| 218 | |
| 219 | |
| 220 | static Try<Nothing> makeDevicesDir( |
| 221 | const string& devicesDir, |
| 222 | const Option<string>& username) |
| 223 | { |
| 224 | Try<Nothing> mkdir = os::mkdir(devicesDir); |
| 225 | if (mkdir.isError()) { |
| 226 | return Error( |
| 227 | "Failed to create container devices directory: " + mkdir.error()); |
| 228 | } |
| 229 | |
| 230 | Try<Nothing> chmod = os::chmod(devicesDir, 0700); |
| 231 | if (chmod.isError()) { |
| 232 | return Error( |
| 233 | "Failed to set container devices directory permissions: " + |
| 234 | chmod.error()); |
| 235 | } |
| 236 | |
| 237 | // We need to restrict access to the devices directory so that all |
| 238 | // processes on the system don't get access to devices that we make |
| 239 | // read-write. This means that we have to chown to ensure that the |
| 240 | // container user still has access. |
| 241 | if (username.isSome()) { |
| 242 | Try<Nothing> chown = os::chown(username.get(), devicesDir); |
| 243 | if (chown.isError()) { |
| 244 | return Error( |
| 245 | "Failed to set '" + username.get() + "' " |
| 246 | "as the container devices directory owner: " + chown.error()); |
| 247 | } |
| 248 | } |
| 249 | |
| 250 | return Nothing(); |
| 251 | } |
| 252 | |
| 253 | |
| 254 | // Make sure that the specified target directory is in a shared mount |