core: support globbing matches in DeviceAllow= when checking for device groups

diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml
index c3fd5fcee4151d95e618a78c06a8e508636b9a3c..a51e600ebb38f9488e8c8495467d15c95eb23412 100644 (file)
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@@ -275,12 +275,16 @@ along with systemd; If not, see <http://www.gnu.org/licenses/>.
           followed by a device group name, as listed in
           <filename>/proc/devices</filename>. The latter is useful to
           whitelist all current and future devices belonging to a
-          specific device group at once. Examples:
-          <filename>/dev/sda5</filename> is a path to a device node,
-          referring to an ATA or SCSI block
+          specific device group at once. The device group is matched
+          according to file name globbing rules, you may hence use the
+          <literal>*</literal> and <literal>?</literal>
+          wildcards. Examples: <filename>/dev/sda5</filename> is a
+          path to a device node, referring to an ATA or SCSI block
           device. <literal>char-pts</literal> and
           <literal>char-alsa</literal> are specifiers for all pseudo
-          TTYs and all ALSA sound devices, respectively.</para>
+          TTYs and all ALSA sound devices,
+          respectively. <literal>char-cpu/*</literal> is a specifier
+          matching all CPU related device groups.</para>
         </listitem>
       </varlistentry>
 

diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 1327486509a6eaaf54af54119087f077f8429f42..18de888ba677b6d7ae7cc43ea46bd19bdda2acd1 100644 (file)
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -20,6 +20,7 @@
 ***/
 
 #include <fcntl.h>
+#include <fnmatch.h>
 
 #include "path-util.h"
 #include "special.h"
@@ -246,7 +247,8 @@ static int whitelist_major(const char *path, const char *name, char type, const
 
                 w++;
                 w += strspn(w, WHITESPACE);
-                if (!streq(w, name))
+
+                if (fnmatch(name, w, 0) != 0)
                         continue;
 
                 sprintf(buf,