cgroups: systemd: skip adding device paths that don't exist

cyphar · cyphar · commit 7219387eb7db · 2022-06-08T09:48:24.000+10:00
systemd emits very loud warnings when the path specified doesn't exist
(which can be the case for some of our default rules). We don't need the
ruleset we give systemd to be completely accurate (we discard some kinds
of wildcard rules anyway) so we can safely skip adding these.

Signed-off-by: Aleksa Sarai &lt;cyphar@cyphar.com&gt;
diff --git a/libcontainer/cgroups/systemd/common.go b/libcontainer/cgroups/systemd/common.go
@@ -289,7 +289,13 @@ func generateDeviceProperties(r *configs.Resources) ([]systemdDbus.Property, err
 				entry.Path = fmt.Sprintf("/dev/char/%d:%d", rule.Major, rule.Minor)
 			}
 		}
-		deviceAllowList = append(deviceAllowList, entry)
+		// systemd will issue a warning if the path we give here doesn't exist.
+		// Since all of this logic is best-effort anyway (we manually set these
+		// rules separately to systemd) we can safely skip entries that don't
+		// have a corresponding path.
+		if _, err := os.Stat(entry.Path); err == nil {
+			deviceAllowList = append(deviceAllowList, entry)
+		}
 	}
 
 	properties = append(properties, newProp("DeviceAllow", deviceAllowList))

Original file line number	Diff line number	Diff line change
`@@ -289,7 +289,13 @@ func generateDeviceProperties(r *configs.Resources) ([]systemdDbus.Property, err`
`289`	`289`	`entry.Path = fmt.Sprintf("/dev/char/%d:%d", rule.Major, rule.Minor)`
`290`	`290`	`}`
`291`	`291`	`}`
`292`		`- deviceAllowList = append(deviceAllowList, entry)`
	`292`	`+ // systemd will issue a warning if the path we give here doesn't exist.`
	`293`	`+ // Since all of this logic is best-effort anyway (we manually set these`
	`294`	`+ // rules separately to systemd) we can safely skip entries that don't`
	`295`	`+ // have a corresponding path.`
	`296`	`+ if _, err := os.Stat(entry.Path); err == nil {`
	`297`	`+ deviceAllowList = append(deviceAllowList, entry)`
	`298`	`+ }`
`293`	`299`	`}`
`294`	`300`
`295`	`301`	`properties = append(properties, newProp("DeviceAllow", deviceAllowList))`