From eff6ed2d5ffa5a1adeedc4fa0500b4b764dd2b80 Mon Sep 17 00:00:00 2001 From: Krister Johansen Date: Wed, 17 May 2023 16:21:32 -0700 Subject: [PATCH] runtime: make debug console work with sandbox_cgroup_only If a hypervisor debug console is enabled and sandbox_cgroup_only is set, the hypervisor can fail to open /dev/ptmx, which prevents the sandbox from launching. This is caused by the absence of a device cgroup entry to allow access to /dev/ptmx. When sandbox_cgroup_only is not set, the hypervisor inherits the default unrestrcited device cgroup, but with it enabled it runs into allow / deny list restrictions. Fix by adding an allowlist entry for /dev/ptmx when debug is enabled, sandbox_cgroup_only is true, and no /dev/ptmx is already in the list of devices. Fixes: #6870 Signed-off-by: Krister Johansen --- src/runtime/virtcontainers/sandbox.go | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/runtime/virtcontainers/sandbox.go b/src/runtime/virtcontainers/sandbox.go index 0eb866bb0..b0697fd84 100644 --- a/src/runtime/virtcontainers/sandbox.go +++ b/src/runtime/virtcontainers/sandbox.go @@ -697,6 +697,7 @@ func (s *Sandbox) createResourceController() error { // Determine if device /dev/null and /dev/urandom exist, and add if they don't nullDeviceExist := false urandomDeviceExist := false + ptmxDeviceExist := false for _, device := range resources.Devices { if device.Type == "c" && device.Major == intptr(1) && device.Minor == intptr(3) { nullDeviceExist = true @@ -705,6 +706,10 @@ func (s *Sandbox) createResourceController() error { if device.Type == "c" && device.Major == intptr(1) && device.Minor == intptr(9) { urandomDeviceExist = true } + + if device.Type == "c" && device.Major == intptr(5) && device.Minor == intptr(2) { + ptmxDeviceExist = true + } } if !nullDeviceExist { @@ -720,6 +725,18 @@ func (s *Sandbox) createResourceController() error { }...) } + // If the hypervisor debug console is enabled and + // sandbox_cgroup_only are configured, then the vmm needs access to + // /dev/ptmx. Add this to the device allowlist if it is not + // already present in the config. + if s.config.HypervisorConfig.Debug && s.config.SandboxCgroupOnly && !ptmxDeviceExist { + // "/dev/ptmx" + resources.Devices = append(resources.Devices, []specs.LinuxDeviceCgroup{ + {Type: "c", Major: intptr(5), Minor: intptr(2), Access: rwm, Allow: true}, + }...) + + } + if spec.Linux.Resources.CPU != nil { resources.CPU = &specs.LinuxCPU{ Cpus: spec.Linux.Resources.CPU.Cpus,