github.com/pf-qiu/concourse/v6@v6.7.3-0.20201207032516-1f455d73275f/worker/runtime/spec/devices.go (about)

     1  package spec
     2  
     3  import "github.com/opencontainers/runtime-spec/specs-go"
     4  
     5  var (
     6  	AnyContainerDevices = []specs.LinuxDeviceCgroup{
     7  		// runc allows these
     8  		{Access: "m", Type: "c", Major: deviceWildcard(), Minor: deviceWildcard(), Allow: true},
     9  		{Access: "m", Type: "b", Major: deviceWildcard(), Minor: deviceWildcard(), Allow: true},
    10  
    11  		{Access: "rwm", Type: "c", Major: intRef(1), Minor: intRef(3), Allow: true},          // /dev/null
    12  		{Access: "rwm", Type: "c", Major: intRef(1), Minor: intRef(8), Allow: true},          // /dev/random
    13  		{Access: "rwm", Type: "c", Major: intRef(1), Minor: intRef(7), Allow: true},          // /dev/full
    14  		{Access: "rwm", Type: "c", Major: intRef(5), Minor: intRef(0), Allow: true},          // /dev/tty
    15  		{Access: "rwm", Type: "c", Major: intRef(1), Minor: intRef(5), Allow: true},          // /dev/zero
    16  		{Access: "rwm", Type: "c", Major: intRef(1), Minor: intRef(9), Allow: true},          // /dev/urandom
    17  		{Access: "rwm", Type: "c", Major: intRef(136), Minor: deviceWildcard(), Allow: true}, // /dev/pts/*
    18  		{Access: "rwm", Type: "c", Major: intRef(5), Minor: intRef(2), Allow: true},          // /dev/ptmx
    19  		{Access: "rwm", Type: "c", Major: intRef(10), Minor: intRef(200), Allow: true},       // /dev/net/tun
    20  
    21  		// we allow this
    22  		{Access: "rwm", Type: "c", Major: intRef(10), Minor: intRef(229), Allow: true}, // /dev/fuse
    23  	}
    24  
    25  	PrivilegedOnlyDevices = []specs.LinuxDeviceCgroup{
    26  		{Allow: false, Access: "rwm"},
    27  	}
    28  )
    29  
    30  func intRef(i int64) *int64  { return &i }
    31  func deviceWildcard() *int64 { return intRef(-1) }