chiark / gitweb /
nspawn: actually allow access to /dev/net/tun in the container
authorLennart Poettering <lennart@poettering.net>
Fri, 10 Oct 2014 09:11:25 +0000 (11:11 +0200)
committerLennart Poettering <lennart@poettering.net>
Fri, 10 Oct 2014 09:11:25 +0000 (11:11 +0200)
It's not sufficient to just copy the device node over, we need to update
the policy for it too.

src/nspawn/nspawn.c

index da4c116..f04d326 100644 (file)
@@ -1558,6 +1558,7 @@ static int register_machine(pid_t pid, int local_ifindex) {
                                           "/dev/random", "rwm",
                                           "/dev/urandom", "rwm",
                                           "/dev/tty", "rwm",
                                           "/dev/random", "rwm",
                                           "/dev/urandom", "rwm",
                                           "/dev/tty", "rwm",
+                                          "/dev/net/tun", "rwm",
                                           /* Allow the container
                                            * access to ptys. However,
                                            * do not permit the
                                           /* Allow the container
                                            * access to ptys. However,
                                            * do not permit the