From ba1c57030f10ece60678a848e04375e4cd2c843d Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 29 Aug 2019 22:47:15 +0200 Subject: rootless: bind mount devices instead of creating them when running in rootless mode, --device creates a bind mount from the host instead of specifying the device in the OCI configuration. This is required as an unprivileged user cannot use mknod, even when root in a user namespace. Closes: https://github.com/containers/libpod/issues/3905 Signed-off-by: Giuseppe Scrivano --- pkg/spec/config_linux.go | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'pkg/spec/config_linux.go') diff --git a/pkg/spec/config_linux.go b/pkg/spec/config_linux.go index 60d31d78e..dea9b393c 100644 --- a/pkg/spec/config_linux.go +++ b/pkg/spec/config_linux.go @@ -98,6 +98,26 @@ func addDevice(g *generate.Generator, device string) error { if err != nil { return errors.Wrapf(err, "%s is not a valid device", src) } + if rootless.IsRootless() { + if _, err := os.Stat(src); err != nil { + if os.IsNotExist(err) { + return errors.Wrapf(err, "the specified device %s doesn't exist", src) + } + return errors.Wrapf(err, "stat device %s exist", src) + } + perm := "ro" + if strings.Contains(permissions, "w") { + perm = "rw" + } + devMnt := spec.Mount{ + Destination: dst, + Type: TypeBind, + Source: src, + Options: []string{"slave", "nosuid", "noexec", perm, "rbind"}, + } + g.Config.Mounts = append(g.Config.Mounts, devMnt) + return nil + } dev.Path = dst linuxdev := spec.LinuxDevice{ Path: dev.Path, -- cgit v1.2.3-54-g00ecf