From 227c07aebc8fc60b3fb7c870060af036be345a9d Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Mon, 26 Jun 2023 17:21:44 +0200 Subject: [PATCH] specgen: honor --device-cgroup-rule with a new user namespace Signed-off-by: Giuseppe Scrivano --- pkg/specgen/generate/oci_linux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/specgen/generate/oci_linux.go b/pkg/specgen/generate/oci_linux.go index 87159bbc4f..89c6e2288b 100644 --- a/pkg/specgen/generate/oci_linux.go +++ b/pkg/specgen/generate/oci_linux.go @@ -258,7 +258,7 @@ func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runt if isRootless && len(s.DeviceCgroupRule) > 0 { return nil, fmt.Errorf("device cgroup rules are not supported in rootless mode or in a user namespace") } - if !inUserNS && !s.Privileged { + if !isRootless && !s.Privileged { for _, dev := range s.DeviceCgroupRule { g.AddLinuxResourcesDevice(true, dev.Type, dev.Major, dev.Minor, dev.Access) }