mirror of
https://github.com/containers/podman.git
synced 2025-12-05 21:32:22 +08:00
d50054f1e4
On FreeBSD, each container has its own devfs instance with a ruleset that controls what the container can see. To expose devices to a container we add rules to its devfs to make the requested devices visible. For privileged containers, we use 'ruleset=0' which makes everything visible. This shares the ParseDevice function with Linux so it moves to config_common.go from config_linux.go. Signed-off-by: Doug Rabson <dfr@rabson.org>
32 lines
902 B
Go
32 lines
902 B
Go
package generate
|
|
|
|
import (
|
|
"github.com/containers/common/libimage"
|
|
"github.com/containers/common/pkg/config"
|
|
"github.com/containers/podman/v4/libpod"
|
|
"github.com/containers/podman/v4/pkg/specgen"
|
|
"github.com/opencontainers/runtime-tools/generate"
|
|
)
|
|
|
|
// setLabelOpts sets the label options of the SecurityConfig according to the
|
|
// input.
|
|
func setLabelOpts(s *specgen.SpecGenerator, runtime *libpod.Runtime, pidConfig specgen.Namespace, ipcConfig specgen.Namespace) error {
|
|
return nil
|
|
}
|
|
|
|
func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, newImage *libimage.Image, rtc *config.Config) error {
|
|
// If this is a privileged container, change the devfs ruleset to expose all devices.
|
|
if s.Privileged {
|
|
for k, m := range g.Config.Mounts {
|
|
if m.Type == "devfs" {
|
|
m.Options = []string{
|
|
"ruleset=0",
|
|
}
|
|
g.Config.Mounts[k] = m
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|