diff options
author | Iain Lane <iain.lane@canonical.com> | 2020-01-07 14:33:29 +0000 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2020-01-07 18:37:30 +0100 |
commit | 625077264ba01a108386eeea733ee244e6b7ff14 (patch) | |
tree | 467bc13e5b6dc3e9f323a8f9edcf51141e37e4c0 /units/meson.build | |
parent | 7a182f10343796eab92a8256e347c11b4be78ea7 (diff) | |
download | systemd-625077264ba01a108386eeea733ee244e6b7ff14.tar.gz |
units: Split modprobing out into a separate service unit
Devices referred to by `DeviceAllow=` sandboxing are resolved into their
corresponding major numbers when the unit is loaded by looking at
`/proc/devices`. If a reference is made to a device which is not yet
available, the `DeviceAllow` is ignored and the unit's processes cannot
access that device.
In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe`
in `ExecStartPre=` to load some kernel modules. Those kernel modules
cause device nodes to become available when they are loaded: the device
nodes may not exist when the unit itself is loaded. This means that the
unit's processes will not be able to access the device since the
`DeviceAllow=` will have been resolved earlier and denied it.
One way to fix this would be to re-evaluate the available devices and
re-apply the policy to the cgroup, but this cannot work atomically on
cgroupsv1. So we fall back to a second approach: instead of running
`modprobe` via `ExecStartPre`, we move this out to a separate unit and
order it before the units which want the module.
Closes #14322.
Fixes: #13943.
Diffstat (limited to 'units/meson.build')
-rw-r--r-- | units/meson.build | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/units/meson.build b/units/meson.build index c809011fc5..4ad64d12f2 100644 --- a/units/meson.build +++ b/units/meson.build @@ -35,6 +35,7 @@ units = [ ['local-fs.target', ''], ['machine.slice', 'ENABLE_MACHINED'], ['machines.target', 'ENABLE_MACHINED'], + ['modprobe@.service', ''], ['multi-user.target', '', 'runlevel2.target runlevel3.target runlevel4.target'], ['network-online.target', ''], |