From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 19 Mar 2014 21:00:43 +0000 (+0100)
Subject: core: make sure we can combine DevicePolicy=closed with PrivateDevices=yes
X-Git-Tag: v212~78
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=7d711efb9c6fd6d025cb688aa8317ce6a78db711

core: make sure we can combine DevicePolicy=closed with PrivateDevices=yes

if PrivateDevices=yes is used we need to make sure we can still
create /dev/null and so on.
---

diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 9cc8544fc..3dd4c9129 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -364,16 +364,22 @@ void cgroup_context_apply(CGroupContext *c, CGroupControllerMask mask, const cha
                 if (c->device_policy == CGROUP_CLOSED ||
                     (c->device_policy == CGROUP_AUTO && c->device_allow)) {
                         static const char auto_devices[] =
-                                "/dev/null\0" "rw\0"
-                                "/dev/zero\0" "rw\0"
-                                "/dev/full\0" "rw\0"
-                                "/dev/random\0" "rw\0"
-                                "/dev/urandom\0" "rw\0";
+                                "/dev/null\0" "rwm\0"
+                                "/dev/zero\0" "rwm\0"
+                                "/dev/full\0" "rwm\0"
+                                "/dev/random\0" "rwm\0"
+                                "/dev/urandom\0" "rwm\0"
+                                "/dev/tty\0" "rwm\0"
+                                "/dev/pts/ptmx\0" "rw\0"; /* /dev/pts/ptmx may not be duplicated, but accessed */
 
                         const char *x, *y;
 
                         NULSTR_FOREACH_PAIR(x, y, auto_devices)
                                 whitelist_device(path, x, y);
+
+                        whitelist_major(path, "pts", 'c', "rw");
+                        whitelist_major(path, "kdbus", 'c', "rw");
+                        whitelist_major(path, "kdbus/*", 'c', "rw");
                 }
 
                 LIST_FOREACH(device_allow, a, c->device_allow) {