:logind.conf(5)
|
||||||
Documentation=https://www.freedesktop.org/wiki/Software/systemd/logind
|
Documentation=https://www.freedesktop.org/wiki/Software/systemd/logind
|
||||||
Documentation=https://www.freedesktop.org/wiki/Software/systemd/multiseat
|
Documentation=https://www.freedesktop.org/wiki/Software/systemd/multiseat
|
||||||
Wants=user.slice
|
Wants=user.slice modprobe@drm.service
|
||||||
After=nss-user-lookup.target user.slice
|
After=nss-user-lookup.target user.slice modprobe@drm.service
|
||||||
|
|
||||||
# Ask for the dbus socket.
|
# Ask for the dbus socket.
|
||||||
Wants=dbus.socket
|
Wants=dbus.socket
|
||||||
|
@ -29,7 +29,6 @@ DeviceAllow=char-input rw
|
||||||
DeviceAllow=char-tty rw
|
DeviceAllow=char-tty rw
|
||||||
DeviceAllow=char-vcs rw
|
DeviceAllow=char-vcs rw
|
||||||
# Make sure the DeviceAllow= lines above can work correctly when referenceing char-drm
|
# Make sure the DeviceAllow= lines above can work correctly when referenceing char-drm
|
||||||
ExecStartPre=-/sbin/modprobe -abq drm
|
|
||||||
ExecStart=@rootlibexecdir@/systemd-logind
|
ExecStart=@rootlibexecdir@/systemd-logind
|
||||||
FileDescriptorStoreMax=512
|
FileDescriptorStoreMax=512
|
||||||
IPAddressDeny=any
|
IPAddressDeny=any
|
||||||
|
|
|
@ -10,14 +10,14 @@
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=Container %i
|
Description=Container %i
|
||||||
Documentation=man:systemd-nspawn(1)
|
Documentation=man:systemd-nspawn(1)
|
||||||
|
Wants=modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service
|
||||||
PartOf=machines.target
|
PartOf=machines.target
|
||||||
Before=machines.target
|
Before=machines.target
|
||||||
After=network.target systemd-resolved.service
|
After=network.target systemd-resolved.service modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service
|
||||||
RequiresMountsFor=/var/lib/machines
|
RequiresMountsFor=/var/lib/machines
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
# Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others)
|
# Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others)
|
||||||
ExecStartPre=-/sbin/modprobe -abq tun loop dm-mod
|
|
||||||
ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
|
ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
|
||||||
KillMode=mixed
|
KillMode=mixed
|
||||||
Type=notify
|
Type=notify
|
||||||
|
|
Loading…
Reference in New Issue