Allow /sys to be RW for a priveleged container.

In order to make this work properly the systemd's device mechanism
needs to be turned off as if /sys was RO.



---
 src/core/device.c |   24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

--- a/src/core/device.c
+++ b/src/core/device.c
@@ -768,15 +768,37 @@ static int device_dispatch_io(sd_event_s
         return 0;
 }
 
+#define CONTAINER_CHECK_PATH "/etc/system-id"
+
 static bool device_supported(void) {
         static int read_only = -1;
 
         /* If /sys is read-only we don't support device units, and any
          * attempts to start one should fail immediately. */
 
-        if (read_only < 0)
+        if (read_only < 0) {
                 read_only = path_is_read_only_fs("/sys");
 
+                /* Secondardy check against container */
+                if (!read_only) {
+                        size_t len = 0;
+                        ssize_t read;
+                        char *buf = NULL;
+                        FILE *F = fopen("/proc/mounts", "r");
+                        if (F) {
+                                while ((read = getline(&buf, &len, F)) != -1) {
+                                        if (strstr(buf,CONTAINER_CHECK_PATH)) {
+                                                read_only = 1;
+                                                break;
+                                        }
+                                }
+                                if (buf)
+                                        free(buf);
+                                fclose(F);
+                        }
+                }
+       }
+
         return read_only <= 0;
 }
 

Allow /sys to be RW for a priveleged container.

In order to make this work properly the systemd's device mechanism
needs to be turned off as if /sys was RO.



---
 src/core/device.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/src/core/device.c
+++ b/src/core/device.c
@@ -774,9 +774,19 @@ static bool device_supported(void) {
         /* If /sys is read-only we don't support device units, and any
          * attempts to start one should fail immediately. */
 
-        if (read_only < 0)
+        if (read_only < 0) {
                 read_only = path_is_read_only_fs("/sys");
 
+                /* Secondardy check against container */
+                if (!read_only) {
+                        const char *c;
+
+                        c = getenv("container");
+                        if (!isempty(c))
+                                read_only = 1;
+                }
+       }
+
         return read_only <= 0;
 }
 

Use container variable for /sys RW check
systemd: Use container variable for /sys RW check

The container variable is universal for containers and should be used
instead of checking for a bind mount for the case where /sys should be
allowed to be RW.

Signed-off-by: Jason Wessel <3f19c87103ac4cd0301ffd05a2421b687c7b3c77@windriver.com>
Signed-off-by: Bruce Ashfield <284cc737d174a260eec2a2a6324a304f84b1ae0f@windriver.com>
