(path string, devices []specs.LinuxDeviceCgroup)
| 893 | } |
| 894 | |
| 895 | func setDevices(path string, devices []specs.LinuxDeviceCgroup) error { |
| 896 | if len(devices) == 0 { |
| 897 | return nil |
| 898 | } |
| 899 | insts, license, err := DeviceFilter(devices) |
| 900 | if err != nil { |
| 901 | return err |
| 902 | } |
| 903 | dirFD, err := unix.Open(path, unix.O_DIRECTORY|unix.O_RDONLY|unix.O_CLOEXEC, 0o600) |
| 904 | if err != nil { |
| 905 | return fmt.Errorf("cannot get dir FD for %s", path) |
| 906 | } |
| 907 | defer unix.Close(dirFD) |
| 908 | if _, err := LoadAttachCgroupDeviceFilter(insts, license, dirFD); err != nil { |
| 909 | if !canSkipEBPFError(devices) { |
| 910 | return err |
| 911 | } |
| 912 | } |
| 913 | return nil |
| 914 | } |
| 915 | |
| 916 | // getSystemdFullPath returns the full systemd path when creating a systemd slice group. |
| 917 | // the reason this is necessary is because the "-" character has a special meaning in |
no test coverage detected
searching dependent graphs…