Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
cgroupv2: ebpf: ignore inaccessible existing programs
This is necessary in order for runc to be able to configure device cgroups with --systemd-cgroup on distributions that have very strict SELinux policies such as openSUSE MicroOS[1]. The core issue here is that systemd is adding its own BPF policy that has an SELinux label such that runc cannot interact with it. In order to work around this, we can just ignore the policy -- in theory this behaviour is not correct but given that the most obvious case (--systemd-cgroup) will still handle updates correctly, this logic is reasonable. [1]: https://bugzilla.suse.com/show_bug.cgi?id=1182428 Fixes: d0f2c25 ("cgroup2: devices: replace all existing filters when attaching") Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (cherry picked from commit 57e3c54) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
- Loading branch information