Hi, On Thu, Nov 19, 2015 at 7:42 AM, von Thadden, Joachim, SEVEN PRINCIPLES <[email protected]> wrote: > using systemd 219-25 on Fedora 22 on a freshly created container I can not > make any > device. Usage of --capability=CAP_MKNOD makes no difference. > > Steps to reproduce: > [root@nbl ~]# machinectl pull-raw --verify=no > http://ftp.halifax.rwth-aachen.de/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz > [root@nbl ~]# systemd-nspawn --capability=CAP_MKNOD -M > Fedora-Cloud-Base-20141203-21.x86_64 > [root@Fedora-Cloud-Base-20141203-21 ~]# strace -f mknod /dev/loop0 b 7 0 > mknod("/dev/loop0", S_IFBLK|0666, makedev(7, 0)) = -1 EPERM (Operation not > permitted)
This is likely being caused by the use of the "devices" namespace, which prevents you from using specific character and block devices inside a cgroup. nspawn now sets these by default. Calling systemd-nspawn with --property='DeviceAllow=/dev/loop0 rwm' should allow it to mknod and later use it in losetup as well. HTH! Filipe _______________________________________________ systemd-devel mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/systemd-devel
